tools/tiff2pdf.c:1100: error: Buffer Overrun S2
  Offset: `t2p->tiff_pagecount` Size: [0, +oo].

tools/tiff2pdf.c:1053:1: <Offset trace>
1051. */
1052. 
1053. void t2p_read_tiff_init(T2P* t2p, TIFF* input){
      ^
1054. 
1055. 	tdir_t directorycount=0;

tools/tiff2pdf.c:1053:1: Parameter `t2p->tiff_pagecount`
1051. */
1052. 
1053. void t2p_read_tiff_init(T2P* t2p, TIFF* input){
      ^
1054. 
1055. 	tdir_t directorycount=0;

tools/tiff2pdf.c:1061:17: <Length trace>
1059. 	uint16 xuint16=0;
1060. 
1061. 	directorycount=TIFFNumberOfDirectories(input);
                      ^
1062. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));
1063. 	if(t2p->tiff_pages==NULL){

tools/tiff2pdf.c:1061:17: Call
1059. 	uint16 xuint16=0;
1060. 
1061. 	directorycount=TIFFNumberOfDirectories(input);
                      ^
1062. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));
1063. 	if(t2p->tiff_pages==NULL){

libtiff/tif_dir.c:1340:2: Assignment
  1338. 	else
  1339. 		nextdir = tif->tif_header.big.tiff_diroff;
  1340. 	n = 0;
         ^
  1341. 	while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
  1342. 		n++;

libtiff/tif_dir.c:1343:2: Assignment
  1341. 	while (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))
  1342. 		n++;
  1343. 	return (n);
         ^
  1344. }
  1345. 

tools/tiff2pdf.c:1061:2: Assignment
1059. 	uint16 xuint16=0;
1060. 
1061. 	directorycount=TIFFNumberOfDirectories(input);
       ^
1062. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));
1063. 	if(t2p->tiff_pages==NULL){

tools/tiff2pdf.c:1062:32: Call
1060. 
1061. 	directorycount=TIFFNumberOfDirectories(input);
1062. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));
                                     ^
1063. 	if(t2p->tiff_pages==NULL){
1064. 		TIFFError(

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

tools/tiff2pdf.c:1062:2: Assignment
1060. 
1061. 	directorycount=TIFFNumberOfDirectories(input);
1062. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));
       ^
1063. 	if(t2p->tiff_pages==NULL){
1064. 		TIFFError(

tools/tiff2pdf.c:1100:5: Array access: Offset: t2p->tiff_pagecount Size: [0, +oo]
1098. 					paged;
1099. 			} else {
1100. 				t2p->tiff_pages[t2p->tiff_pagecount].page_number = 
          ^
1101. 					pagen;
1102. 			}

