tree 00fea98a284a5a90d2f8b91f18194853689a0a29
parent be9ed03f1aa5f348aa836c4ffe1904d8e37a629a
author Emmanuel T Odeke <emmanuel@orijtech.com> 1599034082 -0700
committer Emmanuel Odeke <emm.odeke@gmail.com> 1599083441 +0000

net/http: reject negative suffix-length Range:bytes=--N with 416 status code

Fixes the file server to reject requests of the form:
    "Range": "bytes=--N"
where "-N" is a negative suffix-length as designated by the
grammar in RFC 7233 Section 2.1, "Byte-Ranges", which specifies
that suffix-length MUST be of the form 1*DIGIT aka a non-negative digit.

Thus requests such as:
    "Range": "bytes=--2"
will be rejected with a "416 Range Not Satisfiable" response.

Fixes #40940

Change-Id: I3e89f8326c14af30d8bdb126998a50e02ba002d9
Reviewed-on: https://go-review.googlesource.com/c/go/+/252497
Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>