fix: reject NumericDates outside Instant range

Author: ANSHUL-REAL

lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java

@@ -13,6 +13,7 @@
 import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
 
 import java.io.IOException;
+import java.time.DateTimeException;
 import java.time.Instant;
 import java.util.*;
 
@@ -88,7 +89,13 @@ Instant getInstantFromSeconds(Map<String, JsonNode> tree, String claimName) {
                     "The claim '%s' value (%s) is out of the range representable as a NumericDate.",
                     claimName, node.asText()));
         }
-        return Instant.ofEpochSecond(node.asLong());
+        try {
+            return Instant.ofEpochSecond(node.asLong());
+        } catch (DateTimeException e) {
+            throw new JWTDecodeException(String.format(
+                    "The claim '%s' value (%s) is out of the range representable as a NumericDate.",
+                    claimName, node.asText()), e);
+        }
     }
 
     String getString(Map<String, JsonNode> tree, String claimName) {

lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java

@@ -269,6 +269,18 @@ public void shouldThrowOutOfRangeWhenNumericDateExceedsLong() {
         deserializer.getInstantFromSeconds(tree, "key");
     }
 
+    @Test
+    public void shouldThrowOutOfRangeWhenNumericDateExceedsInstantRange() {
+        exception.expect(JWTDecodeException.class);
+        exception.expectMessage(
+                "The claim 'key' value (9223372036854775807) is out of the range representable as a NumericDate.");
+
+        Map<String, JsonNode> tree = new HashMap<>();
+        tree.put("key", new LongNode(Long.MAX_VALUE));
+
+        deserializer.getInstantFromSeconds(tree, "key");
+    }
+
     @Test
     public void shouldGetNullStringWhenParsingNullNode() {
         Map<String, JsonNode> tree = new HashMap<>();
@@ -299,4 +311,4 @@ public void shouldGetStringWhenParsingTextNode() {
         assertThat(text, is("something here"));
     }
 
-}
+}