Skip to content

fix(pcapng): Journal Export entries with an unterminated binary field or a bare key do not rebuild byte-exactly #1413

Closed

Description

@JarryShaw

Describe the bug
#1406's strict ruling covers a Journal Export binary field whose declared length overruns the entry, and #1412 fixes that case. Two neighbouring malformations still don't round-trip:

  • a binary field whose length equals the available octets but has no closing \n;
  • a bare KEY with no = and no newline.

To Reproduce
Run PCAPNG.from_data(PCAPNG(raw).info).data on #1412's head 0514d5c30. main behaves the same.

  • BIN\n + <len=4> + abc\n, with no final terminator: 28 octets in, 32 out (a terminator is appended).
  • A block holding only KEY: 16 octets in, 12 out (the entry is dropped).

Expected behavior
Per #1406's ruling, keep the whole entry raw and rebuild it verbatim.

Found by the #1412 cross-review, and I reproduced both. Blocked until #1412 merges.

Activity

  1. added
    fixPull requests that fix a defect (fix: subject prefix)
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 8, 2026
  2. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    blockedDeferred pending another issue or decision; see the last comment for what unblocks it
    on Oct 8, 2026
  3. JarryShaw commented on Oct 8, 2026

    @JarryShaw
    OwnerAuthor

    Unblocked: #1412 merged (ec2ba13a4). A worker is on it now.

  4. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    fixPull requests that fix a defect (fix: subject prefix)

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions