Using pcre_copy_substring is preferred, as it makes no memory allocation. See https://redmine.openinfosecfoundation.org/issues/1046