Pre-existing on main, confirmed identical on #722's branch (not introduced or fixed there).
A: a binary field's value containing \n\n splits the entry mid-value.
b'MESSAGE\n' + pack('<Q',5) + b'a\n\nb\n' -> MESSAGE=b'a' plus a junk entry named b declaring a bogus length, 2 warnings. Same shape on both trees (byte counts differ by 1 on #722's branch, an artifact of its terminator-newline restore, not a new defect).
B: a binary field's own 8-octet length prefix can equal \n\n + 6 NULs, since:
>>> struct.pack('<Q', 2570)
b'\n\n\x00\x00\x00\x00\x00\x00'So a 2570-octet binary field splits mid-prefix and the entry parses zero fields. Identical on main and #722: data=[{}, {}], 1 warning.
Root cause: self.entry.split(b'\n\n') in SystemdJournalExportBlock.post_process (pcapkit/protocols/schema/misc/pcapng.py) can't tell a real entry separator from \n\n inside binary data.
Refs: #704, #722.
Pre-existing on
main, confirmed identical on #722's branch (not introduced or fixed there).A: a binary field's value containing
\n\nsplits the entry mid-value.b'MESSAGE\n' + pack('<Q',5) + b'a\n\nb\n'->MESSAGE=b'a'plus a junk entry namedbdeclaring a bogus length, 2 warnings. Same shape on both trees (byte counts differ by 1 on #722's branch, an artifact of its terminator-newline restore, not a new defect).B: a binary field's own 8-octet length prefix can equal
\n\n+ 6 NULs, since:So a 2570-octet binary field splits mid-prefix and the entry parses zero fields. Identical on
mainand #722:data=[{}, {}], 1 warning.Root cause:
self.entry.split(b'\n\n')inSystemdJournalExportBlock.post_process(pcapkit/protocols/schema/misc/pcapng.py) can't tell a real entry separator from\n\ninside binary data.Refs: #704, #722.