Menu
▾
▴
#2553 Unreadable messages with UIDs bigger than 2^31
SquirrelMail (1.4.13 and 1.5.2-svn and older) sanitizes passed_id variable by typecasting it to integer. PHP supports only signed integers. On 32 bit system signed integer is from -2147483648 to 2147483647. IMAP message ids use unsigned 32bit integers. They are from 0 to 4294967295. If message id is bigger than 2147483647, typecasting corrupts it and SquirrelMail displays "The server couldn't find the message you requested. Most probably your message list was out of date and the message has been moved away or deleted (perhaps by another program accessing the same mailbox)." error.
Issue can be reproduced with mbox mailboxes that store new uid value in internal mbox information. You can set big uid value there. Works with UW and Dovecot.
Logged In: YES
user_id=285765
Originator: NO
Good point. We should make them a string. The cast was probably done for XSS issues, so care is needed that it's properly sanitised, e.g. with is_numeric.
Hi, it's sitting here for a while... is there any progress? Or is it planned not to fix it at all?
Thanks.
I've prepared patches for 1.4svn and 1.5svn
(more about this can be found in squirrelmail-devel mailing list, thread "[SM-DEVEL] solution for UIDs bigger than 2^31", started 2009-11-25)
In the end, I've used conversion to string in both of them. Only 1.4 contains
additional conversion in sources of delete_and_next plugin to float
to perform arithmetic operations.
I've tested both of them with dovecot and manually created messages with high
uids. Both versions were working on systems with 64bit php, both of them
resulted with imap error on 32 bit system.
Now both of them works on 64 and 32 bit systems. I've checked this functions:
send email (created email got big uid from dovecot) - successfully stored in Sent and readable
move emails between folders
next & prev
delete and next & delete and prev
delete email
forward
edit
view header
forward as attachment and read both email and the attachment in Sent folder
Both patches has only changes to the code text for changelog/other document is missing.
I can't see how to attach files... anyway, both patches can be found in the mailing list thread mentioned in prev comment.
BIGINT UID patch for SquirrelMail 1.4.18
I have attached the patch here for 1.4.18 (with very small changes); 1.5.2 has recently been updated to support BIGINT UIDs natively (no patch needed, but testing needed!). Due to the extent of the changes, we won't be looking to apply this patch to 1.4.x at this time (pending discussion we could decide to adopt it in the future).
File Added: squirrelmail-1.4svn-biguid.patch