detect/tag: improve time handling on windows

Bug: #5584.

diff --git a/src/detect-engine-tag.c b/src/detect-engine-tag.c
index d445560f3914b9db73e6b3b5d2d12864d48a3d4e..61cada65474b7574c0a59d65c3377c5039e36a49 100644 (file)
--- a/src/detect-engine-tag.c
+++ b/src/detect-engine-tag.c
@@ -555,7 +555,9 @@ int TagTimeoutCheck(Host *host, struct timeval *tv)
 
     prev = NULL;
     while (tmp != NULL) {
-        if ((tv->tv_sec - tmp->last_ts) <= TAG_MAX_LAST_TIME_SEEN) {
+        struct timeval last_ts = { .tv_sec = tmp->last_ts, 0 };
+        struct timeval timeout_at = TimevalWithSeconds(&last_ts, TAG_MAX_LAST_TIME_SEEN);
+        if (!TimevalEarlier(&timeout_at, tv)) {
             prev = tmp;
             tmp = tmp->next;
             retval = 0;