mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-14 03:57:15 +00:00
Code Issues Projects Releases Wiki Activity

python3-pillow: Fix CVE-2026-59199

Browse Source 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Yogita Urade authored and Anuj Mittal committed 2026-10-28 12:31:49 +05:30
1 parent dbf1a37262
commit 1d22c2e3b3
2 files changed
+85
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch
+84
View File
@@ -0,0 +1,84 @@
From 0d706085cfb87ffac6eea54f1a42ce8bd3f16513 Mon Sep 17 00:00:00 2001
From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
Date: Mon, 22 Jun 2026 12:56:41 +1000
Subject: [PATCH] Use int64_t to calculate paste box dimensions (#9703)
CVE: CVE-2026-59199
Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b]
(cherry picked from commit ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b)
Signed-off-by: Yogita Urade <yurade@cisco.com>
---
Tests/test_image_paste.py | 14 ++++++++++++++
src/libImaging/Paste.c | 12 ++++++------
2 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/Tests/test_image_paste.py b/Tests/test_image_paste.py
index 37e4df103..f9b72e46f 100644
--- a/Tests/test_image_paste.py
+++ b/Tests/test_image_paste.py
@@ -357,6 +357,20 @@ class TestImagingPaste:
im.copy().paste(im2)
im.copy().paste(im2, (0, 0))
+ @pytest.mark.parametrize(
+ "box",
+ (
+ (2**31 - 1, 0, -(2**31), 1),
+ (0, 2**31 - 1, 1, -(2**31)),
+ ),
+ )
+ def test_overflow(self, box: tuple[int, int, int, int]) -> None:
+ im = Image.new("1", (1, 1))
+ im.paste(1, box)
+
+ with pytest.raises(ValueError, match="images do not match"):
+ im.paste(im.copy(), box)
+
def test_incorrect_abbreviated_form(self) -> None:
im = Image.new("L", (1, 1))
with pytest.raises(ValueError):
diff --git a/src/libImaging/Paste.c b/src/libImaging/Paste.c
index f4b72c5d8..bf72d3a1c 100644
--- a/src/libImaging/Paste.c
+++ b/src/libImaging/Paste.c
@@ -274,7 +274,7 @@ int
ImagingPaste(
Imaging imOut, Imaging imIn, Imaging imMask, int dx0, int dy0, int dx1, int dy1
) {
- int xsize, ysize;
+ int64_t xsize, ysize;
int pixelsize;
int sx0, sy0;
ImagingSectionCookie cookie;
@@ -286,8 +286,8 @@ ImagingPaste(
pixelsize = imOut->pixelsize;
- xsize = dx1 - dx0;
- ysize = dy1 - dy0;
+ xsize = (int64_t)dx1 - dx0;
+ ysize = (int64_t)dy1 - dy0;
if (xsize != imIn->xsize || ysize != imIn->ysize || pixelsize != imIn->pixelsize) {
(void)ImagingError_Mismatch();
@@ -598,7 +598,7 @@ ImagingFill2(
Imaging imOut, const void *ink, Imaging imMask, int dx0, int dy0, int dx1, int dy1
) {
ImagingSectionCookie cookie;
- int xsize, ysize;
+ int64_t xsize, ysize;
int pixelsize;
int sx0, sy0;
@@ -609,8 +609,8 @@ ImagingFill2(
pixelsize = imOut->pixelsize;
- xsize = dx1 - dx0;
- ysize = dy1 - dy0;
+ xsize = (int64_t)dx1 - dx0;
+ ysize = (int64_t)dy1 - dy0;
if (imMask && (xsize != imMask->xsize || ysize != imMask->ysize)) {
(void)ImagingError_Mismatch();
meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
+1
View File
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
file://CVE-2026-55380.patch \
file://CVE-2026-59197.patch \
file://CVE-2026-59198.patch \
file://CVE-2026-59199.patch \
"
SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"