From 699fcdd1fba3b8adb8e70d4e743cb7238b273ef4 Mon Sep 17 00:00:00 2001 From: Dan Kortschak <90160302+efd6@users.noreply.github.com> Date: Wed, 10 Nov 2021 08:01:00 +1030 Subject: [PATCH] x-pack/auditbeat/tracing: fix invalid span in array punning (#28580) Previously the copy for the raw case converted the unsafe pointer to a concrete array of 2048 bytes due to an unnecessary pointer dereference. This invalidly spans beyond the end of the struct allocation. This is identified either with a build using the race detector or with -gcflags=all=-d=checkptr. Rather than using unsafe punning use the unsafe.Slice function. Also clean up some pointer arithmetic syntax. --- CHANGELOG.next.asciidoc | 1 + x-pack/auditbeat/tracing/decoder.go | 11 +++++------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 27d60319b14..6ac8ac639f7 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -37,6 +37,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix handling of long file names on Windows. {issue}25334[25334] {pull}28517[28517] - System/socket dataset: Fix uninstallation of return kprobes. {issue}28608[28608] {pull}28609[28609] - Replace usage of deprecated `process.ppid` field with `process.parent.pid`. {pull}28620[28620] +- Fix auditbeat tracing struct decoding. {pull}28580[28580] *Filebeat* diff --git a/x-pack/auditbeat/tracing/decoder.go b/x-pack/auditbeat/tracing/decoder.go index 88797351e1e..f087a4f5225 100644 --- a/x-pack/auditbeat/tracing/decoder.go +++ b/x-pack/auditbeat/tracing/decoder.go @@ -320,9 +320,8 @@ func (d *structDecoder) Decode(raw []byte, meta Metadata) (s interface{}, err er } switch dec.typ { case FieldTypeInteger: - if err := copyInt( - unsafe.Pointer(uintptr(destPtr)+dec.dst), - unsafe.Pointer(&raw[dec.src]), uint8(dec.len)); err != nil { + err := copyInt(unsafe.Add(destPtr, dec.dst), unsafe.Pointer(&raw[dec.src]), uint8(dec.len)) + if err != nil { return nil, fmt.Errorf("bad size=%d for integer field=%s", dec.len, dec.name) } @@ -335,13 +334,13 @@ func (d *structDecoder) Decode(raw []byte, meta Metadata) (s interface{}, err er if len > 0 && raw[offset+len-1] == 0 { len-- } - *((*string)(unsafe.Pointer(uintptr(destPtr) + dec.dst))) = string(raw[offset : offset+len]) + *(*string)(unsafe.Add(destPtr, dec.dst)) = string(raw[offset : offset+len]) case FieldTypeMeta: - *(*Metadata)(unsafe.Pointer(uintptr(destPtr) + dec.dst)) = meta + *(*Metadata)(unsafe.Add(destPtr, dec.dst)) = meta case FieldTypeRaw: - copy((*(*[maxRawCopySize]byte)(unsafe.Pointer(uintptr(destPtr) + dec.dst)))[:dec.len], raw[dec.src:dec.src+dec.len]) + copy(unsafe.Slice((*byte)(unsafe.Add(destPtr, dec.dst)), dec.len), raw[dec.src:]) } }