libtiff/tif_getimage.c:2205: error: Buffer Overrun L3
  Offset: [0, 3] Size: [0, +oo] by call to `makebwmap`.

libtiff/tif_getimage.c:2183:9: Assignment
2181.     /* treat 16 bit the same as eight bit */
2182.     if( img->bitspersample == 16 )
2183.         range = (int32) 255;
              ^
2184. 
2185.     img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));

libtiff/tif_getimage.c:2185:32: Call
2183.         range = (int32) 255;
2184. 
2185.     img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));
                                     ^
2186.     if (img->Map == NULL) {
2187. 		TIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif),

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

libtiff/tif_getimage.c:2185:5: Assignment
2183.         range = (int32) 255;
2184. 
2185.     img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));
          ^
2186.     if (img->Map == NULL) {
2187. 		TIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif),

libtiff/tif_getimage.c:2205:7: Call
2203. 	 * unpacking tables for samples <= 8 bits.
2204. 	 */
2205. 	if (!makebwmap(img))
            ^
2206. 	    return (0);
2207. 	/* no longer need Map, free it */

libtiff/tif_getimage.c:2134:10: <Offset trace>
2132.     }
2133.     p = (uint32*)(img->BWmap + 256);
2134.     for (i = 0; i < 256; i++) {
               ^
2135. 	TIFFRGBValue c;
2136. 	img->BWmap[i] = p;

libtiff/tif_getimage.c:2134:10: Assignment
  2132.     }
  2133.     p = (uint32*)(img->BWmap + 256);
  2134.     for (i = 0; i < 256; i++) {
                 ^
  2135. 	TIFFRGBValue c;
  2136. 	img->BWmap[i] = p;

libtiff/tif_getimage.c:2115:1: <Length trace>
2113.  * number.
2114.  */
2115. static int
      ^
2116. makebwmap(TIFFRGBAImage* img)
2117. {

libtiff/tif_getimage.c:2115:1: Parameter `*img->Map`
  2113.  * number.
  2114.  */
  2115. static int
        ^
  2116. makebwmap(TIFFRGBAImage* img)
  2117. {

libtiff/tif_getimage.c:2118:5: Assignment
  2116. makebwmap(TIFFRGBAImage* img)
  2117. {
  2118.     TIFFRGBValue* Map = img->Map;
            ^
  2119.     int bitspersample = img->bitspersample;
  2120.     int nsamples = 8 / bitspersample;

libtiff/tif_getimage.c:2150:6: Array access: Offset: [0, 3] Size: [0, +oo] by call to `makebwmap` 
  2148. 	    break;
  2149. 	case 2:
  2150. 	    GREY(i>>6);
             ^
  2151. 	    GREY((i>>4)&3);
  2152. 	    GREY((i>>2)&3);

static int
makebwmap(TIFFRGBAImage* img)
{
    TIFFRGBValue* Map = img->Map;
    int bitspersample = img->bitspersample;
    int nsamples = 8 / bitspersample;
    int i;
    uint32* p;
    if( nsamples == 0 )
        nsamples = 1;
    img->BWmap = (uint32**) _TIFFmalloc(
	256*sizeof (uint32 *)+(256*nsamples*sizeof(uint32)));
    if (img->BWmap == NULL) {
		TIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif), "No space for B&W mapping table");
		return (0);
    }
    p = (uint32*)(img->BWmap + 256);
    for (i = 0; i < 256; i++) {
	TIFFRGBValue c;
	img->BWmap[i] = p;
	switch (bitspersample) {
#define	GREY(x)	c = Map[x]; *p++ = PACK(c,c,c);
	case 1:
	    GREY(i>>7);
	    GREY((i>>6)&1);
	    GREY((i>>5)&1);
	    GREY((i>>4)&1);
	    GREY((i>>3)&1);
	    GREY((i>>2)&1);
	    GREY((i>>1)&1);
	    GREY(i&1);
	    break;
	case 2:
	    GREY(i>>6);
	    GREY((i>>4)&3);
	    GREY((i>>2)&3);
	    GREY(i&3);
	    break;
	case 4:
	    GREY(i>>4);
	    GREY(i&0xf);
	    break;
	case 8:
        case 16:
	    GREY(i);
	    break;
	}
#undef	GREY
    }
    return (1);
}
['static int\nsetupMap(TIFFRGBAImage* img)\n{\n    int32 x, range;\n    range = (int32)((1L<<img->bitspersample)-1);\n    if( img->bitspersample == 16 )\n        range = (int32) 255;\n    img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));\n    if (img->Map == NULL) {\n\t\tTIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif),\n\t\t\t"No space for photometric conversion table");\n\t\treturn (0);\n    }\n    if (img->photometric == PHOTOMETRIC_MINISWHITE) {\n\tfor (x = 0; x <= range; x++)\n\t    img->Map[x] = (TIFFRGBValue) (((range - x) * 255) / range);\n    } else {\n\tfor (x = 0; x <= range; x++)\n\t    img->Map[x] = (TIFFRGBValue) ((x * 255) / range);\n    }\n    if (img->bitspersample <= 16 &&\n\t(img->photometric == PHOTOMETRIC_MINISBLACK ||\n\t img->photometric == PHOTOMETRIC_MINISWHITE)) {\n\tif (!makebwmap(img))\n\t    return (0);\n\t_TIFFfree(img->Map), img->Map = NULL;\n    }\n    return (1);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n\treturn (malloc((size_t) s));\n}', 'static int\nmakebwmap(TIFFRGBAImage* img)\n{\n    TIFFRGBValue* Map = img->Map;\n    int bitspersample = img->bitspersample;\n    int nsamples = 8 / bitspersample;\n    int i;\n    uint32* p;\n    if( nsamples == 0 )\n        nsamples = 1;\n    img->BWmap = (uint32**) _TIFFmalloc(\n\t256*sizeof (uint32 *)+(256*nsamples*sizeof(uint32)));\n    if (img->BWmap == NULL) {\n\t\tTIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif), "No space for B&W mapping table");\n\t\treturn (0);\n    }\n    p = (uint32*)(img->BWmap + 256);\n    for (i = 0; i < 256; i++) {\n\tTIFFRGBValue c;\n\timg->BWmap[i] = p;\n\tswitch (bitspersample) {\n#define\tGREY(x)\tc = Map[x]; *p++ = PACK(c,c,c);\n\tcase 1:\n\t    GREY(i>>7);\n\t    GREY((i>>6)&1);\n\t    GREY((i>>5)&1);\n\t    GREY((i>>4)&1);\n\t    GREY((i>>3)&1);\n\t    GREY((i>>2)&1);\n\t    GREY((i>>1)&1);\n\t    GREY(i&1);\n\t    break;\n\tcase 2:\n\t    GREY(i>>6);\n\t    GREY((i>>4)&3);\n\t    GREY((i>>2)&3);\n\t    GREY(i&3);\n\t    break;\n\tcase 4:\n\t    GREY(i>>4);\n\t    GREY(i&0xf);\n\t    break;\n\tcase 8:\n        case 16:\n\t    GREY(i);\n\t    break;\n\t}\n#undef\tGREY\n    }\n    return (1);\n}']