From c20dddb046fa91e6c0624a136214be6e53304a03 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 18 Jul 2025 14:46:56 +0200
Subject: [PATCH] output: fix NULL deref if no app-layer is logged

Ticket: 7815
---
 src/output-tx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/output-tx.c b/src/output-tx.c
index b5a1852fa2..2874b40f6e 100644
--- a/src/output-tx.c
+++ b/src/output-tx.c
@@ -627,6 +627,12 @@ static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data)
 
 static uint32_t OutputTxLoggerGetActiveCount(void)
 {
+    if (list == NULL) {
+        // This may happen in socket mode playing pcaps
+        // when suricata.yaml logs only alerts (and no app-layer events)
+        return 0;
+    }
+
     uint32_t cnt = 0;
     for (AppProto alproto = 0; alproto < g_alproto_max; alproto++) {
         for (OutputTxLogger *p = list[alproto]; p != NULL; p = p->next) {