pxr/usd/sdf/parserValueContext.cpp:249 Stack Overflow in Sdf_ParserValueContext::BeginTuple

Author: sigdevelCreated Sep 15, 2026Updated Sep 15, 2026

pxr/usd/sdf/parserValueContext.cpp:249 Stack Overflow in Sdf_ParserValueContext::BeginTuple

Description:

A crafted USDA input causes unbounded tuple-value parsing in the SDF text parser. The ASan build exhausts the stack while formatting tuple-depth diagnostics in Sdf_ParserValueContext::BeginTuple, reached from TextParserAction<TupleValueOpen>::apply.

To Reproduce

Discovered during a fuzzing campaign using a structure-aware mutator. If you need the code to compile and run it yourself, please let me know. Steps to reproduce the behavior:

bash

./usda_fuzzer_asan < ./2_BeginTuple_parserValueContext_cpp_249

Output:

truncated asan-build (full log in attachment):

bash

AddressSanitizer:DEADLYSIGNAL
=================================================================
==316835==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd879b8e08 (pc 0x55dc07c67831 bp 0x7ffd879b9690 sp 0x7ffd879b8e10 T0)
    #0 0x55dc07c67831 in printf_common(void*, char const*, __va_list_tag*) asan_interceptors.cpp.o
    #1 0x55dc07c68575 in vsnprintf (/run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/fuzz/usda_fuzzer_asan+0x58575)
    #2 0x7f44da0ba42c in pxrInternal_v0_26_11__pxrReserved__::ArchVsnprintf(char*, unsigned long, char const*, __va_list_tag*) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/arch/vsnprintf.cpp:23:12
    #3 0x7f44da0ba42c in pxrInternal_v0_26_11__pxrReserved__::ArchVStringPrintf[abi:cxx11](char const*, __va_list_tag*) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/arch/vsnprintf.cpp:36:21
    #4 0x7f44da2848bc in pxrInternal_v0_26_11__pxrReserved__::TfStringPrintf[abi:cxx11](char const*, ...) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/tf/stringUtils.cpp:65:16
    #5 0x7f44db4f1bbd in pxrInternal_v0_26_11__pxrReserved__::Sdf_ParserValueContext::BeginTuple() /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/parserValueContext.cpp:249:23
    #6 0x7f44db688e92 in void pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::TextParserAction<pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::TupleValueOpen>::apply<...>(...) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/textFileFormatParser.cpp:1636:24
SUMMARY: AddressSanitizer: stack-overflow asan_interceptors.cpp.o in printf_common(void*, char const*, __va_list_tag*)
==316835==ABORTING

Environment

OS: tested at 7.1.5+kali-amd64 x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 ;
CPU type: x86_64 ;
OpenUSD - commit hash 23b83aa8c479ec0f8b8b11dada50e764af6f3645 ;
OpenUSD - version 28.08 ;
Build flags: clang RelWithDebInfo, -DBUILD_SHARED_LIBS=ON -DPXR_BUILD_MONOLITHIC=ON -DPXR_BUILD_IMAGING=OFF -DPXR_BUILD_USD_IMAGING=OFF -DPXR_ENABLE_PYTHON_SUPPORT=OFF -DPXR_BUILD_TESTS=OFF -DPXR_BUILD_USD_VALIDATION=ON ;
Asan build flags: afl-clang-fast/afl-clang-fast++ RelWithDebInfo, -g -O1 -fno-omit-frame-pointer, ASan-enabled harness fuzz/usda_fuzzer_asan ;

Additional context

link to the sample (github-url):

2_BeginTuple_parserValueContext_cpp_249

full-asan-log

Screenshots

screen

Source: PixarAnimationStudios/OpenUSD

View original on GitHub View discussion on GitHub