protect ourselves again underflow (Refs #911)

consensus/replay.go

@@ -90,6 +90,7 @@ func (cs *ConsensusState) readReplayMessage(msg *TimedWALMessage, newStepCh chan
 
 // replay only those messages since the last block.
 // timeoutRoutine should run concurrently to read off tickChan
+// CONTRACT: csHeight > 0
 func (cs *ConsensusState) catchupReplay(csHeight uint64) error {
 	// set replayMode
 	cs.replayMode = true

consensus/state.go

@@ -697,6 +697,7 @@ func (cs *ConsensusState) enterNewRound(height uint64, round int) {
 
 // needProofBlock returns true on the first height (so the genesis app hash is signed right away)
 // and where the last block (height-1) caused the app hash to change
+// CONTRACT: height > 0
 func (cs *ConsensusState) needProofBlock(height uint64) bool {
 	if height == 1 {
 		return true

rpc/core/blocks.go

@@ -62,19 +62,28 @@ import (
 //
 // <aside class="notice">Returns at most 20 items.</aside>
 func BlockchainInfo(minHeight, maxHeight uint64) (*ctypes.ResultBlockchainInfo, error) {
+	if minHeight == 0 {
+		minHeight = 1
+	}
+
 	if maxHeight == 0 {
 		maxHeight = blockStore.Height()
 	} else {
 		maxHeight = cmn.MinUint64(blockStore.Height(), maxHeight)
 	}
-	if minHeight == 0 {
-		minHeight = cmn.MaxUint64(1, maxHeight-20)
-	} else {
-		minHeight = cmn.MaxUint64(minHeight, maxHeight-20)
+
+	// maximum 20 block metas
+	const limit uint64 = 20
+	if maxHeight >= limit { // to prevent underflow
+		minHeight = cmn.MaxUint64(minHeight, maxHeight-limit)
 	}
 
 	logger.Debug("BlockchainInfoHandler", "maxHeight", maxHeight, "minHeight", minHeight)
 
+	if minHeight > maxHeight {
+		return nil, fmt.Errorf("min height %d can't be greater than max height %d", minHeight, maxHeight)
+	}
+
 	blockMetas := []*types.BlockMeta{}
 	for height := maxHeight; height >= minHeight; height-- {
 		blockMeta := blockStore.LoadBlockMeta(height)