in_systemd: always reset cursor before iterating fields

Signed-off-by: Eduardo Silva <[email protected]>

Author: edsiper

plugins/in_systemd/systemd.c

@@ -384,6 +384,16 @@ static int in_systemd_collect(struct flb_input_instance *ins,
         /* Pack every field in the entry */
         entries = 0;
         skip_entries = 0;
+
+        /*
+         * Restart the journal data cursor before enumerating the fields for
+         * this entry.  Recent libsystemd releases require callers to reset
+         * the cursor between entries; otherwise the internal decompression
+         * context can be reused in an invalid state, which ultimately
+         * triggers a crash in ZSTD_freeDDict().
+         */
+        sd_journal_restart_data(ctx->j);
+
         while (sd_journal_enumerate_data(ctx->j, &data, &length) > 0 &&
                entries < ctx->max_fields) {
             key = (const char *) data;