The journal file reader loop in src/or/keypin.c only uses end of file or '\n' to find the end of a line, so if a line contains a NUL we may end up passing a string with one in the middle to other things: ``` 367 STATIC int 368 keypin_load_journal_impl(const char *data, size_t size, 369 keypin_journal_pruner_t *pruner) 370 { 371 const char *start = data, *end = data + size, *next; 372 373 int n_corrupt_lines = 0; 374 int n_entries = 0; 375 int n_duplicates = 0; 376 int n_conflicts = 0; 377 378 for (const char *cp = start; cp < end; cp = next) { 379 const char *eol = memchr(cp, '\n', end-cp); 380 const char *eos = eol ? eol : end; 381 const size_t len = eos - cp; ``` We should think about this more and make sure this is safe.