fix: http range underflow (#690)

src/utils.rs

@@ -121,7 +121,7 @@ pub fn parse_range(range: &str, size: u64) -> Option<Vec<(u64, u64)>> {
                     result.push((start, size - 1));
                 } else {
                     let end = end.parse::<u64>().ok()?;
-                    if end < size {
+                    if end < size && start <= end {
                         result.push((start, end));
                     } else {
                         return None;

tests/range.rs

@@ -104,3 +104,25 @@ fn get_file_multipart_range_invalid(server: TestServer) -> Result<(), Error> {
     assert_eq!(resp.headers().get("content-length").unwrap(), "0");
     Ok(())
 }
+
+#[rstest]
+fn get_file_range_reversed(server: TestServer) -> Result<(), Error> {
+    let resp = fetch!(b"GET", format!("{}index.html", server.url()))
+        .header("range", HeaderValue::from_static("bytes=10-1"))
+        .send()?;
+    assert_eq!(resp.status(), 416);
+    assert_eq!(resp.headers().get("content-range").unwrap(), "bytes */18");
+    assert_eq!(resp.headers().get("accept-ranges").unwrap(), "bytes");
+    Ok(())
+}
+
+#[rstest]
+fn get_file_multipart_range_reversed(server: TestServer) -> Result<(), Error> {
+    let resp = fetch!(b"GET", format!("{}index.html", server.url()))
+        .header("range", HeaderValue::from_static("bytes=10-1,20-2"))
+        .send()?;
+    assert_eq!(resp.status(), 416);
+    assert_eq!(resp.headers().get("content-range").unwrap(), "bytes */18");
+    assert_eq!(resp.headers().get("accept-ranges").unwrap(), "bytes");
+    Ok(())
+}