2 files changed, 18 insertions, 11 deletions
diff --git a/internal/notify/config.go b/internal/notify/config.go
index 2b6ba5e..fcba5a8 100644
--- a/internal/notify/config.go
+++ b/internal/notify/config.go
@@ -74,18 +74,25 @@ func LoadConfig(path string) Config {
 	}
 	c.LiveCap = clamp(c.LiveCap, 1, 100)
 	c.HistoryCap = clamp(c.HistoryCap, 1, 100)
-	if c.Timeouts.Low < 0 {
-		c.Timeouts.Low = def.Timeouts.Low
-	}
-	if c.Timeouts.Normal < 0 {
-		c.Timeouts.Normal = def.Timeouts.Normal
-	}
-	if c.Timeouts.Critical < 0 {
-		c.Timeouts.Critical = def.Timeouts.Critical
-	}
+	c.Timeouts.Low = seconds(c.Timeouts.Low, def.Timeouts.Low)
+	c.Timeouts.Normal = seconds(c.Timeouts.Normal, def.Timeouts.Normal)
+	c.Timeouts.Critical = seconds(c.Timeouts.Critical, def.Timeouts.Critical)
 	return c
 }
 
+// maxTimeout is a day. Beyond it nothing is meaningfully a timeout, and a
+// value near 1e10 seconds would overflow time.Duration and wrap to an
+// immediate or negative expiry.
+const maxTimeout = 86400
+
+// seconds keeps a timeout in 0..maxTimeout, else the default.
+func seconds(v, def int) int {
+	if v < 0 || v > maxTimeout {
+		return def
+	}
+	return v
+}
+
 func clamp(v, lo, hi int) int {
 	return min(max(v, lo), hi)
 }
diff --git a/internal/notify/config_test.go b/internal/notify/config_test.go
index 46032ee..818e88f 100644
--- a/internal/notify/config_test.go
+++ b/internal/notify/config_test.go
@@ -58,8 +58,8 @@ func TestLoadConfigWrongTypeKeepsThatDefault(t *testing.T) {
 }
 
 func TestLoadConfigClamps(t *testing.T) {
-	got := LoadConfig(writeConfig(t, `{"liveCap": 0, "historyCap": 1000, "timeouts": {"normal": -4}}`))
-	if got.LiveCap != 1 || got.HistoryCap != 100 || got.Timeouts.Normal != 10 {
+	got := LoadConfig(writeConfig(t, `{"liveCap": 0, "historyCap": 1000, "timeouts": {"normal": -4, "low": 99999999999}}`))
+	if got.LiveCap != 1 || got.HistoryCap != 100 || got.Timeouts.Normal != 10 || got.Timeouts.Low != 10 {
 		t.Errorf("got %+v", got)
 	}
 }