Auditbeat can crash when recursively watching directories in Windows

[jsoriano]

It seems to be exactly the same case reported in the underlying fsnotify library used: fsnotify/fsnotify#318

For confirmed bugs, please report:

• Version: 7.10.1 (probably more versions affected)
• Operating System: Windows
• Steps to Reproduce: Recursively watch long paths with the file_integrity module.

Failures like these ones happen:

panic: runtime error: slice bounds out of range [:262] with length 260

goroutine 101 [running, locked to thread]:
github.com/fsnotify/fsnotify.(*Watcher).readEvents(0xc00037e500)
	/go/pkg/mod/github.com/adriansr/fsnotify@v0.0.0-20180417234312-c9bbe1f46f1d/windows.go:465 +0xf8a
created by github.com/fsnotify/fsnotify.NewWatcher
	/go/pkg/mod/github.com/adriansr/fsnotify@v0.0.0-20180417234312-c9bbe1f46f1d/windows.go:48 +0x1f8

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[efd6]

Given the docs here it may be reasonable to replace the offending line in fsnotify

buf := (*[syscall.MAX_PATH]uint16)(unsafe.Pointer(&raw.FileName))

with

// Windows long file names may be up to 32k long.
buf := (*[0x7fff]uint16)(unsafe.Pointer(&raw.FileName))

Actually. Now that unsafe.Slice exists and beats is on go1.17, that would be perfect.