From fa34e2fafc5df9c7153676c5df6d8263094c12cb Mon Sep 17 00:00:00 2001
From: Thomas <31802793+ThomasNotTom@users.noreply.github.com>
Date: Wed, 4 Feb 2026 09:38:25 +0000
Subject: [PATCH] Fix: Correctly parse xxd odd byte hexdumps (#2058)

Co-authored-by: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com>
---
 src/core/operations/FromHexdump.mjs |  2 +-
 tests/operations/tests/Hexdump.mjs  | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/core/operations/FromHexdump.mjs b/src/core/operations/FromHexdump.mjs
index e8c25441f..6fd3c1dc7 100644
--- a/src/core/operations/FromHexdump.mjs
+++ b/src/core/operations/FromHexdump.mjs
@@ -43,7 +43,7 @@ class FromHexdump extends Operation {
      */
     run(input, args) {
         const output = [],
-            regex = /^\s*(?:[\dA-F]{4,16}h?:?)?[ \t]+((?:[\dA-F]{2} ){1,8}(?:[ \t]|[\dA-F]{2}-)(?:[\dA-F]{2} ){1,8}|(?:[\dA-F]{4} )*[\dA-F]{4}|(?:[\dA-F]{2} )*[\dA-F]{2})/igm;
+            regex = /^\s*(?:[\dA-F]{4,16}h?:?)?[ \t]+((?:[\dA-F]{2} ){1,8}(?:[ \t]|[\dA-F]{2}-)(?:[\dA-F]{2} ){1,8}|(?:[\dA-F]{4} )+(?:[\dA-F]{2})?|(?:[\dA-F]{2} )*[\dA-F]{2})/igm;
         let block, line;
 
         while ((block = regex.exec(input))) {
diff --git a/tests/operations/tests/Hexdump.mjs b/tests/operations/tests/Hexdump.mjs
index 90523a08e..6eb486db2 100644
--- a/tests/operations/tests/Hexdump.mjs
+++ b/tests/operations/tests/Hexdump.mjs
@@ -152,6 +152,17 @@ TestRegister.addTests([
             }
         ],
     },
+    {
+        name: "From Hexdump: xxd format, odd number of bytes",
+        input: "00000000: 6162 6364 65                             abcde",
+        expectedOutput: "abcde",
+        recipeConfig: [
+            {
+                op: "From Hexdump",
+                args: []
+            }
+        ],
+    },
     {
         name: "From Hexdump: Wireshark",
         input: `00000000  00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f ........ ........