detect/tag: improve time handling on windows

Bug: #5584.
(cherry picked from commit 0977f40d1cf6d5dad75c95f31614678225a77943)

diff --git a/src/detect-engine-tag.c b/src/detect-engine-tag.c
index f79548eb6112c4752a572e796dc3337872297245..505ff443fd236587453444b5869e729d9e86a30a 100644 (file)
--- a/src/detect-engine-tag.c
+++ b/src/detect-engine-tag.c
@@ -553,7 +553,9 @@ int TagTimeoutCheck(Host *host, struct timeval *tv)
 
     prev = NULL;
     while (tmp != NULL) {
-        if ((tv->tv_sec - tmp->last_ts) <= TAG_MAX_LAST_TIME_SEEN) {
+        struct timeval last_ts = { .tv_sec = tmp->last_ts, 0 };
+        struct timeval timeout_at = TimevalWithSeconds(&last_ts, TAG_MAX_LAST_TIME_SEEN);
+        if (!TimevalEarlier(&timeout_at, tv)) {
             prev = tmp;
             tmp = tmp->next;
             retval = 0;