From cddd3a261f413a38f3052872c75e712bc705011b Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 1 Apr 2025 15:44:50 -0600
Subject: [PATCH] pcap-log: only allow one instance of pcap-log

As a global is used to store state, only one instance can be used.

See https://redmine.openinfosecfoundation.org/issues/7640.
---
 src/log-pcap.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/log-pcap.c b/src/log-pcap.c
index 45c6e2aaf1..f426c27029 100644
--- a/src/log-pcap.c
+++ b/src/log-pcap.c
@@ -1343,6 +1343,10 @@ static OutputInitResult PcapLogInitCtx(SCConfNode *conf)
     int en;
     PCRE2_SIZE eo = 0;
 
+    if (g_pcap_data) {
+        FatalError("A pcap-log instance is already active, only one can be enabled.");
+    }
+
     PcapLogData *pl = SCCalloc(1, sizeof(PcapLogData));
     if (unlikely(pl == NULL)) {
         FatalError("Failed to allocate Memory for PcapLogData");