python3-pillow: Fix CVE-2026-59200

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59200.patch

@@ -0,0 +1,82 @@
+From 9ce0814ba3aec3d4ba57f15593ebe063bf5ea205 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <3112309+radarhere@users.noreply.github.com>
+Date: Tue, 30 Jun 2026 09:17:05 +1000
+Subject: [PATCH] Add max_length to PdfStream decode() (#9718)
+
+CVE: CVE-2026-59200
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09]
+
+(cherry picked from commit f7a31ea75e460e108c37126da1f47812f21f6b09)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_pdfparser.py | 11 +++++++++++
+ src/PIL/PdfParser.py    | 15 +++++++++------
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/Tests/test_pdfparser.py b/Tests/test_pdfparser.py
+index cba6cd053..4c522eb7a 100644
+--- a/Tests/test_pdfparser.py
++++ b/Tests/test_pdfparser.py
+@@ -1,6 +1,7 @@
+ from __future__ import annotations
+ 
+ import time
++import zlib
+ 
+ import pytest
+ 
+@@ -95,6 +96,16 @@ def test_parsing() -> None:
+             assert time.strftime("%Y%m%d%H%M%S", getattr(d, name)) == value
+ 
+ 
++def test_pdfstream_flatedecode() -> None:
++    d = PdfDict({b"Filter": b"FlateDecode"})
++    buf = zlib.compress(b"test")
++    s = PdfStream(d, buf)
++    assert s.decode() == b"test"
++
++    with pytest.raises(ValueError, match="Decompressed data too large"):
++        s.decode(3)
++
++
+ def test_pdf_repr() -> None:
+     assert bytes(IndirectReference(1, 2)) == b"1 2 R"
+     assert bytes(IndirectObjectDef(*IndirectReference(1, 2))) == b"1 2 obj"
+diff --git a/src/PIL/PdfParser.py b/src/PIL/PdfParser.py
+index f7f3a4643..10079ac66 100644
+--- a/src/PIL/PdfParser.py
++++ b/src/PIL/PdfParser.py
+@@ -10,6 +10,8 @@ import time
+ import zlib
+ from typing import Any, NamedTuple
+ 
++from . import ImageFile
++
+ TYPE_CHECKING = False
+ if TYPE_CHECKING:
+     from typing import IO
+@@ -320,17 +322,18 @@ class PdfStream:
+         self.dictionary = dictionary
+         self.buf = buf
+ 
+-    def decode(self) -> bytes:
++    def decode(self, max_length: int = ImageFile.SAFEBLOCK) -> bytes:
+         try:
+             filter = self.dictionary[b"Filter"]
+         except KeyError:
+             return self.buf
+         if filter == b"FlateDecode":
+-            try:
+-                expected_length = self.dictionary[b"DL"]
+-            except KeyError:
+-                expected_length = self.dictionary[b"Length"]
+-            return zlib.decompress(self.buf, bufsize=int(expected_length))
++            dobj = zlib.decompressobj()
++            plaintext = dobj.decompress(self.buf, max_length)
++            if dobj.unconsumed_tail:
++                msg = "Decompressed data too large"
++                raise ValueError(msg)
++            return plaintext
+         else:
+             msg = f"stream filter {repr(filter)} unknown/unsupported"
+             raise NotImplementedError(msg)

meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb

@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-59197.patch \
            file://CVE-2026-59198.patch \
            file://CVE-2026-59199.patch \
+           file://CVE-2026-59200.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"