CWE-416

{
  "affected": [],
  "aliases": [
    "CVE-2025-27077"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-24T16:15:36Z",
    "severity": "HIGH"
  },
  "details": "Memory corruption while processing message in guest VM.",
  "id": "GHSA-58mr-6jqq-28pg",
  "modified": "2025-09-24T18:30:30Z",
  "published": "2025-09-24T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27077"
    },
    {
      "type": "WEB",
      "url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2025-bulletin.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "usd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-04T18:57:27Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nA Use-After-Free (UAF) vulnerability has been discovered in the Sdf_PathNode module of the Pixar OpenUSD library. This issue occurs during the deletion of the Sdf_PrimPathNode object in multi-threaded environments, where freed memory is accessed. This results in segmentation faults or bus errors, allowing attackers to potentially exploit the vulnerability for remote code execution (RCE). By using a specially crafted .usd file, an attacker could gain control of the affected system. The vulnerability has been confirmed in multiple OpenUSD tools, including sdfdump, usdtree, usdcat, and sdffilter.\n\n### Patches\n\nThis is fixed with [commit 0d74f31](https://github.com/PixarAnimationStudios/OpenUSD/commit/0d74f31fe64310791e274e587c9926335e9db9db), with the fix available in OpenUSD 25.08 and onwards.\n\n### Details\nThe issue is a Use-After-Free vulnerability in the Sdf_PathNode destruction process, specifically in Sdf_PrimPathNode::~Sdf_PrimPathNode(). When multiple threads attempt to destroy or modify the same Sdf_PathNode object, a race condition can occur, causing the object to be accessed after it has been freed. This leads to segmentation faults or bus errors, as observed in the crash logs.\n```\nroot@DESKTOP-7VTO277:/mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/bin# ./sdffilter /mnt/c/Users/HomePc/Downloads/one.usd\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nAddressSanitizer:DEADLYSIGNAL\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\n=================================================================\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nAddressSanitizerWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\n:DEADLYSIGNAL\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Standin\u0027 to path \u0027/HumanFemale_Group/KidThinButtonDown/Geom/LSock/Hair/Body/HeelSeam_sbdv/BrowL_HairLayer.primvars:displayColor\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Tongue_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Body/Body_sbdv.points\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Geom\u0027 to path \u0027/HumanFemale_Group/KidThinButtonDown/Geom/LSock/Hair/Body/HeelSeam_sbdv.faceVertexCounts\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Cornea_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Body/Body_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Iris_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Body/Body_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:geomBindTransform\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\n==270474==ERROR: AddressSanitizer: SEGV on unknown address 0x7f8500000008 (pc 0x7f855a574b2b bp 0x7ffcd379aa30 sp 0x7ffcd379a770 T0)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Pupil_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Body/Body_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Sclera_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Body/Body_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:geomBindTransform\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\n==270474==The signal is caused by a WRITE memory access.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027subdivisionScheme\u0027 to a prim path (/HumanFemale_Group/HumanFemaleHair.xformOpOrder)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027subdivisionScheme\u0027 to a prim path (/HumanFemale_Group/SocksHuman.xformOp:transform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:geomBindTransform\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027visibility\u0027 to a prim path (/RShoe/Body/ShoeBody_sbdv/Geom/RShoe/Sole/Standin/Shell_sbdv.interpolateBoundary)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027subdivisionScheme\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=faceBones}Geom/Face/Eyes/LEye/Pupil_sbdv/LEye/Iris_sbdv.faceVertexCounts)\nAddressSanitizer:DEADLYSIGNAL\n    #0 0x7f855a574b2b in std::__atomic_base\u003cunsigned int\u003e::fetch_add(unsigned int, std::memory_order) /usr/include/c++/11/bits/atomic_base.h:618\n    #1 0x7f855a574b2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountIncrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:742\n    #2 0x7f855a574b2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_IncrementIfValid() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:247\n    #3 0x7f855a574b2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::TfDelegatedCountPtr(pxrInternal_v0_24__pxrReserved__::TfDelegatedCountIncrementTagType, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:116\n    #4 0x7f855a574b2b in pxrInternal_v0_24__pxrReserved__::Sdf_PrimPathNode::~Sdf_PrimPathNode() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:752\n    #5 0x5653213d7c80 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::_Destroy() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:659\n    #6 0x5653213d7c80 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountDecrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:746\n    #7 0x5653213d7c80 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_DecRef() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:177\n    #8 0x5653213d7c80 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::~Sdf_PathNodeHandleImpl() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:97\nAddressSanitizer:DEADLYSIGNAL\nAddressSanitizer: nested bug in the same thread, aborting.