From d413763ec88dae1b620ab51ddc442913461ef6d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Wed, 15 Apr 2026 21:20:04 +0100
Subject: [PATCH] ofz#497427650 Integer-overflow

Change-Id: I1abc37d6cb9605a31618d01971b2f93b632eb3bc
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1999
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit c2993fe52a217fd1e828c313cc49dd2bd2d2c81c)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/205282
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
---
 starmath/source/node.cxx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/starmath/source/node.cxx b/starmath/source/node.cxx
index 0264d23c564c..7581f45a679d 100644
--- a/starmath/source/node.cxx
+++ b/starmath/source/node.cxx
@@ -21,6 +21,7 @@
 #include <symbol.hxx>
 #include <smmod.hxx>
 #include "tmpdevice.hxx"
+#include <algorithm>
 #include <utility>
 #include <visitors.hxx>
 #include <tools/UnitConversion.hxx>
@@ -140,6 +141,8 @@ void SmNode::SetFontSize(double fSize, FontSizeType nType)
     if (!(Flags() & FontChangeMask::Size))
     {
         double fVal(conversionFract(o3tl::Length::pt, SmO3tlLengthUnit()) * fSize);
+        const int nMaxVal = o3tl::convert(128, o3tl::Length::pt, SmO3tlLengthUnit());
+        fVal = std::clamp(fVal, static_cast<double>(-nMaxVal), static_cast<double>(nMaxVal));
         tools::Long      nHeight = static_cast<tools::Long>(fVal);
 
         aFntSize = GetFont().GetFontSize();
@@ -171,7 +174,6 @@ void SmNode::SetFontSize(double fSize, FontSizeType nType)
         }
 
         // check the requested size against maximum value
-        const int nMaxVal = o3tl::convert(128, o3tl::Length::pt, SmO3tlLengthUnit());
         if (aFntSize.Height() > nMaxVal)
             aFntSize.setHeight( nMaxVal );