From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 18 Jul 2025 12:46:56 +0000 (+0200)
Subject: output: fix NULL deref if no app-layer is logged
X-Git-Tag: suricata-8.0.1~100
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c20dddb046fa91e6c0624a136214be6e53304a03;p=thirdparty%2Fsuricata.git

output: fix NULL deref if no app-layer is logged

Ticket: 7815
---

diff --git a/src/output-tx.c b/src/output-tx.c
index b5a1852fa2..2874b40f6e 100644
--- a/src/output-tx.c
+++ b/src/output-tx.c
@@ -627,6 +627,12 @@ static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data)
 
 static uint32_t OutputTxLoggerGetActiveCount(void)
 {
+    if (list == NULL) {
+        // This may happen in socket mode playing pcaps
+        // when suricata.yaml logs only alerts (and no app-layer events)
+        return 0;
+    }
+
     uint32_t cnt = 0;
     for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
         for (OutputTxLogger *p = list[alproto]; p != NULL; p = p->next) {