3 files changed, 91 insertions, 0 deletions

diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch
new file mode 100644
index 0000000000..918c9a234a
--- /dev/null
+++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-1.patch
@@ -0,0 +1,63 @@
+From 70edff9f6f5af7314b65d6aab04b208f752f8953 Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Thu, 26 Feb 2026 21:14:10 +0000
+Subject: [PATCH] Regression test for
+ https://github.com/Exiv2/exiv2/issues/3513
+
+CVE: CVE-2026-27631
+Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/7adedce8c779e9c7bce843cbaf9eff26bc1659b6]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ test/data/issue_3513_poc.psd                   | Bin 0 -> 206 bytes
+ tests/bugfixes/github/test_issue_3513.py       |  17 +++++++++++++++++
+ .../test_regression_allfiles.py                |   1 +
+ 3 files changed, 18 insertions(+)
+ create mode 100644 test/data/issue_3513_poc.psd
+ create mode 100644 tests/bugfixes/github/test_issue_3513.py
+
+diff --git a/test/data/issue_3513_poc.psd b/test/data/issue_3513_poc.psd
+new file mode 100644
+index 0000000000000000000000000000000000000000..b8cf982ccc29e4574783b1317347a8494bce4240
+GIT binary patch
+literal 206
+zcmcC;3J7LkWXND(VPIfj2I6QSp2oldW&@cF4i-+HzAOnKCIbVQ%?V)xNk#^S{{sU!
+VK$eS7U=ZX2Ii>-KnHh{ttN=+HebfK|
+
+literal 0
+HcmV?d00001
+
+diff --git a/tests/bugfixes/github/test_issue_3513.py b/tests/bugfixes/github/test_issue_3513.py
+new file mode 100644
+index 000000000..5383470e4
+--- /dev/null
++++ b/tests/bugfixes/github/test_issue_3513.py
+@@ -0,0 +1,17 @@
++# -*- coding: utf-8 -*-
++
++import system_tests
++
++
++class test_issue_3513_PsdImage_readResourceBlock(metaclass=system_tests.CaseMeta):
++    url = "https://github.com/Exiv2/exiv2/issues/3513"
++
++    filename = "$data_path/issue_3513_poc.psd"
++    commands = ["$exiv2 -pp $filename"]
++    retval = [1]
++    stderr = [
++        """$exiv2_exception_message $filename:
++$kerCorruptedMetadata
++"""
++    ]
++    stdout = [""]
+diff --git a/tests/regression_tests/test_regression_allfiles.py b/tests/regression_tests/test_regression_allfiles.py
+index 34bea3b03..ef7b066e0 100644
+--- a/tests/regression_tests/test_regression_allfiles.py
++++ b/tests/regression_tests/test_regression_allfiles.py
+@@ -124,6 +124,7 @@ def get_valid_files(data_dir):
+         "pocIssue283.jpg",
+         "poc_1522.jp2",
+         "xmpsdk.xmp",
++        "issue_3513_poc.psd",
+         "issue_3511_poc.eps",
+         # large file that creates 11Mb of output so let's exclude it
+         "ReaganLargeTiff.tiff",
diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch
new file mode 100644
index 0000000000..e762b10b6d
--- /dev/null
+++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27631-2.patch
@@ -0,0 +1,26 @@
+From 5a6dd6015d436c1f64b55b47bb50ef8fa72f11d2 Mon Sep 17 00:00:00 2001
+From: Kevin Backhouse <kevinbackhouse@github.com>
+Date: Fri, 27 Feb 2026 10:38:22 +0000
+Subject: [PATCH] Check for integer overflow.
+
+CVE: CVE-2026-27631
+Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/284b4e20229dd6edf492e712871878ae320801fc]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/psdimage.cpp | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/psdimage.cpp b/src/psdimage.cpp
+index 1a8e4c61c..b2f5247a2 100644
+--- a/src/psdimage.cpp
++++ b/src/psdimage.cpp
+@@ -287,6 +287,9 @@ void PsdImage::readResourceBlock(uint16_t resourceId, uint32_t resourceSize) {
+       nativePreview.height_ = getLong(buf + 8, bigEndian);
+       const uint32_t format = getLong(buf + 0, bigEndian);
+ 
++      Internal::enforce(nativePreview.size_ <= static_cast<size_t>(std::numeric_limits<long>::max()),
++                        Exiv2::ErrorCode::kerCorruptedMetadata);
++
+       if (nativePreview.size_ > 0 && nativePreview.position_ > 0) {
+         io_->seek(static_cast<long>(nativePreview.size_), BasicIo::cur);
+         if (io_->error() || io_->eof())
diff --git a/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb b/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb
index 9ec2f48a77..f9ccdc079f 100644
--- a/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb
+++ b/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb
@@ -12,6 +12,8 @@ SRC_URI = "git://github.com/Exiv2/exiv2.git;protocol=https;branch=0.28.x \
            file://CVE-2026-25884-2.patch \
            file://CVE-2026-27596-1.patch \
            file://CVE-2026-27596-2.patch \
+           file://CVE-2026-27631-1.patch \
+           file://CVE-2026-27631-2.patch \
            "
 SRCREV = "a6a79ef064f131ffd03c110acce2d3edb84ffa2e"
 S = "${WORKDIR}/git"