@@ -89,7 +89,7 @@ impl fmt::Display for PolicyError {
8989 }
9090 PolicyError :: NonBinaryArgOr => f. write_str ( "Or policy fragment must take 2 arguments" ) ,
9191 PolicyError :: IncorrectThresh => {
92- f. write_str ( "Threshold k must be greater than 0 and less than n" )
92+ f. write_str ( "Threshold k must be greater than 0 and less than or equal to n 0<k<= n" )
9393 }
9494 PolicyError :: TimeTooFar => {
9595 f. write_str ( "Relative/Absolute time must be less than 2^31; n < 2^31" )
@@ -382,12 +382,24 @@ where
382382 }
383383 match ( frag_name, top. args . len ( ) as u32 ) {
384384 ( "pk" , 1 ) => expression:: terminal ( & top. args [ 0 ] , |pk| Pk :: from_str ( pk) . map ( Policy :: Key ) ) ,
385- ( "after" , 1 ) => expression:: terminal ( & top. args [ 0 ] , |x| {
386- expression:: parse_num ( x) . map ( Policy :: After )
387- } ) ,
388- ( "older" , 1 ) => expression:: terminal ( & top. args [ 0 ] , |x| {
389- expression:: parse_num ( x) . map ( Policy :: Older )
390- } ) ,
385+ ( "after" , 1 ) => {
386+ let num = expression:: terminal ( & top. args [ 0 ] , |x| expression:: parse_num ( x) ) ?;
387+ if num > 2u32 . pow ( 31 ) {
388+ return Err ( Error :: PolicyError ( PolicyError :: TimeTooFar ) ) ;
389+ } else if num == 0 {
390+ return Err ( Error :: PolicyError ( PolicyError :: ZeroTime ) ) ;
391+ }
392+ Ok ( Policy :: After ( num) )
393+ }
394+ ( "older" , 1 ) => {
395+ let num = expression:: terminal ( & top. args [ 0 ] , |x| expression:: parse_num ( x) ) ?;
396+ if num > 2u32 . pow ( 31 ) {
397+ return Err ( Error :: PolicyError ( PolicyError :: TimeTooFar ) ) ;
398+ } else if num == 0 {
399+ return Err ( Error :: PolicyError ( PolicyError :: ZeroTime ) ) ;
400+ }
401+ Ok ( Policy :: Older ( num) )
402+ }
391403 ( "sha256" , 1 ) => expression:: terminal ( & top. args [ 0 ] , |x| {
392404 sha256:: Hash :: from_hex ( x) . map ( Policy :: Sha256 )
393405 } ) ,
@@ -402,7 +414,7 @@ where
402414 } ) ,
403415 ( "and" , _) => {
404416 if top. args . len ( ) != 2 {
405- return Err ( errstr ( "and fragment must have exactly two children" ) ) ;
417+ return Err ( Error :: PolicyError ( PolicyError :: NonBinaryArgAnd ) ) ;
406418 }
407419 let mut subs = Vec :: with_capacity ( top. args . len ( ) ) ;
408420 for arg in & top. args {
@@ -412,7 +424,7 @@ where
412424 }
413425 ( "or" , _) => {
414426 if top. args . len ( ) != 2 {
415- return Err ( errstr ( "or fragment must have exactly two children" ) ) ;
427+ return Err ( Error :: PolicyError ( PolicyError :: NonBinaryArgOr ) ) ;
416428 }
417429 let mut subs = Vec :: with_capacity ( top. args . len ( ) ) ;
418430 for arg in & top. args {
@@ -421,16 +433,13 @@ where
421433 Ok ( Policy :: Or ( subs) )
422434 }
423435 ( "thresh" , nsubs) => {
424- if top. args . is_empty ( ) {
425- return Err ( errstr ( "thresh without args" ) ) ;
426- }
427- if !top. args [ 0 ] . args . is_empty ( ) {
428- return Err ( errstr ( top. args [ 0 ] . args [ 0 ] . name ) ) ;
436+ if top. args . is_empty ( ) || !top. args [ 0 ] . args . is_empty ( ) {
437+ return Err ( Error :: PolicyError ( PolicyError :: IncorrectThresh ) ) ;
429438 }
430439
431440 let thresh = expression:: parse_num ( top. args [ 0 ] . name ) ?;
432- if thresh >= nsubs {
433- return Err ( errstr ( top . args [ 0 ] . name ) ) ;
441+ if thresh >= nsubs || thresh <= 0 {
442+ return Err ( Error :: PolicyError ( PolicyError :: IncorrectThresh ) ) ;
434443 }
435444
436445 let mut subs = Vec :: with_capacity ( top. args . len ( ) - 1 ) ;
0 commit comments