pxr/usd/sdf/textFileFormatParser.cpp:4334 Heap-Buffer-Overflow in TextParserAction<VariantStatement>::apply

Author: sigdevelCreated Sep 15, 2026Updated Sep 15, 2026

pxr/usd/sdf/textFileFormatParser.cpp:4334 Heap-Buffer-Overflow in TextParserAction::apply

Description:

A crafted USDA input leaves variant-selection parser state inconsistent while parsing a variant statement. TextParserAction<VariantStatement>::apply reads through an invalid std::vector<TfToken> state and ASan reports a heap-buffer-overflow read past the allocated object.

To Reproduce

Discovered during a fuzzing campaign using a structure-aware mutator. If you need the code to compile and run it yourself, please let me know. Steps to reproduce the behavior:

bash

./usda_fuzzer_asan < ./5_VariantStatement_textFileFormatParser_cpp_4334

Output:

truncated asan-build (full log in attachment):

bash

Warning: in ~_DeferredDiagnostics at line 64 of /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child 'root' to path ''.
=================================================================
==317062==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c3d4edef488 at pc 0x7fbd5292516b bp 0x7ffde7ae1090 sp 0x7ffde7ae1088
READ of size 8 at 0x7c3d4edef488 thread T0
    #0 0x7fbd5292516a in __gnu_cxx::__normal_iterator<...>::__normal_iterator(...) /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/stl_iterator.h:1059:20
    #1 0x7fbd5292516a in std::vector<pxrInternal_v0_26_11__pxrReserved__::TfToken, ...>::begin() const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/stl_vector.h:1009:16
    #2 0x7fbd5292516a in std::vector<pxrInternal_v0_26_11__pxrReserved__::TfToken, ...>::empty() const /usr/lib/gcc/x86_64-linux-gnu/15/../../../../include/c++/15/bits/stl_vector.h:1224:16
    #3 0x7fbd5292516a in void pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::TextParserAction<pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::VariantStatement>::apply<...>(...) /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/textFileFormatParser.cpp:4334:45
SUMMARY: AddressSanitizer: heap-buffer-overflow /run/media/user/8ed8205b-4114-4c2a-b2d0-e2ad6640262d/PixarAnimationStudios/asan_OpenUSD/pxr/usd/sdf/textFileFormatParser.cpp:4334:45 in void pxrInternal_v0_26_11__pxrReserved__::Sdf_TextFileFormatParser::TextParserAction<...VariantStatement>::apply<...>(...)
==317062==ABORTING

Environment

OS: tested at 7.1.5+kali-amd64 x86_64 GNU/Linux ;
Compiler version: Debian clang version 21.1.8 ;
CPU type: x86_64 ;
OpenUSD - commit hash 23b83aa8c479ec0f8b8b11dada50e764af6f3645 ;
OpenUSD - version 28.08 ;
Build flags: clang RelWithDebInfo, -DBUILD_SHARED_LIBS=ON -DPXR_BUILD_MONOLITHIC=ON -DPXR_BUILD_IMAGING=OFF -DPXR_BUILD_USD_IMAGING=OFF -DPXR_ENABLE_PYTHON_SUPPORT=OFF -DPXR_BUILD_TESTS=OFF -DPXR_BUILD_USD_VALIDATION=ON ;
Asan build flags: afl-clang-fast/afl-clang-fast++ RelWithDebInfo, -g -O1 -fno-omit-frame-pointer, ASan-enabled harness fuzz/usda_fuzzer_asan ;

Additional context

link to the sample (github-url):

5_VariantStatement_textFileFormatParser_cpp_4334

full-asan-log

Screenshots

screen

Source: PixarAnimationStudios/OpenUSD

View original on GitHub View discussion on GitHub