fix: DoS issue when To header is not present

emiago · emiago · commit dc9669364a15 · 2025-09-04T19:28:05.000+02:00
Thanks to Sandro Gauci from Enable Security for reporting issue
diff --git a/sip/response.go b/sip/response.go
@@ -239,9 +239,10 @@ func NewResponseFromRequest(
 	case 100:
 		CopyHeaders("Timestamp", req, res)
 	default:
-		if _, ok := res.To().Params["tag"]; !ok {
-			uuid, _ := uuid.NewRandom()
-			res.to.Params["tag"] = uuid.String()
+		if h := res.To(); h != nil {
+			if _, ok := h.Params["tag"]; !ok {
+				h.Params["tag"] = uuid.NewString()
+			}
 		}
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -239,9 +239,10 @@ func NewResponseFromRequest(`
`239`	`239`	`case 100:`
`240`	`240`	`CopyHeaders("Timestamp", req, res)`
`241`	`241`	`default:`
`242`		`- if _, ok := res.To().Params["tag"]; !ok {`
`243`		`- uuid, _ := uuid.NewRandom()`
`244`		`- res.to.Params["tag"] = uuid.String()`
	`242`	`+ if h := res.To(); h != nil {`
	`243`	`+ if _, ok := h.Params["tag"]; !ok {`
	`244`	`+ h.Params["tag"] = uuid.NewString()`
	`245`	`+ }`
`245`	`246`	`}`
`246`	`247`	`}`
`247`	`248`