Suricata

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index dbc18c2980..8bf548c81f 100644
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -478,6 +478,9 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
                 SCReturnInt(-1);
             }

+            if (prev_offset == 0) {
+                SCReturnInt(-1);
+            }
             det_ctx->buffer_offset = prev_buffer_offset;
             det_ctx->pcre_match_start_offset = prev_offset;
         } while (1);

Fix without understanding the sig

jq '.. | objects | select(.pcre and .pcre.relative_next and .pcre.negated)' rules.json on engine-analysis output tells if a rule is vulnerable