From c3e869b827bda5ca0d5adb50981fc8e668abb640 Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Wed, 10 Apr 2024 14:17:12 -0700
Subject: [PATCH] Don't attempt to stop or flush disabled writer frontends

---
 src/logging/WriterFrontend.cc | 22 ++++++++++++++++++++++
 src/logging/WriterFrontend.h  |  3 +++
 2 files changed, 25 insertions(+)

diff --git a/src/logging/WriterFrontend.cc b/src/logging/WriterFrontend.cc
index ecab930f7e..d1fae0d3f9 100644
--- a/src/logging/WriterFrontend.cc
+++ b/src/logging/WriterFrontend.cc
@@ -133,6 +133,11 @@ WriterFrontend::~WriterFrontend() {
 }
 
 void WriterFrontend::Stop() {
+    if ( disabled ) {
+        CleanupWriteBuffer();
+        return;
+    }
+
     FlushWriteBuffer();
     SetDisable();
 
@@ -204,6 +209,11 @@ void WriterFrontend::Write(int arg_num_fields, Value** vals) {
 }
 
 void WriterFrontend::FlushWriteBuffer() {
+    if ( disabled ) {
+        CleanupWriteBuffer();
+        return;
+    }
+
     if ( ! write_buffer_pos )
         // Nothing to do.
         return;
@@ -261,4 +271,16 @@ void WriterFrontend::DeleteVals(int num_fields, Value** vals) {
     delete[] vals;
 }
 
+void WriterFrontend::CleanupWriteBuffer() {
+    if ( ! write_buffer || write_buffer_pos == 0 )
+        return;
+
+    for ( int j = 0; j < write_buffer_pos; j++ )
+        DeleteVals(num_fields, write_buffer[j]);
+
+    delete[] write_buffer;
+    write_buffer = nullptr;
+    write_buffer_pos = 0;
+}
+
 } // namespace zeek::logging
diff --git a/src/logging/WriterFrontend.h b/src/logging/WriterFrontend.h
index fdfdffa127..dfd984b502 100644
--- a/src/logging/WriterFrontend.h
+++ b/src/logging/WriterFrontend.h
@@ -206,6 +206,9 @@ protected:
     static const int WRITER_BUFFER_SIZE = 1000;
     int write_buffer_pos;             // Position of next write in buffer.
     threading::Value*** write_buffer; // Buffer of size WRITER_BUFFER_SIZE.
+
+private:
+    void CleanupWriteBuffer();
 };
 
 } // namespace zeek::logging