[Buildroot] [PATCH v2] package/python-pillow: security bump to version 13.0.0

[Angelo Compagnucci <angelo.compagnucci@gmail.com>]

Fixes the following security issues:

- CVE-2026-96639, GHSA-v9pv-5gc8-w2m6: Stale native image storage reused
  after mode transitions
- GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782: JPEG decoder buffer overflow
  from scanlines wider than tile extents
- CVE-2026-96644, GHSA-9v9v-9qvf-h2hj: WMF/EMF heap out-of-bounds read
  from dimension truncation
- CVE-2026-96637, GHSA-g842-9rc4-69pw: SPIDER decompression bomb bypass
  via seek()
- CVE-2026-96643, GHSA-g4qv-2jxx-769h: Unbounded Exif header replacement
  loop
- CVE-2026-96778, GHSA-g7cr-3p24-7wf7: JPEG comment write after ICC
  profile fills encoder buffer
- GHSA-462x-pgg6-55fp, GHSA-c6hw-5grf-ff96: TIFF tile and YCbCr decoding
  out-of-bounds read from undersized libtiff buffers
- GHSA-p4wg-p73j-c528: PDF parsing stack exhaustion from long trailer
  chains and deep or cyclic page trees
- CVE-2026-96640, GHSA-mrfp-p49p-3hf2: PDF append resource exhaustion
  from repeated page tree references
- GHSA-pchr-8j38-3x4p: TIFF encoder accepted an incorrectly sized
  Colormap for non-8-bit images
- GHSA-332p-7hrc-92wf: TIFF encoder heap buffer overflow when saving to
  a file object
- GHSA-xcvg-w56q-r89m: TIFF encoder heap buffer overflow when tags
  override the image size
- GHSA-xvh5-g6gv-559v: TIFF encoder memory disclosure and crash from
  mismatched tag values
- GHSA-q45j-58j2-45rg: TIFF decoding returned uninitialized memory for
  short JPEG strips
- GHSA-78g4-xqwv-q3g8: Bundled OpenJPEG heap buffer overflow when
  reading tile-part data
- GHSA-4rr5-89j8-mwwm: TIFF encoder use-after-free write
- CVE-2026-96636, GHSA-p8hx-v2p6-rp84: MPO, DCX and MIC decompression
  bomb bypass via seek()
- GHSA-f2g6-542v-9j58: PDF page tree stack exhaustion via cyclic /Kids
  reference
- GHSA-5xm2-6676-qcp9: APNG decompression bomb bypass via delayed
  disposal-frame sizing
- CVE-2026-96642, GHSA-3j72-p6qg-6xp7: TarIO negative size field causes
  infinite CPU-spin loop
- CVE-2026-96638, GHSA-24rc-8hj2-v98c: BMP RLE decoder
  memory-amplification denial of service
- GHSA-gg2r-wvfm-q9rx: MSP RLE decoder expands a tiny file into
  unbounded memory
- GHSA-wqgw-9xfh-qf2g: TIFF and Exif IFD parsing memory and CPU
  amplification from shared tag data
- GHSA-jg86-v3jv-hrpm: Quadratic time when writing many objects to a PDF
- GHSA-254f-3936-288h: PdfParser unbounded recursion via deeply nested
  objects
- GHSA-rfgq-q3w2-pmv2: Image.quantize() crash from an empty target
  palette
- GHSA-xgh8-jp6q-p5x8: XBM header parsing regular expression denial of
  service
- GHSA-22hg-r758-rrw9, GHSA-74r2-7ff9-mjj2, GHSA-fc9g-5qg7-mf45: GIF
  comment handling quadratic-time blowup from repeated concatenation
- GHSA-27h8-gf7j-v5hc: Out-of-bounds read in rank-based filters for
  zero-dimension images
- CVE-2026-96641, GHSA-4rm8-3hmm-39fg: Integer underflow in PILfont text
  width calculation
- GHSA-cp9v-662q-vvx9: Image.merge() buffer overflow when merging 32-bit
  images as narrower bands
- GHSA-j4m9-6w36-pw47: Uninitialized glyph pointer freed on font
  rendering error path
- GHSA-7mwm-ghpf-9vrm: Double free in Image.transform() after an
  allocation failure
- GHSA-4558-3h8r-v8xp: P;2L and P;4L raw mode decoders read past the end
  of their input
- GHSA-w889-685w-c8fh: EPS filename argument injection into Ghostscript
- GHSA-65qm-jvmh-6pqg: GIF decompression bomb check used a size
  discarded on failure
- GHSA-vx6w-vv9f-6gvg: EPS decompression bomb bypass via Ghostscript
  rendering
- GHSA-58r4-6rv3-gfh8: ImageMorph.MorphOp.apply() out-of-bounds write on
  zero-width images

Fix the AVIF build option: Pillow names it avif, the -Clibavif setting
was silently ignored, so AVIF support was only auto-detected instead of
following BR2_PACKAGE_LIBAVIF.

