From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 21 Oct 2021 13:28:17 +0000 (+0200)
Subject: pcrexform: use substring and not whole match
X-Git-Tag: suricata-7.0.0-beta1~1286
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F6518%2Fhead;p=thirdparty%2Fsuricata.git

pcrexform: use substring and not whole match
---

diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
index 5f64b40efb..992b0527b0 100644
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@@ -135,7 +135,7 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options)
     if (ret > 0) {
         const char *str;
         PCRE2_SIZE caplen;
-        ret = pcre2_substring_get_bynumber(match, 0, (PCRE2_UCHAR8 **)&str, &caplen);
+        ret = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&str, &caplen);
 
         if (ret >= 0) {
             InspectionBufferCopy(buffer, (uint8_t *)str, (uint32_t)caplen);