[AutoPR- Security] Patch elixir for CVE-2026-75758 [MEDIUM]

SPECS/elixir/CVE-2026-75758.patch

@@ -0,0 +1,103 @@
+From e1939d826504c7cc841cb17c78f3c09fa24f7a0a Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 31 Aug 2026 12:52:12 +0000
+Subject: [PATCH] Fix recursion on charlist error path
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/elixir-lang/elixir/commit/5230d73968f1b4969d2a2646786fa6c71475f5cc.patch
+---
+    lib/elixir/lib/inspect.ex         | 30 +++++++++++++++++++++++++-----
+    lib/elixir/lib/inspect/algebra.ex |  4 ++--
+    lib/elixir/lib/list.ex            |  4 ++--
+    3 files changed, 29 insertions(+), 9 deletions(-)
+
+diff --git a/lib/elixir/lib/inspect.ex b/lib/elixir/lib/inspect.ex
+index d5753b8..de1ab0d 100644
+--- a/lib/elixir/lib/inspect.ex
++++ b/lib/elixir/lib/inspect.ex
+@@ -264,13 +264,20 @@ def inspect(term, opts) do
+     close = color("]", :list, opts)
+
+     cond do
+-      lists == :as_charlists or (lists == :infer and List.ascii_printable?(term, printable_limit)) ->
+-        inspected =
+-          case Identifier.escape(IO.chardata_to_string(term), ?", printable_limit) do
+-            {escaped, ""} -> [?~, ?c, ?", escaped, ?"]
+-            {escaped, _} -> [?~, ?c, ?", escaped, ?", " ++ ..."]
++      (lists == :as_charlists and unicode_list?(term, printable_limit)) or
++          (lists == :infer and List.ascii_printable?(term, printable_limit)) ->
++        {split, tail} =
++          if is_integer(printable_limit) do
++            case Enum.split(term, printable_limit) do
++              {split, []} -> {split, []}
++              {split, _} -> {split, " ++ ..."}
++            end
++          else
++            {term, []}
+           end
+
++        {escaped, _} = Identifier.escape(IO.chardata_to_string(split), ?")
++        inspected = [?~, ?c, ?", escaped, ?" | tail]
+         color(IO.iodata_to_binary(inspected), :charlist, opts)
+
+       keyword?(term) ->
+@@ -281,6 +288,19 @@ def inspect(term, opts) do
+     end
+   end
+
++  defp unicode_list?(_, 0), do: true
++
++  defp unicode_list?([char | rest], counter)
++       when char in 0..0xD7FF or char in 0xE000..0x10FFFF,
++       do: unicode_list?(rest, decrement(counter))
++
++  defp unicode_list?([], _counter), do: true
++  defp unicode_list?(_, _counter), do: false
++
++  @compile {:inline, decrement: 1}
++  defp decrement(:infinity), do: :infinity
++  defp decrement(counter), do: counter - 1
++
+   @doc false
+   def keyword({key, value}, opts) do
+     key = color(Macro.inspect_atom(:key, key), :atom, opts)
+diff --git a/lib/elixir/lib/inspect/algebra.ex b/lib/elixir/lib/inspect/algebra.ex
+index 5e213b3..941aa55 100644
+--- a/lib/elixir/lib/inspect/algebra.ex
++++ b/lib/elixir/lib/inspect/algebra.ex
+@@ -17,8 +17,8 @@ defmodule Inspect.Opts do
+       is `:decimal` and if it is printable, otherwise in bit syntax. See
+       `String.printable?/1` to learn when a string is printable.
+
+-    * `:charlists` - when `:as_charlists` all lists will be printed as charlists,
+-      non-printable elements will be escaped.
++    * `:charlists` - when `:as_charlists` all charlists will be printed as charlists,
++      non-printable code points will be escaped. Other lists will be printed as lists.
+
+       When `:as_lists` all lists will be printed as lists.
+
+diff --git a/lib/elixir/lib/list.ex b/lib/elixir/lib/list.ex
+index afd19d2..6798cf2 100644
+--- a/lib/elixir/lib/list.ex
++++ b/lib/elixir/lib/list.ex
+@@ -1093,7 +1093,7 @@ def to_string(list) when is_list(list) do
+
+         Please check the given list or call inspect/1 to get the list representation, got:
+
+-        #{inspect(list)}
++        #{inspect(list, charlists: :as_lists)}
+         """
+     else
+       result when is_binary(result) ->
+@@ -1145,7 +1145,7 @@ def to_charlist(list) when is_list(list) do
+
+         Please check the given list or call inspect/1 to get the list representation, got:
+
+-        #{inspect(list)}
++        #{inspect(list, charlists: :as_lists)}
+         """
+     else
+       result when is_list(result) ->
+-- 
+2.45.4
+

SPECS/elixir/elixir.spec

@@ -2,14 +2,15 @@
 Summary:        elixir
 Name:           elixir
 Version:        1.16.1
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        Apache-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Group:          Development/Languages
 URL:            https://elixir-lang.org
 Source0:        https://github.com/elixir-lang/elixir/archive/v%{version}/elixir-%{version}.tar.gz
 Patch0:         CVE-2026-49762.patch
+Patch1:         CVE-2026-75758.patch
 BuildRequires:  erlang
 BuildRequires:  glibc-lang
 
@@ -40,6 +41,9 @@ export LANG="en_US.UTF-8"
 
 
 %changelog
+* Mon Aug 31 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.16.1-3
+- Patch for CVE-2026-75758
+
 * Thu Jun 11 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.16.1-2
 - Patch for CVE-2026-49762