Forbid reading an empty range in file serving handles

include/ccf/odata_error.h

@@ -119,6 +119,7 @@ namespace ccf
     ERROR(TooManyPendingTransactions)
     ERROR(MissingApiVersionParameter)
     ERROR(UnsupportedApiVersionValue)
+    ERROR(EmptyFile)
 
     // node-to-node (/join and /create):
     ERROR(ConsensusTypeMismatch)

src/node/rpc/file_serving_handlers.h

@@ -168,6 +168,18 @@ namespace ccf::node
     f.seekg(0, std::ifstream::end);
     const auto total_size = (size_t)f.tellg();
 
+    if (total_size == 0)
+    {
+      // Refuse to return an empty file - it's not going to be a valid snapshot
+      // or ledger chunk, and cannot be described in a Content-Range response
+      // header
+      ctx.rpc_ctx->set_error(
+        HTTP_STATUS_INTERNAL_SERVER_ERROR,
+        ccf::errors::EmptyFile,
+        "Found empty file");
+      return;
+    }
+
     ctx.rpc_ctx->set_response_header("accept-ranges", "bytes");
 
     // Parse Want-Repr-Digest if present

tests/e2e_operations.py

@@ -372,6 +372,7 @@ def do_request(http_verb, *args, **kwargs):
                 (b, range_max),
                 (b, None),
                 (range_max, range_max),
+                (range_max, None),
             ]:
                 range_header_value = f"{start}-{'' if end is None else end}"
                 r = do_request(
@@ -844,13 +845,32 @@ def test_ledger_chunk_access(network, args):
                 ), f"Expected chunk size {actual_chunk_size}, got {chunk_size}"
 
                 r = c.get(chunk_url.path, allow_redirects=False)
+                assert r.status_code == http.HTTPStatus.OK.value, r
                 dled_chunk_digest = hashlib.sha256(r.body.data()).hexdigest()
                 with open(ledger_chunk_path, "rb") as f:
                     actual_chunk_digest = hashlib.sha256(f.read()).hexdigest()
                 assert (
                     dled_chunk_digest == actual_chunk_digest
                 ), "Ledger chunk content does not match"
 
+            LOG.info("Accessing an empty chunk always returns an error")
+            with tempfile.NamedTemporaryFile(dir=main_ledger_dir) as temp_chunk:
+                chunk_url = f"/node/ledger-chunk/{os.path.basename(temp_chunk.name)}"
+                r = c.get(
+                    chunk_url,
+                    allow_redirects=True,
+                )
+                assert r.status_code == http.HTTPStatus.INTERNAL_SERVER_ERROR, r
+
+                chunk_url = f"/node/ledger-chunk/{os.path.basename(temp_chunk.name)}"
+                for range_value in ("bytes=0-10", "bytes=0-", "bytes=0-0"):
+                    r = c.get(
+                        chunk_url,
+                        allow_redirects=True,
+                        headers={"Range": range_value},
+                    )
+                    assert r.status_code == http.HTTPStatus.INTERNAL_SERVER_ERROR, r
+
 
 def test_ledger_chunk_repr_digest(network, args):
     """