GitHub Security Advisory: GHSA-c623-f998-8hhv
Package: github.com/emiago/sipgo (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 0.3.0, < 1.0.0-alpha-1
Patched in: 1.0.0-alpha-1

Summary: SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference

Details:
### Description

A nil pointer dereference vulnerability was discovered in the SIPGO library's `NewResponseFromRequest` function that affects all normal SIP operations. The vulnerability allows remote attackers to crash any SIP application by sending a single malformed SIP request without a To header.

The vulnerability occurs when SIP message parsing succeeds for a request missing the To header, but the response creation code assumes the To header exists without proper nil checks. This affects routine operations like call setup, authentication, and message handling - not just error cases.

> Note: This vulnerability affects all SIP applications using the sipgo library, not just specific configurations or edge cases, as long as they make use of the `NewResponseFromRequest` function.

### Technical details

The vulnerability is located in `/sip/response.go` at line 242 in the `NewResponseFromRequest` function:

```go
if _, ok := res.To().Params["tag"]; !ok {
    uuid, _ := uuid.NewRandom()
    res.to.Params["tag"] = uuid.String()
}
```

**Root Cause:**

1. **Missing To Header**: When any SIP request is sent without a To header, the SIP message parsing succeeds but the To header is never set in the request object.

2. **Header Copying Logic**: During response creation in `NewResponseFromRequest`, the code attempts to copy headers from the request to the response. Since there's no To header in the request, no To header is copied to the response.

3. **Unsafe Assumption**: The response creation code assumes the To header exists and calls `res.To().Params["tag"]` without checking if `res.To()` returns `nil`, causing a nil pointer dereference.

**Stack Trace:**
```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x70 pc=0x10261fcb4]

goroutine 175 [running]:
github.com/emiago/sipgo/sip.NewResponseFromRequest(0x14000433e00, 0x191, {0x1026b074b, 0xb}, {0x0, 0x0, 0x0})
    /Users/user/Documents/GitHub/sipgo/sip/response.go:242 +0x394
```

### Impact

This vulnerability affects **all SIP applications using the sipgo library when using NewResponseFromRequest to generate SIP responses**.

**Attack Impact:**
- **Availability**: Complete denial of service - application crashes immediately
- **Remote Exploitation**: Yes
- **Authentication Required**: No - vulnerability triggers during initial response generation which does not require authentication


### How to reproduce the issue

To reproduce this issue, you need:

1. A SIP application using the vulnerable sipgo library
2. Network access to send SIP messages to the target

Steps:

1. Save the following Python script as `sipgo-response-dos.py`:

    ```python
    #!/usr/bin/env python3
    import socket
    import sys
    import time
    import random

    def create_malformed_register(target_ip, target_port):
        call_id = f"sipgo-dos-{int(time.time())}"
        tag = f"sipgo-dos-{random.randint(1000, 9999)}"
        branch = f