#2553 Unreadable messages with UIDs bigger than 2^31

open
None
5
2008-01-24
2007-12-21
Tomas Kuliavas
No

SquirrelMail (1.4.13 and 1.5.2-svn and older) sanitizes passed_id variable by typecasting it to integer. PHP supports only signed integers. On 32 bit system signed integer is from -2147483648 to 2147483647. IMAP message ids use unsigned 32bit integers. They are from 0 to 4294967295. If message id is bigger than 2147483647, typecasting corrupts it and SquirrelMail displays "The server couldn't find the message you requested. Most probably your message list was out of date and the message has been moved away or deleted (perhaps by another program accessing the same mailbox)." error.

Issue can be reproduced with mbox mailboxes that store new uid value in internal mbox information. You can set big uid value there. Works with UW and Dovecot.

Discussion

  • Logged In: YES
    user_id=285765
    Originator: NO

    Good point. We should make them a string. The cast was probably done for XSS issues, so care is needed that it's properly sanitised, e.g. with is_numeric.

     
    • assigned_to: nobody --> kink
     
  • MiHl
    MiHl
    2008-11-06

    Hi, it's sitting here for a while... is there any progress? Or is it planned not to fix it at all?

    Thanks.

     
  • MiHl
    MiHl
    2009-01-27

    I've prepared patches for 1.4svn and 1.5svn

    (more about this can be found in squirrelmail-devel mailing list, thread "[SM-DEVEL] solution for UIDs bigger than 2^31", started 2009-11-25)

    In the end, I've used conversion to string in both of them. Only 1.4 contains
    additional conversion in sources of delete_and_next plugin to float
    to perform arithmetic operations.

    I've tested both of them with dovecot and manually created messages with high
    uids. Both versions were working on systems with 64bit php, both of them
    resulted with imap error on 32 bit system.

    Now both of them works on 64 and 32 bit systems. I've checked this functions:
    send email (created email got big uid from dovecot) - successfully stored in Sent and readable
    move emails between folders
    next & prev
    delete and next & delete and prev
    delete email
    forward
    edit
    view header
    forward as attachment and read both email and the attachment in Sent folder

    Both patches has only changes to the code text for changelog/other document is missing.

     
  • MiHl
    MiHl
    2009-01-27

    I can't see how to attach files... anyway, both patches can be found in the mailing list thread mentioned in prev comment.

     
  • I have attached the patch here for 1.4.18 (with very small changes); 1.5.2 has recently been updated to support BIGINT UIDs natively (no patch needed, but testing needed!). Due to the extent of the changes, we won't be looking to apply this patch to 1.4.x at this time (pending discussion we could decide to adopt it in the future).
    File Added: squirrelmail-1.4svn-biguid.patch