From 30683c653da1a26d9da3da605f5ed93f7781db7e Mon Sep 17 00:00:00 2001
From: Rohini Sangam <rsangam@mvista.com>
Date: Thu, 17 Sep 2026 15:22:13 +0530
Subject: [PATCH] python3-pillow: Security fix for CVE-2026-59198

Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
[2] https://nvd.nist.gov/vuln/detail/cve-2026-59198

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../python3-pillow/CVE-2026-59198.patch       | 60 +++++++++++++++++++
 .../python/python3-pillow_10.3.0.bb           |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch

diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch
new file mode 100644
index 0000000000..eb8a6e5a1c
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch
@@ -0,0 +1,60 @@
+From eada3cbd7fb9963ee90673fb7b5270124a0d5f4b Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Tue, 23 Jun 2026 09:46:33 +1000
+Subject: [PATCH] Prevent saving 1 mode images as TGA with run-length
+encoding
+ (#9709)
+
+CVE: CVE-2026-59198
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b]
+
+Signed-off-by: Rohini Sangam <rsangam@mvista.com>
+---
+ Tests/test_file_tga.py    | 12 +++++++++++-
+ src/PIL/TgaImagePlugin.py |  4 ++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py
+index ff6dab00d..c03282142 100644
+--- a/Tests/test_file_tga.py
++++ b/Tests/test_file_tga.py
+@@ -147,10 +147,20 @@ def test_save_wrong_mode(tmp_path: Path) -> None:
+     im = hopper("PA")
+     out = str(tmp_path / "temp.tga")
+ 
+-    with pytest.raises(OSError):
++    with pytest.raises(OSError, match="cannot write mode PA as TGA"):
+         im.save(out)
+ 
+ 
++def test_save_1_mode_rle(tmp_path: Path) -> None:
++    im = Image.new("1", (1, 1))
++    out = tmp_path / "temp.tga"
++
++    with pytest.raises(
++        OSError, match="cannot write mode 1 as TGA with run-length encoding"
++    ):
++        im.save(out, compression="tga_rle")
++
++
+ def test_save_mapdepth() -> None:
+     # This image has been manually hexedited from 200x32_p_bl_raw.tga
+     # to include an origin
+diff --git a/src/PIL/TgaImagePlugin.py b/src/PIL/TgaImagePlugin.py
+index 401a83f9f..e8fd297cf 100644
+--- a/src/PIL/TgaImagePlugin.py
++++ b/src/PIL/TgaImagePlugin.py
+@@ -191,6 +191,10 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str) -> None:
+         compression = im.encoderinfo.get("compression", im.info.get("compression"))
+         rle = compression == "tga_rle"
+     if rle:
++        if im.mode == "1":
++            msg = f"cannot write mode {im.mode} as TGA with run-length encoding"
++            raise OSError(msg)
++
+         imagetype += 8
+ 
+     id_section = im.encoderinfo.get("id_section", im.info.get("id_section", ""))
+-- 
+2.44.4
+
diff --git a/meta-python/recipes-devtools/python/python3-pillow_10.3.0.bb b/meta-python/recipes-devtools/python/python3-pillow_10.3.0.bb
index 8f7d11195d..35ecaaa4c8 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_10.3.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_10.3.0.bb
@@ -11,6 +11,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https
            file://CVE-2026-25990.patch \
            file://CVE-2026-40192.patch \
            file://CVE-2026-42311.patch \
+           file://CVE-2026-59198.patch \
            "
 SRCREV = "5c89d88eee199ba53f64581ea39b6a1bc52feb1a"