Fix exception in StaticFileHandler when range requested is larger tha…

…n file.

tornado/test/web_test.py

@@ -900,6 +900,26 @@ def test_static_with_range_full_file(self):
         self.assertEqual(response.headers.get("Content-Length"), "26")
         self.assertEqual(response.headers.get("Content-Range"), None)
 
+    def test_static_with_range_full_past_end(self):
+        response = self.fetch('/static/robots.txt', headers={
+            'Range': 'bytes=0-10000000'})
+        self.assertEqual(response.code, 200)
+        robots_file_path = os.path.join(self.static_dir, "robots.txt")
+        with open(robots_file_path) as f:
+            self.assertEqual(response.body, utf8(f.read()))
+        self.assertEqual(response.headers.get("Content-Length"), "26")
+        self.assertEqual(response.headers.get("Content-Range"), None)
+
+    def test_static_with_range_partial_past_end(self):
+        response = self.fetch('/static/robots.txt', headers={
+            'Range': 'bytes=1-10000000'})
+        self.assertEqual(response.code, 206)
+        robots_file_path = os.path.join(self.static_dir, "robots.txt")
+        with open(robots_file_path) as f:
+            self.assertEqual(response.body, utf8(f.read()[1:]))
+        self.assertEqual(response.headers.get("Content-Length"), "25")
+        self.assertEqual(response.headers.get("Content-Range"), "bytes 1-25/26")
+
     def test_static_with_range_end_edge(self):
         response = self.fetch('/static/robots.txt', headers={
             'Range': 'bytes=22-'})

tornado/web.py

@@ -1827,6 +1827,10 @@ def get(self, path, include_body=True):
                 return
             if start is not None and start < 0:
                 start += size
+            if end is not None and end > size:
+                # Clients sometimes blindly use a large range to limit their
+                # download size; cap the endpoint at the actual file size.
+                end = size
             # Note: only return HTTP 206 if less than the entire range has been
             # requested. Not only is this semantically correct, but Chrome
             # refuses to play audio if it gets an HTTP 206 in response to