From 50c35345ed941209331aaa2fe785df53053609c1 Mon Sep 17 00:00:00 2001
From: Eduardo Arias <eduar_hte@hotmail.com>
Date: Tue, 23 Apr 2024 17:10:47 -0300
Subject: [PATCH] Fixed use after free in ModSecurity::processContentOffset -
 Use after free issue detected with Address Sanitizer while running   the
 reading_logs_with_offset example. - Keeps reference to last element in vars
 vector with vars.back(). Then   it removes the element from vars calling
 vars.pop_back() which   invalidates the reference, but it's accessed later in
 the function.

---
 src/modsecurity.cc | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/src/modsecurity.cc b/src/modsecurity.cc
index 4b48b799..7319bb96 100644
--- a/src/modsecurity.cc
+++ b/src/modsecurity.cc
@@ -258,14 +258,11 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
             strlen("highlight"));
 
         yajl_gen_array_open(g);
-    while (vars.size() > 3) {
-        std::string value;
+    for(auto [it, pending] = std::tuple{vars.rbegin(), vars.size()}; pending > 3; pending -= 3) {
         yajl_gen_map_open(g);
-        vars.pop_back();
-        const std::string &startingAt = vars.back().str();
-        vars.pop_back();
-        const std::string &size = vars.back().str();
-        vars.pop_back();
+        it++;
+        const std::string &startingAt = it->str(); it++;
+        const std::string &size = it->str(); it++;
         yajl_gen_string(g,
             reinterpret_cast<const unsigned char*>("startingAt"),
             strlen("startingAt"));
@@ -284,7 +281,7 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
             return -1;
         }
 
-        value = std::string(content, stoi(startingAt), stoi(size));
+        const auto value = std::string(content, stoi(startingAt), stoi(size));
         if (varValue.size() > 0) {
             varValue.append(" " + value);
         } else {
@@ -340,16 +337,13 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
 
     yajl_gen_map_open(g);
 
-    while (ops.size() > 3) {
-        std::string value;
+    for(auto [it, pending] = std::tuple{ops.rbegin(), ops.size()}; pending > 3; pending -= 3) {
         yajl_gen_string(g, reinterpret_cast<const unsigned char*>("highlight"),
             strlen("highlight"));
         yajl_gen_map_open(g);
-        ops.pop_back();
-        std::string startingAt = ops.back().str();
-        ops.pop_back();
-        std::string size = ops.back().str();
-        ops.pop_back();
+        it++;
+        const std::string &startingAt = it->str(); it++;
+        const std::string &size = ops.back().str(); it++;
         yajl_gen_string(g,
             reinterpret_cast<const unsigned char*>("startingAt"),
             strlen("startingAt"));
@@ -371,7 +365,7 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
             reinterpret_cast<const unsigned char*>("value"),
             strlen("value"));
 
-        value = std::string(varValue, stoi(startingAt), stoi(size));
+        const auto value = std::string(varValue, stoi(startingAt), stoi(size));
 
         yajl_gen_string(g,
             reinterpret_cast<const unsigned char*>(value.c_str()),