From 6c5fed069253825cf9a9b9811122fb49c46cb4ef Mon Sep 17 00:00:00 2001
From: Yogita Urade <yurade@cisco.com>
Date: Thu, 15 Oct 2026 23:23:16 -0700
Subject: [PATCH] python3-pillow: Fix CVE-2026-55380

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../python3-pillow/CVE-2026-55380.patch       | 62 +++++++++++++++++++
 .../python/python3-pillow_12.2.0.bb           |  1 +
 2 files changed, 63 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch

diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch
new file mode 100644
index 0000000000..16321294c9
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch
@@ -0,0 +1,62 @@
+From 176781ac99ebf9aa5486384e6e2e4896b30d95b5 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Sun, 21 Jun 2026 14:06:24 +1000
+Subject: [PATCH] Add decompression bomb check to GdImageFile (#9693)
+
+CVE: CVE-2026-55380
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675]
+
+(cherry picked from commit f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_file_gd.py  | 8 +++++++-
+ src/PIL/GdImageFile.py | 3 ++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/Tests/test_file_gd.py b/Tests/test_file_gd.py
+index 8a49fd4fa..7d9e85976 100644
+--- a/Tests/test_file_gd.py
++++ b/Tests/test_file_gd.py
+@@ -4,7 +4,7 @@ from io import BytesIO
+ 
+ import pytest
+ 
+-from PIL import GdImageFile, UnidentifiedImageError
++from PIL import GdImageFile, Image, UnidentifiedImageError, _binary
+ 
+ from .helper import assert_image_similar_tofile
+ 
+@@ -31,6 +31,12 @@ def test_bad_mode() -> None:
+         GdImageFile.open(TEST_GD_FILE, "bad mode")
+ 
+ 
++def test_decompression_bomb() -> None:
++    b = BytesIO(_binary.o16be(65535) + _binary.o16be(50000) + _binary.o16be(50000))
++    with pytest.raises(Image.DecompressionBombError):
++        GdImageFile.open(b)
++
++
+ def test_invalid_file() -> None:
+     invalid_file = "Tests/images/flower.jpg"
+ 
+diff --git a/src/PIL/GdImageFile.py b/src/PIL/GdImageFile.py
+index d73bc1982..4ff96f1fa 100644
+--- a/src/PIL/GdImageFile.py
++++ b/src/PIL/GdImageFile.py
+@@ -30,7 +30,7 @@ from __future__ import annotations
+ 
+ from typing import IO
+ 
+-from . import ImageFile, ImagePalette, UnidentifiedImageError
++from . import Image, ImageFile, ImagePalette, UnidentifiedImageError
+ from ._binary import i16be as i16
+ from ._binary import i32be as i32
+ from ._typing import StrOrBytesPath
+@@ -59,6 +59,7 @@ class GdImageFile(ImageFile.ImageFile):
+ 
+         self._mode = "P"
+         self._size = i16(s, 2), i16(s, 4)
++        Image._decompression_bomb_check(self.size)
+ 
+         true_color = s[6]
+         true_color_offset = 2 if true_color else 0
diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
index aa7de55fab..d5576560e7 100644
--- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-54058.patch \
            file://CVE-2026-59204.patch \
            file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \
+           file://CVE-2026-55380.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"