Reject out-of-range long and float values in NumberConverter (1.X)

src/main/java/org/apache/commons/beanutils/converters/NumberConverter.java

@@ -481,6 +481,14 @@ private <T> T toNumber(final Class<?> sourceType, final Class<T> targetType, fin
 
         // Long
         if (targetType.equals(Long.class)) {
+            if (value.doubleValue() > Long.MAX_VALUE) {
+                throw new ConversionException(toString(sourceType) + " value '" + value
+                        + "' is too large for " + toString(targetType));
+            }
+            if (value.doubleValue() < Long.MIN_VALUE) {
+                throw new ConversionException(toString(sourceType) + " value '" + value
+                        + "' is too small " + toString(targetType));
+            }
             return targetType.cast(Long.valueOf(value.longValue()));
         }
 
@@ -490,6 +498,10 @@ private <T> T toNumber(final Class<?> sourceType, final Class<T> targetType, fin
                 throw new ConversionException(toString(sourceType) + " value '" + value
                         + "' is too large for " + toString(targetType));
             }
+            if (value.doubleValue() < -Float.MAX_VALUE) {
+                throw new ConversionException(toString(sourceType) + " value '" + value
+                        + "' is too small " + toString(targetType));
+            }
             return targetType.cast(Float.valueOf(value.floatValue()));
         }
 

src/test/java/org/apache/commons/beanutils/converters/FloatConverterTest.java

@@ -67,19 +67,32 @@ public void testInvalidAmount() {
         final Converter converter = makeConverter();
         final Class<?> clazz = Float.class;
 
-        final Double max     = Double.valueOf(Float.MAX_VALUE);
-        final Double tooBig  = Double.valueOf(Double.MAX_VALUE);
+        final Double max      = Double.valueOf(Float.MAX_VALUE);
+        final Double min      = Double.valueOf(-Float.MAX_VALUE);
+        final Double tooBig   = Double.valueOf(Double.MAX_VALUE);
+        final Double tooSmall = Double.valueOf(-Double.MAX_VALUE);
 
         // Maximum
         assertEquals("Maximum", Float.valueOf(Float.MAX_VALUE), converter.convert(clazz, max));
 
+        // Minimum
+        assertEquals("Minimum", Float.valueOf(-Float.MAX_VALUE), converter.convert(clazz, min));
+
         // Too Large
         try {
             assertEquals("Too Big", null, converter.convert(clazz, tooBig));
             fail("More than maximum, expected ConversionException");
         } catch (final Exception e) {
             // expected result
         }
+
+        // Too Small
+        try {
+            assertEquals("Too Small", null, converter.convert(clazz, tooSmall));
+            fail("Less than minimum, expected ConversionException");
+        } catch (final Exception e) {
+            // expected result
+        }
     }
 
     public void testSimpleConversion() throws Exception {

src/test/java/org/apache/commons/beanutils/converters/LongConverterTest.java

@@ -17,6 +17,9 @@
 
 package org.apache.commons.beanutils.converters;
 
+import java.math.BigInteger;
+import java.util.Locale;
+
 import org.apache.commons.beanutils.Converter;
 
 /**
@@ -60,6 +63,53 @@ public void tearDown() throws Exception {
         converter = null;
     }
 
+    /**
+     * Test Invalid Amounts (too big/small)
+     */
+    public void testInvalidAmount() {
+        final Converter converter = makeConverter();
+        final Class<?> clazz = Long.class;
+
+        // Boundaries still convert
+        assertEquals("Minimum", Long.valueOf(Long.MIN_VALUE), converter.convert(clazz, Long.valueOf(Long.MIN_VALUE)));
+        assertEquals("Maximum", Long.valueOf(Long.MAX_VALUE), converter.convert(clazz, Long.valueOf(Long.MAX_VALUE)));
+
+        // Out of range values must be rejected, not silently truncated/clamped
+        final BigInteger tooSmall = BigInteger.valueOf(Long.MIN_VALUE).multiply(BigInteger.TEN);
+        final BigInteger tooBig   = BigInteger.valueOf(Long.MAX_VALUE).multiply(BigInteger.TEN);
+
+        // Too Small
+        try {
+            converter.convert(clazz, tooSmall);
+            fail("Less than minimum, expected ConversionException");
+        } catch (final Exception e) {
+            // expected result
+        }
+
+        // Too Large
+        try {
+            converter.convert(clazz, tooBig);
+            fail("More than maximum, expected ConversionException");
+        } catch (final Exception e) {
+            // expected result
+        }
+    }
+
+    /**
+     * A locale-parsed String beyond long range comes back from DecimalFormat as a Double and must be
+     * rejected rather than clamped to Long.MAX_VALUE.
+     */
+    public void testLocaleStringOutOfRange() {
+        final NumberConverter converter = makeConverter();
+        converter.setLocale(Locale.US);
+        try {
+            converter.convert(Long.class, "99999999999999999999");
+            fail("More than maximum, expected ConversionException");
+        } catch (final Exception e) {
+            // expected result
+        }
+    }
+
     public void testSimpleConversion() throws Exception {
         final String[] message= {
             "from String",