pcrexform: use substring and not whole match

4 years ago · 416575ea02
parent c9d664b0a0
commit 416575ea02
1 changed files with 1 additions and 1 deletions
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@ -135,7 +135,7 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options)
    if (ret > 0) {
        const char *str;
        PCRE2_SIZE caplen;
-        ret = pcre2_substring_get_bynumber(match, 0, (PCRE2_UCHAR8 **)&str, &caplen);
+        ret = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&str, &caplen);

        if (ret >= 0) {
            InspectionBufferCopy(buffer, (uint8_t *)str, (uint32_t)caplen);