From 739bf7cb509c20141093d5a7f553007c8af81129 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Fri, 19 Dec 2025 23:49:05 +0000
Subject: [PATCH] soup-message-headers: Reject invalid Range ends longer than
 the content

If the `Range` header in a request specifies a range longer than the
full content, it should be rejected. Previously, only the start of the
range was validated, rather than the start and the end. This led to an
assertion failure in `g_bytes_new_from_bytes()` (or a buffer overflow if
GLib was compiled with `G_DISABLE_CHECKS`, which is not recommended).

Add the missing check on the Range end, and add a unit test.

Spotted by Codean Labs.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Fixes: #487
---
 libsoup/soup-message-headers.c | 4 +++-
 1 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
index e8d0beea..f0a938bf 100644
--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
@@ -1238,7 +1238,9 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders  *hdrs,
 		if (*end) {
 			status = SOUP_STATUS_OK;
 			break;
-		} else if (check_satisfiable && cur.start >= total_length) {
+		} else if (check_satisfiable &&
+			   (cur.start >= total_length ||
+			    cur.end >= total_length)) {
 			if (status == SOUP_STATUS_OK)
 				status = SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE;
 			continue;