python3-pillow: Fix CVE-2026-59197

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59197.patch

@@ -0,0 +1,74 @@
+From cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Sat, 20 Jun 2026 11:53:14 +1000
+Subject: [PATCH] Validate large filter sizes when initializing RankFilter
+ (#9695)
+
+CVE: CVE-2026-59197
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1]
+
+Backport Changes:
+- Adapted the ImagingExpand check to Pillow 12.2.0's two-margin API.
+  It checks the larger margin and guards against zero before division;
+  the regression test passes both margins.
+
+(cherry picked from commit cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_image_filter.py | 5 +++++
+ src/PIL/ImageFilter.py     | 3 +++
+ src/libImaging/Filter.c    | 5 +++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/Tests/test_image_filter.py b/Tests/test_image_filter.py
+index e566cd055..4bed605 100644
+--- a/Tests/test_image_filter.py
++++ b/Tests/test_image_filter.py
+@@ -141,6 +141,11 @@ def test_rankfilter_properties() -> None:
+     assert rankfilter.size == 1
+     assert rankfilter.rank == 2
+ 
++    with pytest.raises(ValueError, match="filter size too large"):
++        ImageFilter.RankFilter(23171, 1)
++    im = Image.new("1", (1, 1))
++    with pytest.raises(ValueError, match="filter size too large"):
++        im.im.expand(23171, 23171)
+ 
+ def test_builtinfilter_p() -> None:
+     builtin_filter = ImageFilter.BuiltinFilter()
+
+diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py
+index 9326eeeda..2c73c27bc 100644
+--- a/src/PIL/ImageFilter.py
++++ b/src/PIL/ImageFilter.py
+@@ -99,6 +99,9 @@ class RankFilter(Filter):
+     name = "Rank"
+ 
+     def __init__(self, size: int, rank: int) -> None:
++        if size * size * 4 > (2**31 - 1):
++            msg = "filter size too large"
++            raise ValueError(msg)
+         self.size = size
+         self.rank = rank
+
+diff --git a/src/libImaging/Filter.c b/src/libImaging/Filter.c
+index cefb8fc..5288754 100644
+--- a/src/libImaging/Filter.c
++++ b/src/libImaging/Filter.c
+@@ -54,11 +54,16 @@ Imaging
+ ImagingExpand(Imaging imIn, int xmargin, int ymargin) {
+     Imaging imOut;
+     int x, y;
++    int margin;
+     ImagingSectionCookie cookie;
+ 
+     if (xmargin < 0 && ymargin < 0) {
+         return (Imaging)ImagingError_ValueError("bad kernel size");
+     }
++    margin = xmargin > ymargin ? xmargin : ymargin;
++    if (margin > 0 && margin > (INT_MAX / (int)sizeof(FLOAT32)) / margin) {
++        return (Imaging)ImagingError_ValueError("filter size too large");
++    }
+ 
+     imOut = ImagingNewDirty(
+         imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin

meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb

@@ -11,6 +11,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-59204.patch \
            file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \
            file://CVE-2026-55380.patch \
+           file://CVE-2026-59197.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"