output: fix NULL deref if no app-layer is logged

Ticket: 7815

diff --git a/src/output-tx.c b/src/output-tx.c
index b5a1852fa2f6db1d4fdb2cbdec0e953478e00fb4..2874b40f6ef28dcbcb55c4d1d5d8aae9c4e02317 100644 (file)
--- a/src/output-tx.c
+++ b/src/output-tx.c
@@ -627,6 +627,12 @@ static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data)
 
 static uint32_t OutputTxLoggerGetActiveCount(void)
 {
+    if (list == NULL) {
+        // This may happen in socket mode playing pcaps
+        // when suricata.yaml logs only alerts (and no app-layer events)
+        return 0;
+    }
+
     uint32_t cnt = 0;
     for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
         for (OutputTxLogger *p = list[alproto]; p != NULL; p = p->next) {