File 8582-erts-stdib-Fix-ets-update_element-4.patch of Package erlang

From 886fcfe7162b2d6f3b0729aec5c1bf54a805b132 Mon Sep 17 00:00:00 2001
From: Sverker Eriksson <sverker@erlang.org>
Date: Thu, 5 Feb 2026 20:36:31 +0100
Subject: [PATCH] erts,stdib: Fix ets:update_element/4

Reject a too small default tuple without key element
and thereby avoid dangerous out of bound key accesses.

For backward (bug)-compatibility reason we only badarg
if the key does not exist and bad default tuple is actually used.
---
 erts/emulator/beam/erl_db.c          |  8 +++++++-
 lib/stdlib/src/erl_stdlib_errors.erl |  3 ++-
 lib/stdlib/test/ets_SUITE.erl        | 11 +++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/erts/emulator/beam/erl_db.c b/erts/emulator/beam/erl_db.c
index 57ea72d026..bc5192a68e 100644
--- a/erts/emulator/beam/erl_db.c
+++ b/erts/emulator/beam/erl_db.c
@@ -1320,7 +1320,13 @@ static BIF_RETTYPE do_update_element(Process *p, DbTable *tb,
     }
 
     if (!tb->common.meth->db_lookup_dbterm(p, tb, key, default_obj, &handle)) {
-	cret = DB_ERROR_BADKEY;
+        if (is_value(default_obj)) {
+            p->fvalue = EXI_DEFAULT;
+            cret = DB_ERROR_UNSPEC;
+        }
+        else {
+            cret = DB_ERROR_BADKEY;
+        }
 	goto bail_out;
     }
 
diff --git a/lib/stdlib/src/erl_stdlib_errors.erl b/lib/stdlib/src/erl_stdlib_errors.erl
index e38cd10d7c..dec78245b9 100644
--- a/lib/stdlib/src/erl_stdlib_errors.erl
+++ b/lib/stdlib/src/erl_stdlib_errors.erl
@@ -808,7 +808,8 @@ format_ets_error(update_element, [_, _, ElementSpec, Default]=Args, Cause) ->
 		    position ->
 			[update_op_range];
 		    _ ->
-			case {is_element_spec_top(ElementSpec), format_tuple(Default)} of
+			case {is_element_spec_top(ElementSpec),
+                              format_default_tuple(Default, Cause)} of
 			    {true, [""]} ->
 				[range];
 			    {true, TupleCause} ->
diff --git a/lib/stdlib/test/ets_SUITE.erl b/lib/stdlib/test/ets_SUITE.erl
index e6d82cf42b..5bcc53c683 100644
--- a/lib/stdlib/test/ets_SUITE.erl
+++ b/lib/stdlib/test/ets_SUITE.erl
@@ -2699,6 +2699,17 @@ update_element_default_opts(Opts) ->
 		    [{key1, key2, b, x}] = ets:lookup(Tab, Key),
 		    true = ets:update_element(Tab, Key, {3, c}, {key1, key2, a, y}),
 		    [{key1, key2, c, x}] = ets:lookup(Tab, Key),
+
+                    BadDefault = list_to_tuple(lists:seq(1, Pos-1)),
+                    badarg = try
+                                 ets:update_element(Tab, key_not_present, {1, x}, BadDefault)
+                             catch
+                                 error:badarg -> badarg
+                             end,
+
+                    %% Ignore bad default object if key exist (for backward bug-compat)
+                    true = ets:update_element(Tab, Key, {3, d}, BadDefault),
+
 		    ets:delete(Tab)
                 end
 	    )
-- 
2.51.0