\n```\n\n```\nroot@DESKTOP-7VTO277:/mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/bin# ./usdcat /mnt/c/Users/HomePc/Downloads/one.usd\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027LEye\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Eyes_REye_Lids_OutCornerUD.xformOp:transform\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027xformOp:transform\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Mouth_JawUD/Geom/Face/Eyes/LEye/Sclera_sbdv.primvars:skel:jointIndices)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Cornea_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/HeelSeam_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027xformOpOrder\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Mouth_JawUD/Geom/Face/Eyes/LEye/Sclera_sbdv.primvars:skel:jointIndices)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Iris_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/HeelSeam_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Pupil_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/HeelSeam_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027HeelSeam_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/ShoeBody_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027xformOp:transform\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Mouth_JawUD/Geom/Face/Eyes/LEye/Pupil_sbdv.subdivisionScheme)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Geom\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Mouth_JawUD/Geom/Face/Eyes/LEye/Sclera_sbdv.primvars:skel:jointIndices\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027xformOpOrder\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Mouth_JawUD/Geom/Face/Eyes/LEye/Pupil_sbdv.subdivisionScheme)\nAddressSanitizer:DEADLYSIGNAL\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/ShoeBody_sbdv.primvars:skel:jointWeights)\n=================================================================\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027ShoeBody_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/ShoeBody_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Tongue_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=reduced}Geom/Face/Body_sbdv.primvars:skel:jointIndices\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027doubleSided\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/ShoeBody_sbdv.primvars:skel:jointWeights)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Sclera_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=faceBones}Geom/Hair/Layers/Geom/LShoe/Body/HeelSeam_sbdv.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Geom\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Mouth_JawUD/Geom/Face/Eyes/LEye/Pupil_sbdv.subdivisionScheme\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027REye\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Eyes_REye_Lids_OutCornerUD.xformOp:transform\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\n==271750==ERROR: AddressSanitizer: SEGV on unknown address 0x7f9602c0040f (pc 0x7f962b94286f bp 0x7f96233abb40 sp 0x7f96233abaf0 T10)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:geomBindTransform\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027subdivisionScheme\u0027 to a prim path (/HumanFemale_Group/HumanFemale{rigComplexity=}{rigComplexity=high}Geom/Hair/Layers/Geom/LShoe/BrowL_HairLayer/Body/ShoeBody_sbdv.faceVertexCounts)\n==271750==The signal is caused by a READ memory access.\n    #0 0x7f962b94286f in _WriteTextToBuffer\u003cpxrInternal_v0_24__pxrReserved__::(anonymous namespace)::_StringBuffer\u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:662\n    #1 0x7f962b942d6f in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::_CreatePathToken(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:620\n    #2 0x7f962b945eb3 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:506\n    #3 0x7f962b945eb3 in FindOrCreate\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode::GetPathToken(const pxrInternal_v0_24__pxrReserved__::Sdf_PathNode*, const pxrInternal_v0_24__pxrReserved__::Sdf_PathNode*)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:458\n    #4 0x7f962b945eb3 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::GetPathToken(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:504\n    #5 0x7f962b852a5c in pxrInternal_v0_24__pxrReserved__::SdfPath::GetToken() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp:339\n    #6 0x7f962b852d2c in pxrInternal_v0_24__pxrReserved__::SdfPath::GetText() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp:353\n    #7 0x7f962b868bd7 in pxrInternal_v0_24__pxrReserved__::SdfPath::AppendChild(pxrInternal_v0_24__pxrReserved__::TfToken const\u0026) const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp:824\n    #8 0x7f962b8708b6 in pxrInternal_v0_24__pxrReserved__::SdfPath::AppendElementToken(pxrInternal_v0_24__pxrReserved__::TfToken const\u0026) const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp:1166\n    #9 0x7f962ca352e5 in pxrInternal_v0_24__pxrReserved__::Usd_CrateFile::CrateFile::_BuildDecompressedPathsImpl(std::vector\u003cunsigned int, std::allocator\u003cunsigned int\u003e \u003e const\u0026, std::vector\u003cint, std::allocator\u003cint\u003e \u003e const\u0026, std::vector\u003cint, std::allocator\u003cint\u003e \u003e const\u0026, unsigned long, pxrInternal_v0_24__pxrReserved__::SdfPath, pxrInternal_v0_24__pxrReserved__::WorkDispatcher\u0026) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/usd/crateFile.cpp:3741\n    #10 0x7f962ca3d435 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/usd/crateFile.cpp:3775\n    #11 0x7f962ca3d435 in execute /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/work/dispatcher.h:170\n    #12 0x7f9629c0f135 in tbb::internal::custom_scheduler\u003ctbb::internal::IntelSchedulerTraits\u003e::process_bypass_loop(tbb::internal::context_guard_helper\u003cfalse\u003e\u0026, tbb::task*, long) ../../src/tbb/custom_scheduler.h:474\n    #13 0x7f9629c1026c in tbb::internal::custom_scheduler\u003ctbb::internal::IntelSchedulerTraits\u003e::local_wait_for_all(tbb::task\u0026, tbb::task*) ../../src/tbb/custom_scheduler.h:636\n    #14 0x7f9629bfa5d3 in tbb::internal::arena::process(tbb::internal::generic_scheduler\u0026) ../../src/tbb/arena.cpp:196\n    #15 0x7f9629bf1741 in tbb::internal::market::process(rml::job\u0026) ../../src/tbb/market.cpp:667\n    #16 0x7f9629be3889 in tbb::internal::rml::private_worker::run() ../../src/tbb/private_server.cpp:266\n    #17 0x7f9629be472a in tbb::internal::rml::private_worker::thread_routine(void*) ../../src/tbb/private_server.cpp:219\n    #18 0x7f96296c4ac2 in start_thread nptl/pthread_create.c:442\n    #19 0x7f962975684f  (/lib/x86_64-linux-gnu/libc.so.6+0x12684f)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:662 in _WriteTextToBuffer\u003cpxrInternal_v0_24__pxrReserved__::(anonymous namespace)::_StringBuffer\u003e\nThread T10 created by T3 here:\n    #0 0x7f962e987685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216\n    #1 0x7f9629be4ff1 in rml::internal::thread_monitor::launch(void* (*)(void*), void*, unsigned long) ../../src/tbb/../rml/server/thread_monitor.h:218\n    #2 0x7f9629be4ff1 in tbb::internal::rml::private_worker::wake_or_launch() ../../src/tbb/private_server.cpp:297\n    #3 0x7f9629be3303 in tbb::internal::rml::private_server::wake_some(int) ../../src/tbb/private_server.cpp:395\n    #4 0x7f9629be3722 in tbb::internal::rml::private_server::propagate_chain_reaction() ../../src/tbb/private_server.cpp:157\n    #5 0x7f9629be3722 in tbb::internal::rml::private_worker::run() ../../src/tbb/private_server.cpp:257\n    #6 0x7f9629be472a in tbb::internal::rml::private_worker::thread_routine(void*) ../../src/tbb/private_server.cpp:219\n    #7 0x7f96296c4ac2 in start_thread nptl/pthread_create.c:442\n\nThread T3 created by T1 here:\n    #0 0x7f962e987685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216\n    #1 0x7f9629be4ff1 in rml::internal::thread_monitor::launch(void* (*)(void*), void*, unsigned long) ../../src/tbb/../rml/server/thread_monitor.h:218\n    #2 0x7f9629be4ff1 in tbb::internal::rml::private_worker::wake_or_launch() ../../src/tbb/private_server.cpp:297\n    #3 0x7f9629be3303 in tbb::internal::rml::private_server::wake_some(int) ../../src/tbb/private_server.cpp:395\n    #4 0x7f9629be3722 in tbb::internal::rml::private_server::propagate_chain_reaction() ../../src/tbb/private_server.cpp:157\n    #5 0x7f9629be3722 in tbb::internal::rml::private_worker::run() ../../src/tbb/private_server.cpp:257\n    #6 0x7f9629be472a in tbb::internal::rml::private_worker::thread_routine(void*) ../../src/tbb/private_server.cpp:219\n    #7 0x7f96296c4ac2 in start_thread nptl/pthread_create.c:442\n\nThread T1 created by T0 here:\n    #0 0x7f962e987685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216\n    #1 0x7f9629be4ff1 in rml::internal::thread_monitor::launch(void* (*)(void*), void*, unsigned long) ../../src/tbb/../rml/server/thread_monitor.h:218\n    #2 0x7f9629be4ff1 in tbb::internal::rml::private_worker::wake_or_launch() ../../src/tbb/private_server.cpp:297\n    #3 0x7f9629be3303 in tbb::internal::rml::private_server::wake_some(int) ../../src/tbb/private_server.cpp:395\n    #4 0x7f9629be3479 in tbb::internal::rml::private_server::adjust_job_count_estimate(int) ../../src/tbb/private_server.cpp:406\n    #5 0x7f9629bf4f27 in tbb::internal::market::adjust_demand(tbb::internal::arena\u0026, int) ../../src/tbb/market.cpp:655\n    #6 0x7f9629c0d7e0 in void tbb::internal::arena::advertise_new_work\u003c(tbb::internal::arena::new_work_type)0\u003e() ../../src/tbb/arena.h:548\n    #7 0x7f9629c096e8 in tbb::internal::generic_scheduler::local_spawn(tbb::task*, tbb::task*\u0026) ../../src/tbb/scheduler.cpp:716\n    #8 0x7f9629c09e36 in tbb::internal::generic_scheduler::spawn(tbb::task\u0026, tbb::task*\u0026) ../../src/tbb/scheduler.cpp:742\n    #9 0x7f962a56553b in tbb::interface5::internal::task_base::spawn(tbb::task\u0026) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task.h:1125\n    #10 0x7f962a56553b in Run\u003cconst pxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool, const AddVisitedPathCallback\u0026, const AddPluginCallback\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*)::\u003clambda()\u003e\u0026\u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/work/dispatcher.h:99\n    #11 0x7f962a56553b in Run\u003cpxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool, const AddVisitedPathCallback\u0026, const AddPluginCallback\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/info.cpp:462\n    #12 0x7f962a56553b in Run\u003cpxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool, const AddVisitedPathCallback\u0026, const AddPluginCallback\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/info.cpp:495\n    #13 0x7f962a56553b in pxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(std::vector\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e, std::allocator\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e \u003e \u003e const\u0026, bool, std::function\u003cbool (std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026)\u003e const\u0026, std::function\u003cvoid (pxrInternal_v0_24__pxrReserved__::Plug_RegistrationMetadata const\u0026)\u003e const\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/info.cpp:716\n    #14 0x7f962a6052a6 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/registry.cpp:125\n    #15 0x7f962a6052a6 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task_arena.h:96\n    #16 0x7f9629bf7d38 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base\u0026, long) ../../src/tbb/arena.cpp:1199\n    #17 0x7f962a606cb3 in isolate_impl\u003cvoid, const pxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task_arena.h:216\n    #18 0x7f962a606cb3 in isolate\u003cpxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task_arena.h:472\n    #19 0x7f962a606cb3 in WorkWithScopedParallelism\u003cpxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/work/withScopedParallelism.h:106\n    #20 0x7f962a606cb3 in pxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(std::vector\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e, std::allocator\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e \u003e \u003e const\u0026, bool) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/registry.cpp:124\n    #21 0x7f962a60d09d in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/registry.cpp:281\n    #22 0x7f962a60d09d in __invoke_impl\u003cvoid, pxrInternal_v0_24__pxrReserved__::PlugPlugin::_RegisterAllPlugins()::\u003clambda()\u003e \u003e /usr/include/c++/11/bits/invoke.h:61\n    #23 0x7f962a60d09d in __invoke\u003cpxrInternal_v0_24__pxrReserved__::PlugPlugin::_RegisterAllPlugins()::\u003clambda()\u003e \u003e /usr/include/c++/11/bits/invoke.h:96\n    #24 0x7f962a60d09d in operator() /usr/include/c++/11/mutex:776\n    #25 0x7f962a60d09d in operator() /usr/include/c++/11/mutex:712\n    #26 0x7f962a60d09d in _FUN /usr/include/c++/11/mutex:712\n    #27 0x7f96296c9ee7 in __pthread_once_slow nptl/pthread_once.c:116\n\n==271750==ABORTING\n```\n\n```\nroot@DESKTOP-7VTO277:/mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/bin# ./sdfdump  /mnt/c/Users/HomePc/Downloads/one.usd\nAddressSanitizerAddressSanitizer:DEADLYSIGNAL\n=================================================================\n:DEADLYSIGNAL\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Hair\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Pupil_sbdv/ThumbToeNail_sbdv.primvars:skel:jointIndices\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Render\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Pupil_sbdv/ThumbToeNail_sbdv.primvars:skel:jointIndices\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Standin\u0027 to path \u0027/HumanFemale_Group/SocksHuman/Geom/RSock/AnkleSock_sbdv.primvars:displayColor\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027ButtonDownRenderMesh_sbdv\u0027 to path \u0027/.