[reSIProcate] [patch] possible DoS with REFER Event: header

[Robert Szokovacs <robert.szokovacs@xxxxxxxxxxx>]

Hi,

When DUM receives a REFER with and "Event:" header, it will use the value 
provided by the client (see BaseSubscription.cxx:22), and later it will cause 
an assert() in ServerSubscription.cxx:208.
The attached patch fixes this and reject such request with 489.

br

Szo

diff -ruwx .svn resiprocate-1.7/resip/dum/Dialog.cxx resiprocate-new/resip/dum/Dialog.cxx
--- resiprocate-1.7/resip/dum/Dialog.cxx	2011-02-27 18:17:15.000000000 +0100
+++ resiprocate-new/resip/dum/Dialog.cxx	2011-11-17 15:25:08.000000000 +0100
@@ -534,6 +534,18 @@
             }
             else
             {
+               if (request.exists(h_Event))
+               {
+                  if (request.header(h_Event).value() != "refer")
+                  {
+                     InfoLog(<< "Received refer with invalid Event: " << request.header(h_Event).value());
+                     SipMessage failure;
+                     makeResponse(failure, request, 489);
+                     mDum.sendResponse(failure);
+                     return;
+                  }
+               }
+
                if ((request.exists(h_ReferSub) && 
                      request.header(h_ReferSub).isWellFormed() &&
                      request.header(h_ReferSub).value()=="false") ||