Skip to content

pcapng: journal entry split on b'\n\n' shreds binary data that contains it #723

Description

@JarryShaw

Pre-existing on main, confirmed identical on #722's branch (not introduced or fixed there).

A: a binary field's value containing \n\n splits the entry mid-value.
b'MESSAGE\n' + pack('<Q',5) + b'a\n\nb\n' -> MESSAGE=b'a' plus a junk entry named b declaring a bogus length, 2 warnings. Same shape on both trees (byte counts differ by 1 on #722's branch, an artifact of its terminator-newline restore, not a new defect).

B: a binary field's own 8-octet length prefix can equal \n\n + 6 NULs, since:

>>> struct.pack('<Q', 2570)
b'\n\n\x00\x00\x00\x00\x00\x00'

So a 2570-octet binary field splits mid-prefix and the entry parses zero fields. Identical on main and #722: data=[{}, {}], 1 warning.

Root cause: self.entry.split(b'\n\n') in SystemdJournalExportBlock.post_process (pcapkit/protocols/schema/misc/pcapng.py) can't tell a real entry separator from \n\n inside binary data.

Refs: #704, #722.

Activity

  1. added
    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)
    on Sep 23, 2026
  2. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Sep 24, 2026
  3. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Sep 24, 2026
  4. added this to the 1.5 milestone on Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssues reporting a defect (set by the bug report template; a default, not an assessment)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions