You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(pcapng): Journal Export entries with an unterminated binary field or a bare key do not rebuild byte-exactly #1413
Describe the bug #1406's strict ruling covers a Journal Export binary field whose declared length overruns the entry, and #1412 fixes that case. Two neighbouring malformations still don't round-trip:
a binary field whose length equals the available octets but has no closing \n;
a bare KEY with no = and no newline.
To Reproduce
Run PCAPNG.from_data(PCAPNG(raw).info).data on #1412's head 0514d5c30. main behaves the same.
BIN\n + <len=4> + abc\n, with no final terminator: 28 octets in, 32 out (a terminator is appended).
A block holding only KEY: 16 octets in, 12 out (the entry is dropped).
Expected behavior
Per #1406's ruling, keep the whole entry raw and rebuild it verbatim.
Found by the #1412 cross-review, and I reproduced both. Blocked until#1412 merges.
Activity
JarryShaw commentedon Oct 8, 2026
Unblocked: #1412 merged (
ec2ba13a4). A worker is on it now.fix(pcapng)!: keep malformed journal entries and short packet blocks …
fix(pcapng)!: keep malformed journal entries and short packet blocks …