pcrexform: use substring and not whole match

diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
index 5f64b40efb9804bb593961ea1c630ec21197142d..992b0527b0459a2654afc8dcd68253b10d34d5cd 100644 (file)
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@@ -135,7 +135,7 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options)
     if (ret > 0) {
         const char *str;
         PCRE2_SIZE caplen;
-        ret = pcre2_substring_get_bynumber(match, 0, (PCRE2_UCHAR8 **)&str, &caplen);
+        ret = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&str, &caplen);
 
         if (ret >= 0) {
             InspectionBufferCopy(buffer, (uint8_t *)str, (uint32_t)caplen);