pxr/base/pegtl/pegtl/internal/marker.hpp:42 Stack Overflow in pegtl::internal::marker::marker

Author: sigdevelCreated Sep 15, 2026Updated Sep 15, 2026

pxr/base/pegtl/pegtl/internal/marker.hpp:42 Stack Overflow in pegtl::internal::marker::marker

Description:

A crafted USDA input drives the text parser into deeply nested PEGTL matching and rewind-marker creation while parsing list/number values. The ASan build reports a stack overflow; under gdb the crashing frame is __asan_memcpy called from pxrInternal_v0_26_11__pxrReserved___pegtl::internal::marker::marker at pxr/base/pegtl/pegtl/internal/marker.hpp:42.

To Reproduce

Discovered during a fuzzing campaign using a structure-aware mutator. If you need the code to compile and run it yourself, please let me know. Steps to reproduce the behavior:

bash

./usda_fuzzer_asan < ./1_marker_pegtl_internal_marker_hpp_42

Output:

truncated asan-build (full log in attachment):

bash

AddressSanitizer:DEADLYSIGNAL
=================================================================
==400424==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd8b688f68 (pc 0x5622734b44ba bp 0x7ffd8b6897b0 sp 0x7ffd8b688f70 T0)
    #0 0x5622734b44ba in __asan_memcpy
    #1 0x7f4e8f083138 in pxrInternal_v0_26_11__pxrReserved___pegtl::internal::marker<...>::marker
        /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/pegtl/pegtl/internal/marker.hpp:42:12
    #2 0x7f4e8f083138 in pxrInternal_v0_26_11__pxrReserved___pegtl::memory_input<...>::mark
        /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/pegtl/pegtl/memory_input.hpp:339:17
    #3 0x7f4e8f083138 in auto pxrInternal_v0_26_11__pxrReserved___pegtl::match<...NumberValue...>
        /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/pegtl/pegtl/match.hpp:139:31
    #4 0x7f4e8f08c53a in bool pxrInternal_v0_26_11__pxrReserved___pegtl::normal<...NumberValue>::match<...>
        /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/pegtl/pegtl/normal.hpp:92:20

Environment

OS: tested at 7.1.5+kali-amd64 x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 ;
CPU type: x86_64 ;
OpenUSD - commit hash 23b83aa8c479ec0f8b8b11dada50e764af6f3645 ;
OpenUSD - version 28.08 ;
Build flags: clang RelWithDebInfo, -DBUILD_SHARED_LIBS=ON -DPXR_BUILD_MONOLITHIC=ON -DPXR_BUILD_IMAGING=OFF -DPXR_BUILD_USD_IMAGING=OFF -DPXR_ENABLE_PYTHON_SUPPORT=OFF -DPXR_BUILD_TESTS=OFF -DPXR_BUILD_USD_VALIDATION=ON ;
Asan build flags: afl-clang-fast/afl-clang-fast++ RelWithDebInfo, -g -O1 -fno-omit-frame-pointer, ASan-enabled harness fuzz/usda_fuzzer_asan ;

Additional context

link to the sample (github-url):

1_marker_pegtl_internal_marker_hpp_42

full-asan-log

Screenshots

screen

Source: PixarAnimationStudios/OpenUSD

View original on GitHub View discussion on GitHub