sync with upstream, fix read-past-end errors

important for a happy mod-security.

should just merge in.  Only libinjection changes, no modsecurity changes.

thanks!