Pillow 13.0.0 adds the Python installation include and library
directories from sysconfig, which are /usr/include and /usr/lib when
cross-compiling, so the build fails with:

  ERROR: unsafe header/library path used in cross-compilation: '-I/usr/include'

Add a patch, backported from an upstream pull request, skipping those
directories when building against an uninstalled Python, as done by
Buildroot.

Release notes:
https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
---
Changes v1 -> v2:
  - add a patch fixing the "unsafe header/library path" build failure
    [Julien]
---
 ...allation-paths-for-build-tree-Python.patch | 48 +++++++++++++++++++
 package/python-pillow/python-pillow.hash      |  4 +-
 package/python-pillow/python-pillow.mk        |  8 ++--
 3 files changed, 54 insertions(+), 6 deletions(-)
 create mode 100644 package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch

diff --git a/package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch b/package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch
new file mode 100644
index 0000000000..ecbff40e2f
--- /dev/null
+++ b/package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch
@@ -0,0 +1,48 @@
+From d32fb4da510c91ba3596fad8d3d73074b1b287ac Mon Sep 17 00:00:00 2001
+From: James Hilliard <james.hilliard1@gmail.com>
+Date: Sun, 18 Oct 2026 12:37:23 -0600
+Subject: [PATCH] Skip Python installation paths for build-tree Python
+
+Upstream: https://github.com/python-pillow/Pillow/pull/10236
+[Angelo: drop the docs/releasenotes/13.1.0.rst change, the file is not
+in the 13.0.0 release]
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+---
+ setup.py | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index 2d02cf129ca..7de22bb78eb 100644
+--- a/setup.py
++++ b/setup.py
+@@ -572,16 +572,20 @@ def build_extensions(self) -> None:
+                 for d in os.environ[k].split(os.path.pathsep):
+                     _add_directory(library_dirs, d)
+ 
+-        _add_directory(
+-            library_dirs,
+-            (sys.prefix == sys.base_prefix and sysconfig.get_config_var("LIBDIR"))
+-            or os.path.join(sys.prefix, "lib"),
+-        )
+-        _add_directory(
+-            include_dirs,
+-            (sys.prefix == sys.base_prefix and sysconfig.get_config_var("INCLUDEDIR"))
+-            or os.path.join(sys.prefix, "include"),
+-        )
++        if not sysconfig.is_python_build():
++            _add_directory(
++                library_dirs,
++                (sys.prefix == sys.base_prefix and sysconfig.get_config_var("LIBDIR"))
++                or os.path.join(sys.prefix, "lib"),
++            )
++            _add_directory(
++                include_dirs,
++                (
++                    sys.prefix == sys.base_prefix
++                    and sysconfig.get_config_var("INCLUDEDIR")
++                )
++                or os.path.join(sys.prefix, "include"),
++            )
+ 
+         #
+         # add platform directories
diff --git a/package/python-pillow/python-pillow.hash b/package/python-pillow/python-pillow.hash
index 6f9c5d2cb1..2bc0206258 100644
--- a/package/python-pillow/python-pillow.hash
+++ b/package/python-pillow/python-pillow.hash
@@ -1,5 +1,5 @@
 # md5, sha256 from https://pypi.org/pypi/pillow/json
-md5  c714771477fa686ba789092cf84234c7  pillow-12.3.0.tar.gz
-sha256  3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce  pillow-12.3.0.tar.gz
+md5  c774e5aef5897704ccd528d0781a9b37  pillow-13.0.0.tar.gz
+sha256  cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510  pillow-13.0.0.tar.gz
 # Locally computed sha256 checksums
 sha256  15181e7363dca9aed78b79bebebc7fde7f1814b8bd311ea3b87ae8ccadfc185b  LICENSE
diff --git a/package/python-pillow/python-pillow.mk b/package/python-pillow/python-pillow.mk
index 433cbae5e5..240353eda3 100644
--- a/package/python-pillow/python-pillow.mk
+++ b/package/python-pillow/python-pillow.mk
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-PYTHON_PILLOW_VERSION = 12.3.0
-PYTHON_PILLOW_SITE = https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9
+PYTHON_PILLOW_VERSION = 13.0.0
+PYTHON_PILLOW_SITE = https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d
 PYTHON_PILLOW_SOURCE = pillow-$(PYTHON_PILLOW_VERSION).tar.gz
 PYTHON_PILLOW_LICENSE = MIT-CMU
 PYTHON_PILLOW_LICENSE_FILES = LICENSE
@@ -43,9 +43,9 @@ endif
 
 ifeq ($(BR2_PACKAGE_LIBAVIF),y)
 PYTHON_PILLOW_DEPENDENCIES += libavif
-PYTHON_PILLOW_BUILD_OPTS += -Clibavif=enable
+PYTHON_PILLOW_BUILD_OPTS += -Cavif=enable
 else
-PYTHON_PILLOW_BUILD_OPTS += -Clibavif=disable
+PYTHON_PILLOW_BUILD_OPTS += -Cavif=disable
 endif
 
 ifeq ($(BR2_PACKAGE_LIBXCB),y)
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot