Fixing an Integer Overflow Issue

oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

@@ -383,7 +383,7 @@ public boolean isRequired(HttpResponse response) {
         responseData, "access_token", PARSE_ERROR_PREFIX);
     int expiresInSeconds = OAuth2Utils.validateInt32(
         responseData, "expires_in", PARSE_ERROR_PREFIX);
-    long expiresAtMilliseconds = clock.currentTimeMillis() + expiresInSeconds * 1000;
+    long expiresAtMilliseconds = clock.currentTimeMillis() + expiresInSeconds * 1000L;
     return new AccessToken(accessToken, new Date(expiresAtMilliseconds));
   }
 

oauth2_http/javatests/com/google/auth/oauth2/MockTokenServerTransport.java

@@ -65,6 +65,7 @@ public class MockTokenServerTransport extends MockHttpTransport {
   private IOException error;
   private Queue<IOException> responseErrorSequence = new ArrayDeque<IOException>();
   private Queue<LowLevelHttpResponse> responseSequence = new ArrayDeque<LowLevelHttpResponse>();
+  private int expiresInSeconds = 3600;
 
   public MockTokenServerTransport() {}
 
@@ -113,6 +114,10 @@ public void addResponseSequence(LowLevelHttpResponse... responses) {
     }
   }
 
+  public void setExpiresInSeconds(int expiresInSeconds) {
+    this.expiresInSeconds = expiresInSeconds;
+  }
+
   @Override
   public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
     buildRequestCount++;
@@ -187,7 +192,7 @@ public LowLevelHttpResponse execute() throws IOException {
           GenericJson refreshContents = new GenericJson();
           refreshContents.setFactory(JSON_FACTORY);
           refreshContents.put("access_token", accessToken);
-          refreshContents.put("expires_in", 3600);
+          refreshContents.put("expires_in", expiresInSeconds);
           refreshContents.put("token_type", "Bearer");
           if (refreshToken != null) {
             refreshContents.put("refresh_token", refreshToken);

oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java

@@ -44,6 +44,7 @@
 import com.google.api.client.json.JsonFactory;
 import com.google.api.client.json.webtoken.JsonWebSignature;
 import com.google.api.client.json.webtoken.JsonWebToken;
+import com.google.api.client.testing.http.FixedClock;
 import com.google.api.client.testing.http.MockLowLevelHttpResponse;
 import com.google.api.client.util.Clock;
 import com.google.api.client.util.Joiner;
@@ -291,6 +292,34 @@ public void refreshAccessToken_refreshesToken() throws IOException {
     TestUtils.assertContainsBearerToken(credentials.getRequestMetadata(CALL_URI), accessToken2);
   }
 
+  @Test
+  public void refreshAccessToken_tokenExpiry() throws IOException {
+    final String tokenString = "1/MkSJoj1xsli0AccessToken_NKPY2";
+    MockTokenServerTransportFactory transportFactory = new MockTokenServerTransportFactory();
+    MockTokenServerTransport transport = transportFactory.transport;
+    ServiceAccountCredentials credentials =
+        ServiceAccountCredentials.fromPkcs8(
+            SA_CLIENT_ID,
+            SA_CLIENT_EMAIL,
+            SA_PRIVATE_KEY_PKCS8,
+            SA_PRIVATE_KEY_ID,
+            SCOPES,
+            transportFactory,
+            null);
+    credentials.clock = new FixedClock(0L);
+
+    transport.addServiceAccount(SA_CLIENT_EMAIL, tokenString);
+    AccessToken accessToken = credentials.refreshAccessToken();
+    assertEquals(tokenString, accessToken.getTokenValue());
+    assertEquals(3600 * 1000L, accessToken.getExpirationTimeMillis().longValue());
+
+    // Test for large expires_in values (should not overflow).
+    transport.setExpiresInSeconds(3600 * 1000);
+    accessToken = credentials.refreshAccessToken();
+    assertEquals(tokenString, accessToken.getTokenValue());
+    assertEquals(3600 * 1000 * 1000L, accessToken.getExpirationTimeMillis().longValue());
+  }
+
   @Test
   public void refreshAccessToken_retriesIOException() throws IOException {
     final String accessToken1 = "1/MkSJoj1xsli0AccessToken_NKPY2";