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Geom\u0027 to path \u0027/HumanFemale_Group/KidThinButtonDown/Face{rigComplexity=}RShoe/Body/HeelSeam_sbdv.extent\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Render\u0027 to path \u0027/HumanFemale_Group/KidThinButtonDown/Face{rigComplexity=}RShoe/Sole/REye.subdivisionScheme\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Iris_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Cheeks_LCheek_Puff.primvars:skel:geomBindTransform\u0027.\nAddressSanitizer:DEADLYSIGNAL\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Pupil_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Cheeks_LCheek_Puff.primvars:skel:geomBindTransform\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Standin\u0027 to path \u0027/HumanFemale_Group/HumanFemale{rigComplexity=reduced}HeadHair/BetaRight_HairLayer/Standin/Shell_sbdv/Iris_sbdv.points\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Sclera_sbdv\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Body/Body_sbdv/HumanFemale_Anim_Face_Cheeks_LCheek_Puff.primvars:skel:geomBindTransform\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\n==271764==ERROR: AddressSanitizer: SEGV on unknown address 0x7fb401c00409 (pc 0x7fb48c37eb2b bp 0x7fb4851b1930 sp 0x7fb4851b1670 T5)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Body_sbdv\u0027 to path \u0027/HumanFemale_Group/KidThinButtonDown{rigComplexity=}Body/Render/ShoeBody_sbdv.faceVertexCounts\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\n==271764==The signal is caused by a WRITE memory access.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027visibility\u0027 to a prim path (/HumanFemale_Group/HumanFemale/Geom/Body/Nails/RFingerNails/Iris_sbdv/Geom/Face/Eyes/REye/Cornea_sbdv.primvars:skel:jointWeights)\n    #0 0x7fb48c37eb2b in std::__atomic_base\u003cunsigned int\u003e::fetch_add(unsigned int, std::memory_order) /usr/include/c++/11/bits/atomic_base.h:618\n    #1 0x7fb48c37eb2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountIncrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:742\n    #2 0x7fb48c37eb2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_IncrementIfValid() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:247\n    #3 0x7fb48c37eb2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::TfDelegatedCountPtr(pxrInternal_v0_24__pxrReserved__::TfDelegatedCountIncrementTagType, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:116\n    #4 0x7fb48c37eb2b in pxrInternal_v0_24__pxrReserved__::Sdf_PrimPathNode::~Sdf_PrimPathNode() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:752\n    #5 0x7fb48c2b1327 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::_Destroy() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:659\n    #6 0x7fb48c2b1327 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountDecrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:746\n    #7 0x7fb48c37f484 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_DecrementIfValid() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:253\n    #8 0x7fb48c37f484 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::~TfDelegatedCountPtr() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:192\n    #9 0x7fb48c37f484 in pxrInternal_v0_24__pxrReserved__::Sdf_PrimPathNode::~Sdf_PrimPathNode() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:752\n    #10 0x7fb48c2b1327 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::_Destroy() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:659\n    #11 0x7fb48c2b1327 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountDecrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:746\n    #12 0x7fb48c37f4e0 in pxrInternal_v0_24__pxrReserved__::Sdf_PrimPartPathNode::~Sdf_PrimPartPathNode() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:324\n    #13 0x7fb48c37f4e0 in pxrInternal_v0_24__pxrReserved__::Sdf_PrimPathNode::~Sdf_PrimPathNode() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:755\n    #14 0x556821bbf7c0 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::_Destroy() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:659\n    #15 0x556821bbf7c0 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountDecrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:746\n    #16 0x556821bbf7c0 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_DecRef() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:177\n    #17 0x556821bbf7c0 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::~Sdf_PathNodeHandleImpl() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:97\n    #18 0x7fb4821c1463 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::operator=(pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e\u0026\u0026) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:117\n    #19 0x7fb4821c1463 in pxrInternal_v0_24__pxrReserved__::SdfPath::operator=(pxrInternal_v0_24__pxrReserved__::SdfPath\u0026\u0026) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:273\n    #20 0x7fb4821c1463 in pxrInternal_v0_24__pxrReserved__::Usd_CrateFile::CrateFile::_BuildDecompressedPathsImpl(std::vector\u003cunsigned int, std::allocator\u003cunsigned int\u003e \u003e const\u0026, std::vector\u003cint, std::allocator\u003cint\u003e \u003e const\u0026, std::vector\u003cint, std::allocator\u003cint\u003e \u003e const\u0026, unsigned long, pxrInternal_v0_24__pxrReserved__::SdfPath, pxrInternal_v0_24__pxrReserved__::WorkDispatcher\u0026) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/usd/crateFile.cpp:3743\n    #21 0x7fb4821c9435 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/usd/crateFile.cpp:3775\n    #22 0x7fb4821c9435 in execute /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/work/dispatcher.h:170\n    #23 0x7fb48a639135 in tbb::internal::custom_scheduler\u003ctbb::internal::IntelSchedulerTraits\u003e::process_bypass_loop(tbb::internal::context_guard_helper\u003cfalse\u003e\u0026, tbb::task*, long) ../../src/tbb/custom_scheduler.h:474\n    #24 0x7fb48a63a26c in tbb::internal::custom_scheduler\u003ctbb::internal::IntelSchedulerTraits\u003e::local_wait_for_all(tbb::task\u0026, tbb::task*) ../../src/tbb/custom_scheduler.h:636\n    #25 0x7fb48a6245d3 in tbb::internal::arena::process(tbb::internal::generic_scheduler\u0026) ../../src/tbb/arena.cpp:196\n    #26 0x7fb48a61b741 in tbb::internal::market::process(rml::job\u0026) ../../src/tbb/market.cpp:667\n    #27 0x7fb48a60d889 in tbb::internal::rml::private_worker::run() ../../src/tbb/private_server.cpp:266\n    #28 0x7fb48a60e72a in tbb::internal::rml::private_worker::thread_routine(void*) ../../src/tbb/private_server.cpp:219\n    #29 0x7fb48a0ecac2 in start_thread nptl/pthread_create.c:442\n    #30 0x7fb48a17e84f  (/lib/x86_64-linux-gnu/libc.so.6+0x12684f)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /usr/include/c++/11/bits/atomic_base.h:618 in std::__atomic_base\u003cunsigned int\u003e::fetch_add(unsigned int, std::memory_order)\nThread T5 created by T1 here:\n    #0 0x7fb48c91e685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216\n    #1 0x7fb48a60eff1 in rml::internal::thread_monitor::launch(void* (*)(void*), void*, unsigned long) ../../src/tbb/../rml/server/thread_monitor.h:218\n    #2 0x7fb48a60eff1 in tbb::internal::rml::private_worker::wake_or_launch() ../../src/tbb/private_server.cpp:297\n    #3 0x7fb48a60d303 in tbb::internal::rml::private_server::wake_some(int) ../../src/tbb/private_server.cpp:395\n    #4 0x7fb48a60d722 in tbb::internal::rml::private_server::propagate_chain_reaction() ../../src/tbb/private_server.cpp:157\n    #5 0x7fb48a60d722 in tbb::internal::rml::private_worker::run() ../../src/tbb/private_server.cpp:257\n    #6 0x7fb48a60e72a in tbb::internal::rml::private_worker::thread_routine(void*) ../../src/tbb/private_server.cpp:219\n    #7 0x7fb48a0ecac2 in start_thread nptl/pthread_create.c:442\n\nThread T1 created by T0 here:\n    #0 0x7fb48c91e685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216\n    #1 0x7fb48a60eff1 in rml::internal::thread_monitor::launch(void* (*)(void*), void*, unsigned long) ../../src/tbb/../rml/server/thread_monitor.h:218\n    #2 0x7fb48a60eff1 in tbb::internal::rml::private_worker::wake_or_launch() ../../src/tbb/private_server.cpp:297\n    #3 0x7fb48a60d303 in tbb::internal::rml::private_server::wake_some(int) ../../src/tbb/private_server.cpp:395\n    #4 0x7fb48a60d479 in tbb::internal::rml::private_server::adjust_job_count_estimate(int) ../../src/tbb/private_server.cpp:406\n    #5 0x7fb48a61ef27 in tbb::internal::market::adjust_demand(tbb::internal::arena\u0026, int) ../../src/tbb/market.cpp:655\n    #6 0x7fb48a6377e0 in void tbb::internal::arena::advertise_new_work\u003c(tbb::internal::arena::new_work_type)0\u003e() ../../src/tbb/arena.h:548\n    #7 0x7fb48a6336e8 in tbb::internal::generic_scheduler::local_spawn(tbb::task*, tbb::task*\u0026) ../../src/tbb/scheduler.cpp:716\n    #8 0x7fb48a633e36 in tbb::internal::generic_scheduler::spawn(tbb::task\u0026, tbb::task*\u0026) ../../src/tbb/scheduler.cpp:742\n    #9 0x7fb48b4ac53b in tbb::interface5::internal::task_base::spawn(tbb::task\u0026) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task.h:1125\n    #10 0x7fb48b4ac53b in Run\u003cconst pxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool, const AddVisitedPathCallback\u0026, const AddPluginCallback\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*)::\u003clambda()\u003e\u0026\u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/work/dispatcher.h:99\n    #11 0x7fb48b4ac53b in Run\u003cpxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool, const AddVisitedPathCallback\u0026, const AddPluginCallback\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/info.cpp:462\n    #12 0x7fb48b4ac53b in Run\u003cpxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool, const AddVisitedPathCallback\u0026, const AddPluginCallback\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/info.cpp:495\n    #13 0x7fb48b4ac53b in pxrInternal_v0_24__pxrReserved__::Plug_ReadPlugInfo(std::vector\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e, std::allocator\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e \u003e \u003e const\u0026, bool, std::function\u003cbool (std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026)\u003e const\u0026, std::function\u003cvoid (pxrInternal_v0_24__pxrReserved__::Plug_RegistrationMetadata const\u0026)\u003e const\u0026, pxrInternal_v0_24__pxrReserved__::Plug_TaskArena*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/info.cpp:716\n    #14 0x7fb48b54c2a6 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/registry.cpp:125\n    #15 0x7fb48b54c2a6 in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task_arena.h:96\n    #16 0x7fb48a621d38 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base\u0026, long) ../../src/tbb/arena.cpp:1199\n    #17 0x7fb48b54dcb3 in isolate_impl\u003cvoid, const pxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task_arena.h:216\n    #18 0x7fb48b54dcb3 in isolate\u003cpxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/include/tbb/task_arena.h:472\n    #19 0x7fb48b54dcb3 in WorkWithScopedParallelism\u003cpxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(const std::vector\u003cstd::__cxx11::basic_string\u003cchar\u003e \u003e\u0026, bool)::\u003clambda()\u003e \u003e /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/work/withScopedParallelism.h:106\n    #20 0x7fb48b54dcb3 in pxrInternal_v0_24__pxrReserved__::PlugRegistry::_RegisterPlugins(std::vector\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e, std::allocator\u003cstd::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e \u003e \u003e const\u0026, bool) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/registry.cpp:124\n    #21 0x7fb48b55409d in operator() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/plug/registry.cpp:281\n    #22 0x7fb48b55409d in __invoke_impl\u003cvoid, pxrInternal_v0_24__pxrReserved__::PlugPlugin::_RegisterAllPlugins()::\u003clambda()\u003e \u003e /usr/include/c++/11/bits/invoke.h:61\n    #23 0x7fb48b55409d in __invoke\u003cpxrInternal_v0_24__pxrReserved__::PlugPlugin::_RegisterAllPlugins()::\u003clambda()\u003e \u003e /usr/include/c++/11/bits/invoke.h:96\n    #24 0x7fb48b55409d in operator() /usr/include/c++/11/mutex:776\n    #25 0x7fb48b55409d in operator() /usr/include/c++/11/mutex:712\n    #26 0x7fb48b55409d in _FUN /usr/include/c++/11/mutex:712\n    #27 0x7fb48a0f1ee7 in __pthread_once_slow nptl/pthread_once.c:116\n\n==271764==ABORTING\n```\n\n```\nroot@DESKTOP-7VTO277:/mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/asan_install/bin# ./usdtree /mnt/c/Users/HomePc/Downloads/one.usd\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027LFingerNails\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Face/Geom/Hair/Layers/EyeHair/BrowL_HairLayer/Standin/Shell_sbdv.extent\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027LToeNails\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Face/Geom/Hair/Layers/EyeHair/BrowL_HairLayer/Standin/Shell_sbdv.extent\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Hair\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.faceVertexIndices\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Standin\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.faceVertexIndices\u0027.