Systemd input plugin (v3.2.3+) produce unwanted message output

[Lanxor]

Bug Report

Describe the bug
The input systemd plugin returns unexpected data when the value of MESSAGE is between 503 and 535 characters (in my tests, but this may vary).

To Reproduce

• Steps to reproduce the problem:

Tests with messages between 504 and 534 characters produce inconsistent outputs in Fluent Bit, while journalctl displays the values correctly.

echo -n 'abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvw' | logger -t test-fluent

Result in journalctl (504 characters as expected):

journalctl -f
Jan 02 20:12:49 lraapps01 test-fluent[101309]: abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvw

Result in Fluent Bit (535 characters):

/opt/fluent-bit/bin/fluent-bit -i systemd -p systemd_filter=SYSLOG_IDENTIFIER=test-fluent -F modify -p 'Remove_wildcard=_' -p 'Remove=SYSLOG_TIMESTAMP' -m '*' -o stdout
...
[0] systemd.0: [[1735845112.829860000, {}], {"PRIORITY"=>"5", "SYSLOG_FACILITY"=>"1", "SYSLOG_IDENTIFIER"=>"test-fluent", "MESSAGE"=>"abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnopqrstuvwxyz01234567890abcdefghijklmnoxy"}]

Expected behavior
The plugin should pass data from systemd identically without altering it.

Screenshots

Your Environment

• Version used: Tested with Fluent Bit v3.2.4 and v3.2.3
• Configuration: None in particular
• Environment name and version (e.g., Kubernetes? What version?):
• Server type and version:
• Operating System and version: Debian 12
• Filters and plugins: systemd input

Additional context
The issue is not present in Fluent Bit versions v3.2.2 and earlier.

[bpetermannS11]

This could be a result of the buffer over-read I reported in #9788

[bpetermannS11]

My patch #9789 might fix it

[cosmo0920]

This issue was fixed in #9789?
I confirmed that the altering issue is already fixed in the current master.

[Lanxor]

Hello, yes thanks you @bpetermannS11 for PR.