100rel bug fix

b/f: check for broken PRACKs, missing the RSeq header.

Bug spotted by Stefan Sayer.

core/sip/parse_100rel.h

@@ -1,6 +1,7 @@
 #ifndef __PARSE_100REL_H__
 #define __PARSE_100REL_H__
 
+#include <assert.h>
 #include "cstring.h"
 #include "sip_parser.h"
 #include "parse_header.h"
@@ -19,6 +20,7 @@ bool parse_rack(sip_rack *rack, const char *start, int len);
 
 inline static sip_rack *get_rack(const sip_msg *msg)
 {
+  assert(msg->rack);
   return dynamic_cast<sip_rack *>(msg->rack->p);
 }
 

core/sip/trans_layer.cpp

@@ -1127,6 +1127,12 @@ void _trans_layer::received_msg(sip_msg* msg)
  
                  case sip_request::PRACK:
                      bucket->unlock();
+                     if (! msg->rack) {
+                       send_sl_reply(msg, 400, 
+                           cstring("Missing valid RSeq header"),
+                           cstring(),cstring());
+                       DROP_MSG;
+                     }
                      /* match INVITE transaction, cool off the 1xx timers */
                      inv_h = hash(msg->callid->value, get_rack(msg)->cseq_str);
                      inv_bucket = get_trans_bucket(inv_h);