First time we use this func, I'm a bit worried it may be part of newer pcre only. Using pcre_copy_substring like in the rest of the code is preferred. E.g. https://github.com/inliniac/suricata/blob/master/src/detect-classtype.c#L111