From 3deaa15255f2df4a22ff035a30dcb90f797d05e4 Mon Sep 17 00:00:00 2001
From: bpintea <bogdan.pintea@iptel.org>
Date: Sat, 20 Nov 2010 15:40:58 +0100
Subject: [PATCH] 100rel bug fix

b/f: check for broken PRACKs, missing the RSeq header.

Bug spotted by Stefan Sayer.
---
 core/sip/parse_100rel.h  | 2 ++
 core/sip/trans_layer.cpp | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/core/sip/parse_100rel.h b/core/sip/parse_100rel.h
index d62fde18..708f81fb 100644
--- a/core/sip/parse_100rel.h
+++ b/core/sip/parse_100rel.h
@@ -1,6 +1,7 @@
 #ifndef __PARSE_100REL_H__
 #define __PARSE_100REL_H__
 
+#include <assert.h>
 #include "cstring.h"
 #include "sip_parser.h"
 #include "parse_header.h"
@@ -19,6 +20,7 @@ bool parse_rack(sip_rack *rack, const char *start, int len);
 
 inline static sip_rack *get_rack(const sip_msg *msg)
 {
+  assert(msg->rack);
   return dynamic_cast<sip_rack *>(msg->rack->p);
 }
 
diff --git a/core/sip/trans_layer.cpp b/core/sip/trans_layer.cpp
index cef83df5..72ea4809 100644
--- a/core/sip/trans_layer.cpp
+++ b/core/sip/trans_layer.cpp
@@ -1127,6 +1127,12 @@ void _trans_layer::received_msg(sip_msg* msg)
  
                  case sip_request::PRACK:
                      bucket->unlock();
+                     if (! msg->rack) {
+                       send_sl_reply(msg, 400, 
+                           cstring("Missing valid RSeq header"),
+                           cstring(),cstring());
+                       DROP_MSG;
+                     }
                      /* match INVITE transaction, cool off the 1xx timers */
                      inv_h = hash(msg->callid->value, get_rack(msg)->cseq_str);
                      inv_bucket = get_trans_bucket(inv_h);