Fix ValueError for some invalid Range requests

fixes pallets#2526

Author: ThiefMaster

CHANGES

@@ -15,6 +15,14 @@ Major release, unreleased
   method returns compressed response by default, and pretty response in
   debug mode.
 
+Version 0.12.3
+--------------
+
+Bugfix release, unreleased
+
+- Fix a ValueError caused by invalid Range requests in some cases
+
+
 Version 0.12.2
 --------------
 

flask/helpers.py

@@ -591,7 +591,8 @@ def send_file(filename_or_fp, mimetype=None, as_attachment=False,
                 rv = rv.make_conditional(request, accept_ranges=True,
                                          complete_length=fsize)
             except RequestedRangeNotSatisfiable:
-                file.close()
+                if file is not None:
+                    file.close()
                 raise
         else:
             rv = rv.make_conditional(request)

tests/test_helpers.py

@@ -468,7 +468,7 @@ def __getattr__(self, name):
 
     @pytest.mark.skipif(
         not callable(getattr(Range, 'to_content_range_header', None)),
-        reason="not implement within werkzeug"
+        reason="not implemented within werkzeug"
     )
     def test_send_file_range_request(self):
         app = flask.Flask(__name__)
@@ -529,6 +529,25 @@ def index():
         assert rv.status_code == 200
         rv.close()
 
+    @pytest.mark.skipif(
+        not callable(getattr(Range, 'to_content_range_header', None)),
+        reason="not implemented within werkzeug"
+    )
+    def test_send_file_range_request_xsendfile_invalid(self):
+        # https://github.com/pallets/flask/issues/2526
+        app = flask.Flask(__name__)
+        app.use_x_sendfile = True
+
+        @app.route('/')
+        def index():
+            return flask.send_file('static/index.html', conditional=True)
+
+        c = app.test_client()
+
+        rv = c.get('/', headers={'Range': 'bytes=1000-'})
+        assert rv.status_code == 416
+        rv.close()
+
     def test_attachment(self):
         app = flask.Flask(__name__)
         with app.test_request_context():