Removed some vestigial code related to Range bounds checks

[philip-peterson]

When an LFS pointer file has a size that is too large (compared to the actual blob size), the Git LFS client can make Range requests that are out of bounds. Currently Gitea tries to obey these requests but gets an EOF during the copy and still responds with a 200, so this PR adds a bounds check to error early if that would be about to happen.

Also removed some vestigial code related to the bounds checks.

Update: see comment below

[Gusted]

Is there a test case where this issue can be reproduced(and ideally can be included into Gitea integration tests.

[KN4CK3R]

I don't understand the problem. The initial toByte = meta.Size - 1 (meta.Size is the content size, there should be no need to stat it). If the client provides a range, toByte gets capped to this size. How can it be out of bounds?

[wxiaoguang]

It comes from user's HTTP header. https://github.com/go-gitea/gitea/pull/20312/files#diff-95b595c61d15024441878562cf12099f39f68773a995de51ff021f7258b5a695R92-L114

While I think the check should be moved above, otherwise the response header (https://github.com/go-gitea/gitea/pull/20312/files#diff-95b595c61d15024441878562cf12099f39f68773a995de51ff021f7258b5a695R111) is still incorrect.

---

Update: hmm ... the toByte was already checked above. 😂

Maybe the problem is that the size in meta doesn't match the real file size?

[KN4CK3R]

The meta size is checked against the written size, must be correct.

gitea/modules/lfs/content_store.go

Lines 142 to 144 in cb6c5f8

	if r.currentSize != r.expectedSize {
	return n, ErrSizeMismatch
	}

[philip-peterson]

Yes, I will have to check to see if this is a problem in latest Gitea. The hashingReader code looks like it might address it, I was working based off an older version.

[philip-peterson]

I was able to verify that this issue has been fixed in latest Gitea. Although, there is still some dead code, so I changed this PR to be just about removing the dead code.

Thanks for the help, all.

[codecov-commenter]

Codecov Report

❗ No coverage uploaded for pull request base (main@ae52df6). Click here to learn what that means.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main   #20312   +/-   ##
=======================================
  Coverage        ?   46.94%           
=======================================
  Files           ?      977           
  Lines           ?   135303           
  Branches        ?        0           
=======================================
  Hits            ?    63519           
  Misses          ?    64001           
  Partials        ?     7783           

Impacted Files	Coverage Δ
modules/lfs/content_store.go	74.66% <ø> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us.