From 395cf7de518f520de35c651c125f1121d6860e14 Mon Sep 17 00:00:00 2001
From: Anthony Romano <anthony.romano@coreos.com>
Date: Thu, 10 Nov 2016 12:24:51 -0800
Subject: [PATCH] grpcproxy: reject invalid watch ranges

---
 proxy/grpcproxy/watch.go   | 4 ++++
 proxy/grpcproxy/watcher.go | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/proxy/grpcproxy/watch.go b/proxy/grpcproxy/watch.go
index 3a1c26b33..d17d3fa36 100644
--- a/proxy/grpcproxy/watch.go
+++ b/proxy/grpcproxy/watch.go
@@ -213,6 +213,10 @@ func (wps *watchProxyStream) recvLoop() error {
 				progress: cr.ProgressNotify,
 				filters:  v3rpc.FiltersFromRequest(cr),
 			}
+			if !w.wr.valid() {
+				w.post(&pb.WatchResponse{WatchId: -1, Created: true, Canceled: true})
+				continue
+			}
 			wps.nextWatcherID++
 			w.nextrev = cr.StartRevision
 			wps.watchers[w.id] = w
diff --git a/proxy/grpcproxy/watcher.go b/proxy/grpcproxy/watcher.go
index 761daa9f4..96ff08420 100644
--- a/proxy/grpcproxy/watcher.go
+++ b/proxy/grpcproxy/watcher.go
@@ -27,6 +27,10 @@ type watchRange struct {
 	key, end string
 }
 
+func (wr *watchRange) valid() bool {
+	return len(wr.end) == 0 || wr.end > wr.key || (wr.end[0] == 0 && len(wr.end) == 1)
+}
+
 type watcher struct {
 	// user configuration