From 416575ea026cdf099ff556b41cc1037783e838b3 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 21 Oct 2021 15:28:17 +0200 Subject: [PATCH] pcrexform: use substring and not whole match --- src/detect-transform-pcrexform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c index 5f64b40efb..992b0527b0 100644 --- a/src/detect-transform-pcrexform.c +++ b/src/detect-transform-pcrexform.c @@ -135,7 +135,7 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options) if (ret > 0) { const char *str; PCRE2_SIZE caplen; - ret = pcre2_substring_get_bynumber(match, 0, (PCRE2_UCHAR8 **)&str, &caplen); + ret = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&str, &caplen); if (ret >= 0) { InspectionBufferCopy(buffer, (uint8_t *)str, (uint32_t)caplen); -- 2.47.2