exiv2: patch CVE-2026-27596

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27596

Backport the commits referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch

@@ -0,0 +1,71 @@
+From f42720d294852c3372fb34c328859e7442128b04 Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Thu, 26 Feb 2026 20:44:18 +0000
+Subject: [PATCH] Regression test for
+ https://github.com/Exiv2/exiv2/issues/3511
+
+CVE: CVE-2026-27596
+Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/fe0d0154ab2886feb503e6cfd38c3b6d5722921f]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ test/data/issue_3511_poc.eps                    | 13 +++++++++++++
+ tests/bugfixes/github/test_issue_3511.py        | 17 +++++++++++++++++
+ .../test_regression_allfiles.py                 |  1 +
+ 3 files changed, 31 insertions(+)
+ create mode 100644 test/data/issue_3511_poc.eps
+ create mode 100644 tests/bugfixes/github/test_issue_3511.py
+
+diff --git a/test/data/issue_3511_poc.eps b/test/data/issue_3511_poc.eps
+new file mode 100644
+index 000000000..4d403cc51
+--- /dev/null
++++ b/test/data/issue_3511_poc.eps
+@@ -0,0 +1,13 @@
++%!PS-Adobe-3.0 EPSF-3.0
++%%BoundingBox: 0 0 100 100
++%%EndComments
++%%BeginProlog
++%%EndProlog
++%%Page: 1 1
++%%BeginPageSetup
++%%EndPageSetup
++%BeginPhotoshop: 16
++3842494D040C00000000000441424344
++%EndPhotoshop
++%%PageTrailer
++%%EOF
+diff --git a/tests/bugfixes/github/test_issue_3511.py b/tests/bugfixes/github/test_issue_3511.py
+new file mode 100644
+index 000000000..1825550a1
+--- /dev/null
++++ b/tests/bugfixes/github/test_issue_3511.py
+@@ -0,0 +1,17 @@
++# -*- coding: utf-8 -*-
++
++import system_tests
++
++
++class test_issue_3511_sigma_LoaderNative_getData(metaclass=system_tests.CaseMeta):
++    url = "https://github.com/Exiv2/exiv2/issues/3511"
++
++    filename = "$data_path/issue_3511_poc.eps"
++    commands = ["$exiv2 -pp $filename"]
++    retval = [1]
++    stderr = [
++        """$exiv2_exception_message $filename:
++$kerCorruptedMetadata
++"""
++    ]
++    stdout = [""]
+diff --git a/tests/regression_tests/test_regression_allfiles.py b/tests/regression_tests/test_regression_allfiles.py
+index 87caa9798..6a230e6fc 100644
+--- a/tests/regression_tests/test_regression_allfiles.py
++++ b/tests/regression_tests/test_regression_allfiles.py
+@@ -126,6 +126,7 @@ def get_valid_files(data_dir):
+         "pocIssue283.jpg",
+         "poc_1522.jp2",
+         "xmpsdk.xmp",
++        "issue_3511_poc.eps",
+         # large file that creates 11Mb of output so let's exclude it
+         "ReaganLargeTiff.tiff",
+         # files that don't create any output

meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch

@@ -0,0 +1,24 @@
+From 8e017375e1cf8b1e5a0c37951152fc7f4c2b3409 Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Thu, 26 Feb 2026 20:44:54 +0000
+Subject: [PATCH] Check for integer overflow.
+
+CVE: CVE-2026-27596
+Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/2cb728a850b4aa048a683711906d716c5f9a32ac]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/preview.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/preview.cpp b/src/preview.cpp
+index 993c3b749..90f60146f 100644
+--- a/src/preview.cpp
++++ b/src/preview.cpp
+@@ -422,6 +422,7 @@ DataBuf LoaderNative::getData() const {
+ #endif
+       return {};
+     }
++    Internal::enforce(sizeData >= 28, ErrorCode::kerCorruptedMetadata);
+     return {record + sizeHdr + 28, sizeData - 28};
+   }
+   throw Error(ErrorCode::kerErrorMessage, "Invalid native preview filter: " + nativePreview_.filter_);

meta-oe/recipes-support/exiv2/exiv2_0.28.7.bb

@@ -7,6 +7,8 @@ DEPENDS = "zlib expat brotli libinih"
 SRC_URI = "git://github.com/Exiv2/exiv2.git;protocol=https;branch=0.28.x;tag=v${PV} \
            file://CVE-2026-25884-1.patch \
            file://CVE-2026-25884-2.patch \
+           file://CVE-2026-27596-1.patch \
+           file://CVE-2026-27596-2.patch \
            "
 SRCREV = "afcb7a8ba84a7de36d2f1ee7689394e078697956"