fix(sys): Bounds-check event record readers

internal/etw/approvers/fs.go

@@ -85,7 +85,7 @@ type fs struct {
 }
 
 func hashFilePath(u []uint16) uint64 {
-	b := unsafe.Slice((*byte)(unsafe.Pointer(unsafe.SliceData(u))), len(u))
+	b := unsafe.Slice((*byte)(unsafe.Pointer(unsafe.SliceData(u))), len(u)*2)
 	return xxh3.Hash(b)
 }
 
@@ -178,7 +178,7 @@ func (f *fs) Approve(r *etw.EventRecord) (*etw.EventRecord, bool) {
 		h := hashFilePath(s)
 		path, ok := f.pathLRUCache.Get(h)
 		if !ok {
-			n := utf16.Decode(s[:len(s)/2-1])
+			n := utf16.Decode(s[:max(len(s)-1, 0)]) // drop the null terminator
 			path = devmapper.GetDevMapper().Convert(n)
 			f.pathLRUCache.Add(h, path)
 		}

internal/etw/approvers/registry.go

@@ -61,7 +61,7 @@ func newRegistryApprover(r *config.RulesCompileResult) Approver {
 func hashKeyPath(r string, u []uint16) uint64 {
 	var h xxh3.Hasher
 
-	b := unsafe.Slice((*byte)(unsafe.Pointer(unsafe.SliceData(u))), len(u))
+	b := unsafe.Slice((*byte)(unsafe.Pointer(unsafe.SliceData(u))), len(u)*2)
 	_, _ = h.Write(b)
 	if r != "" {
 		k := unsafe.Slice(unsafe.StringData(r), len(r))
@@ -109,7 +109,7 @@ func (r *registry) Approve(rec *etw.EventRecord) (*etw.EventRecord, bool) {
 		// KCB object address references a key
 		// we can use to reconstruct the full
 		// registry path
-		path = utf16.Decode(s[:len(s)/2-1])
+		path = utf16.Decode(s[:max(len(s)-1, 0)]) // drop the null terminator
 		if kcb != 0 {
 			path = key.ConcatPaths(r.kcbs[kcb], path)
 		}