python3-pillow: Fix CVE-2026-59205

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch

@@ -0,0 +1,66 @@
+From a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 Mon Sep 17 00:00:00 2001
+From: Andrew Murray <radarhere@users.noreply.github.com>
+Date: Sat, 20 Jun 2026 21:18:14 +1000
+Subject: [PATCH] Raise error if image modes do not match ImageCms transform
+ modes (#9715)
+
+CVE: CVE-2026-59205
+Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721]
+
+(cherry picked from commit 066e349b8e20f6e0400683ff988ac72eea24c049)
+(cherry picked from commit 7f6e9d696913bba9fd1a6cf0b53f4a313dc25329)
+(cherry picked from commit 642d806703c62d4160f3eb8ff25fb63cbedadd98)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ Tests/test_imagecms.py | 4 ++++
+ src/PIL/ImageCms.py    | 16 +++++++++-------
+ 2 files changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/Tests/test_imagecms.py b/Tests/test_imagecms.py
+index d73ab34282b..3382a34e47c 100644
+--- a/Tests/test_imagecms.py
++++ b/Tests/test_imagecms.py
+@@ -196,6 +196,10 @@ def test_exceptions() -> None:
+     psRGB = ImageCms.createProfile("sRGB")
+     pLab = ImageCms.createProfile("LAB")
+     t = ImageCms.buildTransform(pLab, psRGB, "LAB", "RGB")
++    with pytest.raises(ValueError, match="mode mismatch"):
++        t.apply(hopper("RGBA"))
++    with pytest.raises(ValueError, match="mode mismatch"):
++        t.apply(hopper("LAB"), hopper("RGBA"))
+     with pytest.raises(ValueError, match="mode mismatch"):
+         t.apply_in_place(hopper("RGBA"))
+ 
+diff --git a/src/PIL/ImageCms.py b/src/PIL/ImageCms.py
+index 513e28acf..388a9296f 100644
+--- a/src/PIL/ImageCms.py
++++ b/src/PIL/ImageCms.py
+@@ -317,19 +317,21 @@ class ImageCmsTransform(Image.ImagePointHandler):
+         return self.apply(im)
+ 
+     def apply(self, im: Image.Image, imOut: Image.Image | None = None) -> Image.Image:
+-        if imOut is None:
++        if im.mode != self.input_mode:
++            msg = "mode mismatch"
++            raise ValueError(msg)
++        if imOut is not None:
++            if imOut.mode != self.output_mode:
++                msg = "mode mismatch"
++                raise ValueError(msg)
++        else:
+             imOut = Image.new(self.output_mode, im.size, None)
+         self.transform.apply(im.getim(), imOut.getim())
+         imOut.info["icc_profile"] = self.output_profile.tobytes()
+         return imOut
+ 
+     def apply_in_place(self, im: Image.Image) -> Image.Image:
+-        if im.mode != self.output_mode:
+-            msg = "mode mismatch"
+-            raise ValueError(msg)  # wrong output mode
+-        self.transform.apply(im.getim(), im.getim())
+-        im.info["icc_profile"] = self.output_profile.tobytes()
+-        return im
++        return self.apply(im, im)
+ 
+ 
+ def get_display_profile(handle: SupportsInt | None = None) -> ImageCmsProfile | None:

meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb

@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https;
            file://CVE-2026-59199.patch \
            file://CVE-2026-59200.patch \
            file://CVE-2026-59203.patch \
+           file://CVE-2026-59205.patch \
            "
 SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"