\nAddressSanitizerAddressSanitizer:DEADLYSIGNAL\n:DEADLYSIGNAL\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Geom\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/LEye/Iris_sbdv/BetaRight_HairLayer/Standin/Shell_sbdv.extent\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027RFingerNails\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Face/Geom/Hair/Layers/EyeHair/BrowL_HairLayer/Standin/Shell_sbdv.extent\u0027.\n=================================================================\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027BrowL_HairLayer\u0027 to path \u0027/EyeHair/Standin.extent\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027RToeNails\u0027 to path \u0027/HumanFemale_Group/HumanFemale/Geom/Face/Geom/Hair/Layers/EyeHair/BrowL_HairLayer/Standin/Shell_sbdv.extent\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Render\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.xformOpOrder\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Body\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/Geom.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027extent\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Sole\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/Geom.primvars:skel:jointWeights\u0027.\nWarning (secondary thread): in AppendChild at line 824 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Cannot append child \u0027Geom\u0027 to path \u0027/HumanFemale_Group/KidThinLeggings/Geom/Render/ButtonDownRenderMesh_sbdv/RShoe/HeelSeam_sbdv/ShoeBody_sbdv.primvars:skel:jointIndices\u0027.\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexCounts\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027faceVertexIndices\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027points\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:displayColor\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nAddressSanitizerWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:geomBindTransform\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\n:DEADLYSIGNAL\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointIndices\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nAddressSanitizer:DEADLYSIGNAL\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027primvars:skel:jointWeights\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\nWarning (secondary thread): in AppendProperty at line 921 of /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.cpp -- Can only append a property \u0027subdivisionScheme\u0027 to a prim path (/HumanFemale_Group/KidThinLeggings/LEye/Sclera_sbdv.primvars:skel:geomBindTransform)\n==271780==ERROR: AddressSanitizer: SEGV on unknown address 0x7fea02800109 (pc 0x7fea78e0db2b bp 0x7ffe818d03e0 sp 0x7ffe818d0120 T0)\n==271780==The signal is caused by a WRITE memory access.\n    #0 0x7fea78e0db2b in std::__atomic_base\u003cunsigned int\u003e::fetch_add(unsigned int, std::memory_order) /usr/include/c++/11/bits/atomic_base.h:618\n    #1 0x7fea78e0db2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountIncrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:742\n    #2 0x7fea78e0db2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_IncrementIfValid() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:247\n    #3 0x7fea78e0db2b in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountPtr\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::TfDelegatedCountPtr(pxrInternal_v0_24__pxrReserved__::TfDelegatedCountIncrementTagType, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/base/tf/delegatedCountPtr.h:116\n    #4 0x7fea78e0db2b in pxrInternal_v0_24__pxrReserved__::Sdf_PrimPathNode::~Sdf_PrimPathNode() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.cpp:752\n    #5 0x564aa248fd20 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNode::_Destroy() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:659\n    #6 0x564aa248fd20 in pxrInternal_v0_24__pxrReserved__::TfDelegatedCountDecrement(pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const*) /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/pathNode.h:746\n    #7 0x564aa248fd20 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::_DecRef() const /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:177\n    #8 0x564aa248fd20 in pxrInternal_v0_24__pxrReserved__::Sdf_PathNodeHandleImpl\u003cpxrInternal_v0_24__pxrReserved__::Sdf_Pool\u003cpxrInternal_v0_24__pxrReserved__::Sdf_PathPrimTag, 24u, 8u, 16384u\u003e::Handle, true, pxrInternal_v0_24__pxrReserved__::Sdf_PathNode const\u003e::~Sdf_PathNodeHandleImpl() /mnt/c/Users/HomePc/Fuzzing/linuxTarget/usd/OpenUSD/pxr/usd/sdf/path.h:97\nAddressSanitizer:DEADLYSIGNAL\nAddressSanitizer: nested bug in the same thread, aborting.\n```\n\n\n### PoC\n1. Upload all proof-of-concept file [poc.usd.zip](https://github.com/user-attachments/files/17690595/poc.usd.zip)\n3. Put any additional instructions or explanation for executing the proof-of-concept here\nA crafted .usd file is attached, which triggers the vulnerability when loaded into any of the affected tools. This issue has been successfully reproduced in both Linux and macOS environments.\n\n- Build the OpenUSD tools using the provided build instructions:\n```\ngit clone https://github.com/PixarAnimationStudios/OpenUSD.git\npython3 OpenUSD/build_scripts/build_usd.py ./install -j4 --no-python\n\ncd ./install/bin\n./sdfdump /path/to/poc.usd\n```\n\n- Run one of the vulnerable tools (e.g., `sdffilter`) with the provided crafted `.usd` file.\n```\n./sdffilter /path/to/crafted_file.usd\n```\n\n\n### Impact\nOpenUSD, managed by the Alliance for OpenUSD (AOUSD), is widely adopted by major organizations such as Apple, NVIDIA, Autodesk, and Pixar. It serves as a key standard in industries like film, animation, gaming, AR/VR, and simulation. Exploitation of this vulnerability could lead to severe consequences, including system compromise, unauthorized data access, and disruption of services relying on OpenUSD. Given its critical role in 3D content creation and its widespread use, this vulnerability poses a significant threat to system security and data integrity. Immediate action is required to patch the issue and prevent potential security breaches.\n\n### Credit \n- Song Hyun Bae ( @bshyuunn )",
