detect/transform: limit json_decode to start of buffer

doc/userguide/rules/transforms.rst

@@ -201,6 +201,10 @@ As such, an escaped double quote in a string will not be replaced and will remai
 Invalid json such as an unescaped tabulation in a string will not be escaped.
 Single unpaired UTF-16 surrogate get unescaped.
 
+This transform only works if we have the buffer from its beginning
+because we need to know which state we are in to start the parsing.
+That means we can only json_decode the first 32KiB of one ``file.data``.
+
 xor
 ---
 

rust/src/detect/transforms/json.rs

@@ -301,6 +301,11 @@ unsafe extern "C" fn json_decode_transform(
     if input.is_null() || input_len == 0 {
         return;
     }
+    if (*buffer).inspect_offset > 0 {
+        // Only apply json_decode transform if we are at the beginning of the buffer.
+        // Otherwise, we do not know in which state to start
+        return;
+    }
     let input = build_slice!(input, input_len as usize);
 
     let output = SCInspectionBufferCheckAndExpand(buffer, input_len);