Baike.dev
Log in
Back to tool/Back to issues
#4216·OpenUSD

pxr/base/tf/stl.h:134 SEGV in TfMapLookupPtr

Author: sigdevelCreated Sep 15, 2026Updated Sep 15, 2026

pxr/base/tf/stl.h:134 SEGV in TfMapLookupPtr

Description:

A crafted USDA input corrupts parser state so that metadata lookup dereferences an invalid SdfSchemaBase::SpecDefinition field map. The crash is a null-adjacent read in TfMapLookupPtr called from SdfSchemaBase::SpecDefinition::IsMetadataField during Sdf_TextFileFormatParser::_KeyValueMetadataEnd.

To Reproduce

Discovered during a fuzzing campaign using a structure-aware mutator. If you need the code to compile and run it yourself, please let me know. Steps to reproduce the behavior:

bash
./usda_fuzzer_asan < ./3_TfMapLookupPtr_stl_h_134

Output:

truncated asan-build (full log in attachment):

bash
AddressSanitizer:DEADLYSIGNAL
=================================================================
==316896==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7fccae4a242d bp 0x7ffef18acfb0 sp 0x7ffef18acf90 T0)
==316896==The signal is caused by a READ memory access.
==316896==Hint: address points to the zero page.
    #0 0x7fccae4a242d in std::_Hashtable<...>::size() const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/hashtable.h:662:16
    #1 0x7fccae4a242d in std::_Hashtable<...>::_M_locate(...) const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/hashtable.h:2264:27
    #2 0x7fccae4a242d in std::_Hashtable<...>::find(...) const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/hashtable.h:1929:29
    #3 0x7fccae4a242d in std::unordered_map<...>::find(...) const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/unordered_map.h:958:21
    #4 0x7fccae4a242d in pxrInternal_v0_26_11__pxrReserved__::TfMapLookupPtr<...>(...) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/tf/stl.h:134:48
    #5 0x7fccae4a242d in pxrInternal_v0_26_11__pxrReserved__::SdfSchemaBase::SpecDefinition::IsMetadataField(...) const /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/schema.cpp:247:39
    #6 0x7fccadb37c4b in pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::_KeyValueMetadataEnd(...) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/textParserHelpers.cpp:178:17
SUMMARY: AddressSanitizer: SEGV /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/base/tf/stl.h:134:48 in pxrInternal_v0_26_11__pxrReserved__::TfMapLookupPtr<...>(...)
==316896==ABORTING

Environment

OS: tested at 7.1.5+kali-amd64 x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 ;
CPU type: x86_64 ;
OpenUSD - commit hash 23b83aa8c479ec0f8b8b11dada50e764af6f3645 ;
OpenUSD - version 28.08 ;
Build flags: clang RelWithDebInfo, -DBUILD_SHARED_LIBS=ON -DPXR_BUILD_MONOLITHIC=ON -DPXR_BUILD_IMAGING=OFF -DPXR_BUILD_USD_IMAGING=OFF -DPXR_ENABLE_PYTHON_SUPPORT=OFF -DPXR_BUILD_TESTS=OFF -DPXR_BUILD_USD_VALIDATION=ON ;
Asan build flags: afl-clang-fast/afl-clang-fast++ RelWithDebInfo, -g -O1 -fno-omit-frame-pointer, ASan-enabled harness fuzz/usda_fuzzer_asan ;

Additional context

link to the sample (github-url):

3_TfMapLookupPtr_stl_h_134

full-asan-log

Screenshots

screen

Source: PixarAnimationStudios/OpenUSD

View original on GitHubView discussion on GitHub