Ticket #54385: 54385.7.diff

src/wp-admin/includes/image.php

@@ -647 +647 @@
  * @since 2.5.0
  *
  * @param string $str
- * @return int|float
+ * @return int|float Returns 0 on failure.
  */
 function wp_exif_frac2dec( $str ) {
-        if ( false === strpos( $str, '/' ) ) {
-                return $str;
+        // Fractions must contain a single `/`.
+        if ( false === strpos( $str, '/' ) || substr_count( $str, '/' ) > 1 ) {
+                return 0;
         }
 
         list( $numerator, $denominator ) = explode( '/', $str );
-        if ( ! empty( $denominator ) ) {
-                return $numerator / $denominator;
+
+        // Both the numerator and the denominator must be numbers.
+        if ( ! is_numeric( $numerator ) || ! is_numeric( $denominator ) ) {
+                return 0;
+        }
+
+        // The denominator must not be 0.
+        if ( empty( $denominator ) ) {
+                return 0;
         }
-        return $str;
+
+        return $numerator / $denominator;
 }
 
 /**

tests/phpunit/tests/image/functions.php

@@ -700 +700 @@
                         unlink( $temp_dir . $size['file'] );
                 }
         }
+
+        /**
+         * Test for wp_exif_frac2dec verified that it properly handles edge cases
+         * and always returns an int or float, 0 for failures.
+         *
+         * @ticket 54385
+         * @dataProvider data_test_wp_exif_frac2dec
+         */
+        public function test_wp_exif_frac2dec( $fraction, $expect ) {
+                $this->assertSame( $expect, wp_exif_frac2dec( $fraction ) );
+        }
+
+
+        /**
+         * Data provider for testing `wp_exif_frac2dec()`.
+         *
+         * @return array {
+         *     Arguments for testing `wp_exif_frac2dec()`.
+         *
+         *     @type string|null        $fraction       The fraction string to run.
+         *     @type int|float       $expected    The resulting expected value.
+         *
+         */
+        public function data_test_wp_exif_frac2dec() {
+                global $wpdb;
+
+                return array(
+                        array(
+                                '0/0',
+                                0,
+                        ),
+                        array(
+                                '0/abc',
+                                0,
+                        ),
+                        array(
+                                '0.0',
+                                0,
+                        ),
+                        array(
+                                '010',
+                                0,
+                        ),
+                        array(
+                                10.123,
+                                0,
+                        ),
+                        array(
+                                '50/100',
+                                0.5,
+                        ),
+                        array(
+                                '25/100',
+                                .25,
+                        ),
+                        array(
+                                '0',
+                                0,
+                        ),
+                        array(
+                                '100/0',
+                                0,
+                        ),
+                        array(
+                                'path/to/file',
+                                0,
+                        ),
+                        array(
+                                '123notafraction',
+                                0,
+                        ),
+                        array(
+                                '/',
+                                0,
+                        ),
+                        array(
+                                '1/2/3',
+                                0,
+                        ),
+                        array(
+                                '///',
+                                0,
+                        ),
+                );
+        }
+
 }