pxr/usd/sdf/textFileFormatParser.cpp:3588 Heap-Buffer-Overflow in TextParserAction<PrimSpec>::apply

Author: sigdevelCreated Sep 15, 2026Updated Sep 20, 2026

pxr/usd/sdf/textFileFormatParser.cpp:3588 Heap-Buffer-Overflow in TextParserAction::apply

Description:

A crafted USDA input leaves Sdf_TextParserContext with an invalid prim type-name stack while parsing a prim spec. TextParserAction<PrimSpec>::apply calls empty() on the corrupted vector and ASan reports a heap-buffer-overflow read just past the allocated region.

To Reproduce

Discovered during a fuzzing campaign using a structure-aware mutator. If you need the code to compile and run it yourself, please let me know. Steps to reproduce the behavior:

bash

./usda_fuzzer_asan < ./4_PrimSpec_textFileFormatParser_cpp_3588

Output:

truncated asan-build (full log in attachment):

bash

Warning: in ~_DeferredDiagnostics at line 64 of /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child 'root' to path ''.
=================================================================
==316998==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c0a60def508 at pc 0x7f8a64928a26 bp 0x7ffd967f97b0 sp 0x7ffd967f97a8
READ of size 8 at 0x7c0a60def508 thread T0
    #0 0x7f8a64928a25 in __gnu_cxx::__normal_iterator<...>::__normal_iterator(...) /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/stl_iterator.h:1059:20
    #1 0x7f8a64928a25 in std::vector<pxrInternal_v0_26_11__pxrReserved__::TfToken, ...>::begin() const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/stl_vector.h:1009:16
    #2 0x7f8a64928a25 in std::vector<pxrInternal_v0_26_11__pxrReserved__::TfToken, ...>::empty() const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/stl_vector.h:1224:16
    #3 0x7f8a64928a25 in void pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::TextParserAction<pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::PrimSpec>::apply<...>(...) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/textFileFormatParser.cpp:3588:45
SUMMARY: AddressSanitizer: heap-buffer-overflow /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/textFileFormatParser.cpp:3588:45 in void pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::TextParserAction<...PrimSpec>::apply<...>(...)
==316998==ABORTING

Environment

OS: tested at 7.1.5+kali-amd64 x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 ;
CPU type: x86_64 ;
OpenUSD - commit hash 23b83aa8c479ec0f8b8b11dada50e764af6f3645 ;
OpenUSD - version 28.08 ;
Build flags: clang RelWithDebInfo, -DBUILD_SHARED_LIBS=ON -DPXR_BUILD_MONOLITHIC=ON -DPXR_BUILD_IMAGING=OFF -DPXR_BUILD_USD_IMAGING=OFF -DPXR_ENABLE_PYTHON_SUPPORT=OFF -DPXR_BUILD_TESTS=OFF -DPXR_BUILD_USD_VALIDATION=ON ;
Asan build flags: afl-clang-fast/afl-clang-fast++ RelWithDebInfo, -g -O1 -fno-omit-frame-pointer, ASan-enabled harness fuzz/usda_fuzzer_asan ;

Additional context

link to the sample (github-url):

4_PrimSpec_textFileFormatParser_cpp_3588

full-asan-log

Screenshots

screen

Source: PixarAnimationStudios/OpenUSD

View original on GitHub View discussion on GitHub