From 5014c8c7b9e0e03d35d27ddb491c7db66b152a64 Mon Sep 17 00:00:00 2001
From: Oliver Bartsch <bo@cedev.de>
Date: Thu, 21 Mar 2024 14:02:58 +0100
Subject: [PATCH] [BUGFIX] Prevent undefined array index in GifBuilder

Unset non matching key arrays and additionally
secure the array access with a corresponding
check.

Resolves: #102241
Releases: main, 12.4
Change-Id: If034faf04f52f6e8882dd0b610fa5dfdf9ec2298
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/83570
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Oliver Bartsch <bo@cedev.de>
---
 typo3/sysext/frontend/Classes/Imaging/GifBuilder.php | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/typo3/sysext/frontend/Classes/Imaging/GifBuilder.php b/typo3/sysext/frontend/Classes/Imaging/GifBuilder.php
index 1b14216d7107..aca23479de95 100644
--- a/typo3/sysext/frontend/Classes/Imaging/GifBuilder.php
+++ b/typo3/sysext/frontend/Classes/Imaging/GifBuilder.php
@@ -159,8 +159,10 @@ public function start($conf, $data)
             }
             // Checking TEXT and IMAGE objects for files. If any errors the objects are cleared.
             // The Bounding Box for the objects is stored in an array
-            foreach ($sKeyArray as $theKey) {
-                $theValue = $this->setup[$theKey];
+            foreach ($sKeyArray as $index => $theKey) {
+                if (!($theValue = $this->setup[$theKey] ?? false)) {
+                    continue;
+                }
                 if ((int)$theKey && ($conf = $this->setup[$theKey . '.'] ?? [])) {
                     // Swipes through TEXT and IMAGE-objects
                     switch ($theValue) {
@@ -228,6 +230,7 @@ public function start($conf, $data)
                         $cObj = GeneralUtility::makeInstance(ContentObjectRenderer::class);
                         $cObj->start($this->data);
                         if (!$cObj->checkIf($conf['if.'])) {
+                            unset($sKeyArray[$index]);
                             unset($this->setup[$theKey]);
                             unset($this->setup[$theKey . '.']);
                             unset($this->objBB[$theKey]);
@@ -242,7 +245,9 @@ public function start($conf, $data)
             $this->setup['workArea'] = (string)$this->cObj->stdWrapValue('workArea', $this->setup ?? []);
             $this->setup['workArea'] = $this->calcOffset($this->setup['workArea']);
             foreach ($sKeyArray as $theKey) {
-                $theValue = $this->setup[$theKey];
+                if (!($theValue = $this->setup[$theKey] ?? false)) {
+                    continue;
+                }
                 if ((int)$theKey && ($this->setup[$theKey . '.'] ?? false)) {
                     switch ($theValue) {
                         case 'TEXT':