From 029a8087a35bf8fcc3f6e5418af6ae996d640364 Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@gmx.de>
Date: Thu, 31 Jan 2013 22:51:21 +0100
Subject: [PATCH] httpd: fix rane requests

we gave wrong content-length in range requests. r->stop - r->start
is wrong because r->stop is the byte offset of the *last* byte, not
the *next* byte after the last.
---
 sys/src/cmd/ip/httpd/sendfd.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sys/src/cmd/ip/httpd/sendfd.c b/sys/src/cmd/ip/httpd/sendfd.c
index 6ae4e7d73..b3ef1c13b 100644
--- a/sys/src/cmd/ip/httpd/sendfd.c
+++ b/sys/src/cmd/ip/httpd/sendfd.c
@@ -127,7 +127,7 @@ sendfd(HConnect *c, int fd, Dir *dir, HContent *type, HContent *enc)
 			hprint(hout, "Content-Length: %lld\r\n", length);
 		else if(r->next == nil){
 			hprint(hout, "Content-Range: bytes %ld-%ld/%lld\r\n", r->start, r->stop, length);
-			hprint(hout, "Content-Length: %ld\r\n", r->stop - r->start);
+			hprint(hout, "Content-Length: %ld\r\n", 1 + r->stop - r->start);
 		}else{
 			multir = 1;
 			boundary = hmkmimeboundary(c);
@@ -196,7 +196,7 @@ sendfd(HConnect *c, int fd, Dir *dir, HContent *type, HContent *enc)
 			hprint(hout, "\r\n--%s\r\n", boundary);
 			printtype(hout, type, enc);
 			hprint(hout, "Content-Range: bytes %ld-%ld/%lld\r\n", r->start, r->stop, length);
-			hprint(hout, "Content-Length: %ld\r\n", r->stop - r->start);
+			hprint(hout, "Content-Length: %ld\r\n", 1 + r->stop - r->start);
 			hprint(hout, "\r\n");
 		}
 		hflush(hout);
@@ -205,7 +205,7 @@ sendfd(HConnect *c, int fd, Dir *dir, HContent *type, HContent *enc)
 			ok = -1;
 			break;
 		}
-		for(tr = r->stop - r->start + 1; tr; tr -= n){
+		for(tr = 1 + r->stop - r->start; tr; tr -= n){
 			n = tr;
 			if(n > HBufSize)
 				n = HBufSize;
@@ -418,6 +418,10 @@ fixrange(HRange *h, long length)
 	rr = nil;
 	for(r = h; r != nil; r = r->next){
 		if(r->suffix){
+			/*
+			 * for suffix, r->stop is a byte *length*
+			 * not the byte *offset* of last byte!
+			 */
 			r->start = length - r->stop;
 			if(r->start >= length)
 				r->start = 0;