  "id": "GHSA-58p5-r2f6-g2cj",
  "modified": "2025-09-04T18:57:27Z",
  "published": "2025-09-04T18:57:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PixarAnimationStudios/OpenUSD/security/advisories/GHSA-58p5-r2f6-g2cj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PixarAnimationStudios/OpenUSD/commit/0d74f31fe64310791e274e587c9926335e9db9db"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PixarAnimationStudios/OpenUSD"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-8584"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-18T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.",
  "id": "GHSA-58q4-h5mm-8v85",
  "modified": "2022-05-24T17:04:16Z",
  "published": "2022-05-24T17:04:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8584"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210118"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210119"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210120"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210123"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210124"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210125"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210212"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-57926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-19T12:15:26Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Set private-\u003eall_drm_private[i]-\u003edrm to NULL if mtk_drm_bind returns err\n\nThe pointer need to be set to NULL, otherwise KASAN complains about\nuse-after-free. Because in mtk_drm_bind, all private\u0027s drm are set\nas follows.\n\nprivate-\u003eall_drm_private[i]-\u003edrm = drm;\n\nAnd drm will be released by drm_dev_put in case mtk_drm_kms_init returns\nfailure. However, the shutdown path still accesses the previous allocated\nmemory in drm_atomic_helper_shutdown.\n\n[   84.874820] watchdog: watchdog0: watchdog did not stop!\n[   86.512054] ==================================================================\n[   86.513162] BUG: KASAN: use-after-free in drm_atomic_helper_shutdown+0x33c/0x378\n[   86.514258] Read of size 8 at addr ffff0000d46fc068 by task shutdown/1\n[   86.515213]\n[   86.515455] CPU: 1 UID: 0 PID: 1 Comm: shutdown Not tainted 6.13.0-rc1-mtk+gfa1a78e5d24b-dirty #55\n[   86.516752] Hardware name: Unknown Product/Unknown Product, BIOS 2022.10 10/01/2022\n[   86.517960] Call trace:\n[   86.518333]  show_stack+0x20/0x38 (C)\n[   86.518891]  dump_stack_lvl+0x90/0xd0\n[   86.519443]  print_report+0xf8/0x5b0\n[   86.519985]  kasan_report+0xb4/0x100\n[   86.520526]  __asan_report_load8_noabort+0x20/0x30\n[   86.521240]  drm_atomic_helper_shutdown+0x33c/0x378\n[   86.521966]  mtk_drm_shutdown+0x54/0x80\n[   86.522546]  platform_shutdown+0x64/0x90\n[   86.523137]  device_shutdown+0x260/0x5b8\n[   86.523728]  kernel_restart+0x78/0xf0\n[   86.524282]  __do_sys_reboot+0x258/0x2f0\n[   86.524871]  __arm64_sys_reboot+0x90/0xd8\n[   86.525473]  invoke_syscall+0x74/0x268\n[   86.526041]  el0_svc_common.constprop.0+0xb0/0x240\n[   86.526751]  do_el0_svc+0x4c/0x70\n[   86.527251]  el0_svc+0x4c/0xc0\n[   86.527719]  el0t_64_sync_handler+0x144/0x168\n[   86.528367]  el0t_64_sync+0x198/0x1a0\n[   86.528920]\n[   86.529157] The buggy address belongs to the physical page:\n[   86.529972] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d46fd4d0 pfn:0x1146fc\n[   86.531319] flags: 0xbfffc0000000000(node=0|zone=2|lastcpupid=0xffff)\n[   86.532267] raw: 0bfffc0000000000 0000000000000000 dead000000000122 0000000000000000\n[   86.533390] raw: ffff0000d46fd4d0 0000000000000000 00000000ffffffff 0000000000000000\n[   86.534511] page dumped because: kasan: bad access detected\n[   86.535323]\n[   86.535559] Memory state around the buggy address:\n[   86.536265]  ffff0000d46fbf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.537314]  ffff0000d46fbf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.538363] \u003effff0000d46fc000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.544733]                                                           ^\n[   86.551057]  ffff0000d46fc080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.557510]  ffff0000d46fc100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n[   86.563928] ==================================================================\n[   86.571093] Disabling lock debugging due to kernel taint\n[   86.577642] Unable to handle kernel paging request at virtual address e0e9c0920000000b\n[   86.581834] KASAN: maybe wild-memory-access in range [0x0752049000000058-0x075204900000005f]\n...",
  "id": "GHSA-58rp-5478-74m7",
  "modified": "2025-01-31T15:30:44Z",
  "published": "2025-01-19T12:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57926"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/078b2ff7da200b7532398e668eef723ad40fb516"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36684e9d88a2e2401ae26715a2e217cb4295cea7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7083b93e9755d60f0c2bcaa9d064308108280534"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-30579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-03T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
  "id": "GHSA-58wq-824w-jq9w",
  "modified": "2022-05-24T19:09:43Z",
  "published": "2022-05-24T19:09:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30579"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1207277"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QW4R2K5HVJ4R6XDZYOJCCFPIN2XHNS3L"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-06T17:15:14Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-58wv-w3hc-2c76",
  "modified": "2024-11-06T18:31:11Z",
  "published": "2024-11-06T18:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10827"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/375065084"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-29977"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-13T17:15:58Z",
    "severity": "HIGH"
  },
  "details": "Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.",
  "id": "GHSA-5949-gw2m-qrqx",
  "modified": "2025-05-13T18:30:55Z",
