x-pack/auditbeat/tracing: fix invalid span in array punning (#28580) (#…

…28897) Previously the copy for the raw case converted the unsafe pointer to a concrete array of 2048 bytes due to an unnecessary pointer dereference. This invalidly spans beyond the end of the struct allocation. This is identified either with a build using the race detector or with -gcflags=all=-d=checkptr. Rather than using unsafe punning use the unsafe.Slice function. Also clean up some pointer arithmetic syntax. (cherry picked from commit 699fcdd) Co-authored-by: Dan Kortschak <[email protected]>
elastic · Nov 9, 2021 · a048c82 · a048c82
1 parent 432e793
commit a048c82
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -25,6 +25,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Auditd dataset: Removes the authentication_success and authentication_failure event.type values for user logins. {issue}19039[19039] {pull}28378[28378]
 - Fix handling of long file names on Windows. {issue}25334[25334] {pull}28517[28517]
 - System/socket dataset: Fix uninstallation of return kprobes. {issue}28608[28608] {pull}28609[28609]
+- Replace usage of deprecated `process.ppid` field with `process.parent.pid`. {pull}28620[28620]
+- Fix auditbeat tracing struct decoding. {pull}28580[28580]
 
 *Filebeat*
 

diff --git a/x-pack/auditbeat/tracing/decoder.go b/x-pack/auditbeat/tracing/decoder.go
@@ -320,9 +320,8 @@ func (d *structDecoder) Decode(raw []byte, meta Metadata) (s interface{}, err er
 		}
 		switch dec.typ {
 		case FieldTypeInteger:
-			if err := copyInt(
-				unsafe.Pointer(uintptr(destPtr)+dec.dst),
-				unsafe.Pointer(&raw[dec.src]), uint8(dec.len)); err != nil {
+			err := copyInt(unsafe.Add(destPtr, dec.dst), unsafe.Pointer(&raw[dec.src]), uint8(dec.len))
+			if err != nil {
 				return nil, fmt.Errorf("bad size=%d for integer field=%s", dec.len, dec.name)
 			}
 
@@ -335,13 +334,13 @@ func (d *structDecoder) Decode(raw []byte, meta Metadata) (s interface{}, err er
 			if len > 0 && raw[offset+len-1] == 0 {
 				len--
 			}
-			*((*string)(unsafe.Pointer(uintptr(destPtr) + dec.dst))) = string(raw[offset : offset+len])
+			*(*string)(unsafe.Add(destPtr, dec.dst)) = string(raw[offset : offset+len])
 
 		case FieldTypeMeta:
-			*(*Metadata)(unsafe.Pointer(uintptr(destPtr) + dec.dst)) = meta
+			*(*Metadata)(unsafe.Add(destPtr, dec.dst)) = meta
 
 		case FieldTypeRaw:
-			copy((*(*[maxRawCopySize]byte)(unsafe.Pointer(uintptr(destPtr) + dec.dst)))[:dec.len], raw[dec.src:dec.src+dec.len])
+			copy(unsafe.Slice((*byte)(unsafe.Add(destPtr, dec.dst)), dec.len), raw[dec.src:])
 		}
 	}