x-pack/auditbeat/tracing: fix invalid span in array punning (#28580)

Previously the copy for the raw case converted the unsafe pointer to a concrete
array of 2048 bytes due to an unnecessary pointer dereference. This invalidly
spans beyond the end of the struct allocation. This is identified either with a
build using the race detector or with -gcflags=all=-d=checkptr.
Rather than using unsafe punning use the unsafe.Slice function. Also clean up
some pointer arithmetic syntax.

CHANGELOG.next.asciidoc

@@ -37,6 +37,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix handling of long file names on Windows. {issue}25334[25334] {pull}28517[28517]
 - System/socket dataset: Fix uninstallation of return kprobes. {issue}28608[28608] {pull}28609[28609]
 - Replace usage of deprecated `process.ppid` field with `process.parent.pid`. {pull}28620[28620]
+- Fix auditbeat tracing struct decoding. {pull}28580[28580]
 
 *Filebeat*
 

x-pack/auditbeat/tracing/decoder.go

@@ -320,9 +320,8 @@ func (d *structDecoder) Decode(raw []byte, meta Metadata) (s interface{}, err er
 		}
 		switch dec.typ {
 		case FieldTypeInteger:
-			if err := copyInt(
-				unsafe.Pointer(uintptr(destPtr)+dec.dst),
-				unsafe.Pointer(&raw[dec.src]), uint8(dec.len)); err != nil {
+			err := copyInt(unsafe.Add(destPtr, dec.dst), unsafe.Pointer(&raw[dec.src]), uint8(dec.len))
+			if err != nil {
 				return nil, fmt.Errorf("bad size=%d for integer field=%s", dec.len, dec.name)
 			}
 
@@ -335,13 +334,13 @@ func (d *structDecoder) Decode(raw []byte, meta Metadata) (s interface{}, err er
 			if len > 0 && raw[offset+len-1] == 0 {
 				len--
 			}
-			*((*string)(unsafe.Pointer(uintptr(destPtr) + dec.dst))) = string(raw[offset : offset+len])
+			*(*string)(unsafe.Add(destPtr, dec.dst)) = string(raw[offset : offset+len])
 
 		case FieldTypeMeta:
-			*(*Metadata)(unsafe.Pointer(uintptr(destPtr) + dec.dst)) = meta
+			*(*Metadata)(unsafe.Add(destPtr, dec.dst)) = meta
 
 		case FieldTypeRaw:
-			copy((*(*[maxRawCopySize]byte)(unsafe.Pointer(uintptr(destPtr) + dec.dst)))[:dec.len], raw[dec.src:dec.src+dec.len])
+			copy(unsafe.Slice((*byte)(unsafe.Add(destPtr, dec.dst)), dec.len), raw[dec.src:])
 		}
 	}