  "published": "2025-05-13T18:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29977"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29977"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-7805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-11T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox \u003c 56, Firefox ESR \u003c 52.4, and Thunderbird \u003c 52.4.",
  "id": "GHSA-595h-pjc7-9xf6",
  "modified": "2024-10-21T15:32:20Z",
  "published": "2022-05-14T02:21:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7805"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2832"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1377618"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201803-14"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-3987"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-3998"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2017/dsa-4014"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2017-21"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2017-22"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2017-23"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/101059"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039465"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-22617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-08T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.",
  "id": "GHSA-595v-6p68-9v59",
  "modified": "2022-05-24T19:17:01Z",
  "published": "2022-05-24T19:17:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22617"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Ardour/ardour/commit/96daa4036a"
    },
    {
      "type": "WEB",
      "url": "https://tracker.ardour.org/view.php?id=7926"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-21753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-27T03:15:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when attempting to join an aborted transaction\n\nWhen we are trying to join the current transaction and if it\u0027s aborted,\nwe read its \u0027aborted\u0027 field after unlocking fs_info-\u003etrans_lock and\nwithout holding any extra reference count on it. This means that a\nconcurrent task that is aborting the transaction may free the transaction\nbefore we read its \u0027aborted\u0027 field, leading to a use-after-free.\n\nFix this by reading the \u0027aborted\u0027 field while holding fs_info-\u003etrans_lock\nsince any freeing task must first acquire that lock and set\nfs_info-\u003erunning_transaction to NULL before freeing the transaction.\n\nThis was reported by syzbot and Dmitry with the following stack traces\nfrom KASAN:\n\n   ==================================================================\n   BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278\n   Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128\n\n   CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n   Workqueue: events_unbound btrfs_async_reclaim_data_space\n   Call Trace:\n    \u003cTASK\u003e\n    __dump_stack lib/dump_stack.c:94 [inline]\n    dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n    print_address_description mm/kasan/report.c:378 [inline]\n    print_report+0x169/0x550 mm/kasan/report.c:489\n    kasan_report+0x143/0x180 mm/kasan/report.c:602\n    join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278\n    start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697\n    flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803\n    btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321\n    process_one_work kernel/workqueue.c:3236 [inline]\n    process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317\n    worker_thread+0x870/0xd30 kernel/workqueue.c:3398\n    kthread+0x2f0/0x390 kernel/kthread.c:389\n    ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n    \u003c/TASK\u003e\n\n   Allocated by task 5315:\n    kasan_save_stack mm/kasan/common.c:47 [inline]\n    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n    poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n    __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n    kasan_kmalloc include/linux/kasan.h:260 [inline]\n    __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n    kmalloc_noprof include/linux/slab.h:901 [inline]\n    join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308\n    start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697\n    btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572\n    lookup_open fs/namei.c:3649 [inline]\n    open_last_lookups fs/namei.c:3748 [inline]\n    path_openat+0x1c03/0x3590 fs/namei.c:3984\n    do_filp_open+0x27f/0x4e0 fs/namei.c:4014\n    do_sys_openat2+0x13e/0x1d0 fs/open.c:1402\n    do_sys_open fs/open.c:1417 [inline]\n    __do_sys_creat fs/open.c:1495 [inline]\n    __se_sys_creat fs/open.c:1489 [inline]\n    __x64_sys_creat+0x123/0x170 fs/open.c:1489\n    do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n    do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n   Freed by task 5336:\n    kasan_save_stack mm/kasan/common.c:47 [inline]\n    kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n    kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n    poison_slab_object mm/kasan/common.c:247 [inline]\n    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n    kasan_slab_free include/linux/kasan.h:233 [inline]\n    slab_free_hook mm/slub.c:2353 [inline]\n    slab_free mm/slub.c:4613 [inline]\n    kfree+0x196/0x430 mm/slub.c:4761\n    cleanup_transaction fs/btrfs/transaction.c:2063 [inline]\n    btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598\n    insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757\n    btrfs_balance+0x992/\n---truncated---",
  "id": "GHSA-595v-ghj9-chj5",
  "modified": "2026-05-12T15:30:47Z",
  "published": "2025-02-27T03:34:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21753"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6ba4663ada6c6315af23a6669d386146634808ec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7e954b6bb95d67ae4d1a20e9cfd83c182cf929bc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/86d71a026a7f63da905db9add845c8ee88801eca"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f5cff471039caa2b088060c074c2bf2081bcb01"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c7a53757717e68af94a56929d57f1e6daff220ec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ce628048390dad80320d5a1f74de6ca1e1be91e7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cee55b1219568c80bf0d5dc55066e4a859baf753"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e2f0943cf37305dbdeaf9846e3c941451bcdef63"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}