From 808890363f820733360a29f3ea6d234f26a0b1ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Wed, 15 Apr 2026 21:17:09 +0100
Subject: [PATCH] ofz#496348501 Integer-overflow

Change-Id: I99c479ab6a1b3e2ef8bde1b7e65b31cee2c2ea45
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/1054
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 44b71efd0519aa061ef78db8d5dc0b0ae0b765b4)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204402
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
---
 vcl/source/gdi/metaact.cxx    | 4 ++++
 vcl/source/gdi/regionband.cxx | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index 1345f25a8e0a..f7ae96f796a9 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -1359,7 +1359,11 @@ MetaClipRegionAction::MetaClipRegionAction( vcl::Region aRegion, bool bClip ) :
 void MetaClipRegionAction::Execute( OutputDevice* pOut )
 {
     if( mbClip )
+    {
+        if (!AllowRect(pOut->LogicToPixel(maRegion.GetBoundRect())))
+            return;
         pOut->SetClipRegion( maRegion );
+    }
     else
         pOut->SetClipRegion();
 }
diff --git a/vcl/source/gdi/regionband.cxx b/vcl/source/gdi/regionband.cxx
index 95802a0d6c63..3016e9b0baeb 100644
--- a/vcl/source/gdi/regionband.cxx
+++ b/vcl/source/gdi/regionband.cxx
@@ -20,6 +20,7 @@
 #include <sal/config.h>
 
 #include <cstdlib>
+#include <limits>
 
 #include <tools/stream.hxx>
 #include <regionband.hxx>
@@ -727,7 +728,8 @@ void RegionBand::InsertBands(tools::Long nTop, tools::Long nBottom)
     }
 
     // find/insert bands for the boundaries of the rectangle
-    bool bTopBoundaryInserted = false;
+    // (no row possible before LONG_MIN)
+    bool bTopBoundaryInserted = nTop == std::numeric_limits<tools::Long>::min();
     bool bTop2BoundaryInserted = false;
     bool bBottomBoundaryInserted = false;