Fixed use after free in ModSecurity::processContentOffset

- Use after free issue detected with Address Sanitizer while running
  the reading_logs_with_offset example.
- Keeps reference to last element in vars vector with vars.back(). Then
  it removes the element from vars calling vars.pop_back() which
  invalidates the reference, but it's accessed later in the function.

Author: eduar-hte

src/modsecurity.cc

@@ -258,14 +258,11 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
             strlen("highlight"));
 
         yajl_gen_array_open(g);
-    while (vars.size() > 3) {
-        std::string value;
+    for(auto [it, pending] = std::tuple{vars.rbegin(), vars.size()}; pending > 3; pending -= 3) {
         yajl_gen_map_open(g);
-        vars.pop_back();
-        const std::string &startingAt = vars.back().str();
-        vars.pop_back();
-        const std::string &size = vars.back().str();
-        vars.pop_back();
+        it++;
+        const std::string &startingAt = it->str(); it++;
+        const std::string &size = it->str(); it++;
         yajl_gen_string(g,
             reinterpret_cast<const unsigned char*>("startingAt"),
             strlen("startingAt"));
@@ -284,7 +281,7 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
             return -1;
         }
 
-        value = std::string(content, stoi(startingAt), stoi(size));
+        const auto value = std::string(content, stoi(startingAt), stoi(size));
         if (varValue.size() > 0) {
             varValue.append(" " + value);
         } else {
@@ -340,16 +337,13 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
 
     yajl_gen_map_open(g);
 
-    while (ops.size() > 3) {
-        std::string value;
+    for(auto [it, pending] = std::tuple{ops.rbegin(), ops.size()}; pending > 3; pending -= 3) {
         yajl_gen_string(g, reinterpret_cast<const unsigned char*>("highlight"),
             strlen("highlight"));
         yajl_gen_map_open(g);
-        ops.pop_back();
-        std::string startingAt = ops.back().str();
-        ops.pop_back();
-        std::string size = ops.back().str();
-        ops.pop_back();
+        it++;
+        const std::string &startingAt = it->str(); it++;
+        const std::string &size = ops.back().str(); it++;
         yajl_gen_string(g,
             reinterpret_cast<const unsigned char*>("startingAt"),
             strlen("startingAt"));
@@ -371,7 +365,7 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
             reinterpret_cast<const unsigned char*>("value"),
             strlen("value"));
 
-        value = std::string(varValue, stoi(startingAt), stoi(size));
+        const auto value = std::string(varValue, stoi(startingAt), stoi(size));
 
         yajl_gen_string(g,
             reinterpret_cast<const unsigned char*>(value.c_str()),