Fix T68951: Incrementing int property causes overflow

This was probably introduced in rBfdef1a6712b.

1 files changed, 10 insertions, 6 deletions

diff --git a/source/blender/editors/interface/interface_handlers.c b/source/blender/editors/interface/interface_handlers.c
index 19eb9699fc8..04b91b12027 100644
--- a/source/blender/editors/interface/interface_handlers.c
+++ b/source/blender/editors/interface/interface_handlers.c
@@ -4800,18 +4800,19 @@ static int ui_do_but_NUM(
   if (click) {
     /* we can click on the side arrows to increment/decrement,
      * or click inside to edit the value directly */
-    const float softmin = but->softmin;
-    const float softmax = but->softmax;
 
     if (!ui_but_is_float(but)) {
       /* Integer Value. */
       if (but->drawflag & (UI_BUT_ACTIVE_LEFT | UI_BUT_ACTIVE_RIGHT)) {
         button_activate_state(C, but, BUTTON_STATE_NUM_EDITING);
+
         const int value_step = (int)but->a1;
         BLI_assert(value_step > 0);
+        const int softmin = round_fl_to_int_clamp(but->softmin);
+        const int softmax = round_fl_to_int_clamp(but->softmax);
         const double value_test = (but->drawflag & UI_BUT_ACTIVE_LEFT) ?
-                                      (double)max_ii((int)softmin, (int)data->value - value_step) :
-                                      (double)min_ii((int)softmax, (int)data->value + value_step);
+                                      (double)max_ii(softmin, (int)data->value - value_step) :
+                                      (double)min_ii(softmax, (int)data->value + value_step);
         if (value_test != data->value) {
           data->value = (double)value_test;
         }
@@ -4828,11 +4829,14 @@ static int ui_do_but_NUM(
       /* Float Value. */
       if (but->drawflag & (UI_BUT_ACTIVE_LEFT | UI_BUT_ACTIVE_RIGHT)) {
         button_activate_state(C, but, BUTTON_STATE_NUM_EDITING);
+
         const double value_step = (double)but->a1 * UI_PRECISION_FLOAT_SCALE;
         BLI_assert(value_step > 0.0f);
         const double value_test = (but->drawflag & UI_BUT_ACTIVE_LEFT) ?
-                                      (double)max_ff(softmin, (float)(data->value - value_step)) :
-                                      (double)min_ff(softmax, (float)(data->value + value_step));
+                                      (double)max_ff(but->softmin,
+                                                     (float)(data->value - value_step)) :
+                                      (double)min_ff(but->softmax,
+                                                     (float)(data->value + value_step));
         if (value_test != data->value) {
           data->value = value_test;
         }