python3-pillow: Fix CVE-2026-59203

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59203.patch

@@ -0,0 +1,45 @@
+From 157289420e2b730688452c58a95a89974b25538d Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Tue, 23 Jun 2026 09:20:48 +1000
+Subject: [PATCH] Raise ValueError if EPS BeginBinary bytecount is negative
+ (#9708)
+
+CVE: CVE-2026-59203
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83]
+
+(cherry picked from commit 03992618118b4a76b6163cd72ab5ecd684133b83)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_file_eps.py    | 4 ++++
+ src/PIL/EpsImagePlugin.py | 3 +++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/Tests/test_file_eps.py b/Tests/test_file_eps.py
+index d4e8db4f4..d1886e9e2 100644
+--- a/Tests/test_file_eps.py
++++ b/Tests/test_file_eps.py
+@@ -204,6 +204,10 @@ def test_begin_binary() -> None:
+     with Image.open(io.BytesIO(data)) as img:
+         assert img.size == (399, 480)
+ 
++    data[76867:76873] = b"    -1"
++    with pytest.raises(ValueError, match="BeginBinary bytecount cannot be negative"):
++        Image.open(io.BytesIO(data))
++
+ 
+ @mark_if_feature_version(
+     pytest.mark.valgrind_known_error, "libjpeg_turbo", "2.0", reason="Known Failing"
+diff --git a/src/PIL/EpsImagePlugin.py b/src/PIL/EpsImagePlugin.py
+index aeb7b0c93..363ba19e1 100644
+--- a/src/PIL/EpsImagePlugin.py
++++ b/src/PIL/EpsImagePlugin.py
+@@ -357,6 +357,9 @@ class EpsImageFile(ImageFile.ImageFile):
+                 trailer_reached = True
+             elif bytes_mv[:14] == b"%%BeginBinary:":
+                 bytecount = int(byte_arr[14:bytes_read])
++                if bytecount < 0:
++                    msg = "BeginBinary bytecount cannot be negative"
++                    raise ValueError(msg)
+                 self.fp.seek(bytecount, os.SEEK_CUR)
+             bytes_read = 0
+

meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb

@@ -15,6 +15,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-59198.patch \
            file://CVE-2026-59199.patch \
            file://CVE-2026-59200.patch \
+           file://CVE-2026-59203.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"