void t2p_read_tiff_init(T2P* t2p, TIFF* input){
	tdir_t directorycount=0;
	tdir_t i=0;
	uint16 pagen=0;
	uint16 paged=0;
	uint16 xuint16=0;
	directorycount=TIFFNumberOfDirectories(input);
	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));
	if(t2p->tiff_pages==NULL){
		TIFFError(
			TIFF2PDF_MODULE,
			"Can't allocate %lu bytes of memory for tiff_pages array, %s",
			(unsigned long) directorycount * sizeof(T2P_PAGE),
			TIFFFileName(input));
		t2p->t2p_error = T2P_ERR_ERROR;
		return;
	}
	_TIFFmemset( t2p->tiff_pages, 0x00, directorycount * sizeof(T2P_PAGE));
	t2p->tiff_tiles = (T2P_TILES*) _TIFFmalloc(directorycount * sizeof(T2P_TILES));
	if(t2p->tiff_tiles==NULL){
		TIFFError(
			TIFF2PDF_MODULE,
			"Can't allocate %lu bytes of memory for tiff_tiles array, %s",
			(unsigned long) directorycount * sizeof(T2P_TILES),
			TIFFFileName(input));
		t2p->t2p_error = T2P_ERR_ERROR;
		return;
	}
	_TIFFmemset( t2p->tiff_tiles, 0x00, directorycount * sizeof(T2P_TILES));
	for(i=0;i<directorycount;i++){
		uint32 subfiletype = 0;
		if(!TIFFSetDirectory(input, i)){
			TIFFError(
				TIFF2PDF_MODULE,
				"Can't set directory %u of input file %s",
				i,
				TIFFFileName(input));
			return;
		}
		if(TIFFGetField(input, TIFFTAG_PAGENUMBER, &pagen, &paged)){
			if((pagen>paged) && (paged != 0)){
				t2p->tiff_pages[t2p->tiff_pagecount].page_number =
					paged;
			} else {
				t2p->tiff_pages[t2p->tiff_pagecount].page_number =
					pagen;
			}
			goto ispage2;
		}
		if(TIFFGetField(input, TIFFTAG_SUBFILETYPE, &subfiletype)){
			if ( ((subfiletype & FILETYPE_PAGE) != 0)
                             || (subfiletype == 0)){
				goto ispage;
			} else {
				goto isnotpage;
			}
		}
		if(TIFFGetField(input, TIFFTAG_OSUBFILETYPE, &subfiletype)){
			if ((subfiletype == OFILETYPE_IMAGE)
				|| (subfiletype == OFILETYPE_PAGE)
				|| (subfiletype == 0) ){
				goto ispage;
			} else {
				goto isnotpage;
			}
		}
		ispage:
		t2p->tiff_pages[t2p->tiff_pagecount].page_number=t2p->tiff_pagecount;
		ispage2:
		t2p->tiff_pages[t2p->tiff_pagecount].page_directory=i;
		if(TIFFIsTiled(input)){
			t2p->tiff_pages[t2p->tiff_pagecount].page_tilecount =
				TIFFNumberOfTiles(input);
		}
		t2p->tiff_pagecount++;
		isnotpage:
		(void)0;
	}
	qsort((void*) t2p->tiff_pages, t2p->tiff_pagecount,
              sizeof(T2P_PAGE), t2p_cmp_t2p_page);
	for(i=0;i<t2p->tiff_pagecount;i++){
		t2p->pdf_xrefcount += 5;
		TIFFSetDirectory(input, t2p->tiff_pages[i].page_directory );
		if((TIFFGetField(input, TIFFTAG_PHOTOMETRIC, &xuint16)
                    && (xuint16==PHOTOMETRIC_PALETTE))
		   || TIFFGetField(input, TIFFTAG_INDEXED, &xuint16)) {
			t2p->tiff_pages[i].page_extra++;
			t2p->pdf_xrefcount++;
		}
#ifdef ZIP_SUPPORT
		if (TIFFGetField(input, TIFFTAG_COMPRESSION, &xuint16)) {
                        if( (xuint16== COMPRESSION_DEFLATE ||
                             xuint16== COMPRESSION_ADOBE_DEFLATE) &&
                            ((t2p->tiff_pages[i].page_tilecount != 0)
                             || TIFFNumberOfStrips(input)==1) &&
                            (t2p->pdf_nopassthrough==0)	){
                                if(t2p->pdf_minorversion<2){t2p->pdf_minorversion=2;}
                        }
                }
#endif
		if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,
                                 &(t2p->tiff_transferfunction[0]),
                                 &(t2p->tiff_transferfunction[1]),
                                 &(t2p->tiff_transferfunction[2]))) {
			if(t2p->tiff_transferfunction[1] !=
			   t2p->tiff_transferfunction[0]) {
				t2p->tiff_transferfunctioncount = 3;
				t2p->tiff_pages[i].page_extra += 4;
				t2p->pdf_xrefcount += 4;
			} else {
				t2p->tiff_transferfunctioncount = 1;
				t2p->tiff_pages[i].page_extra += 2;
				t2p->pdf_xrefcount += 2;
			}
			if(t2p->pdf_minorversion < 2)
				t2p->pdf_minorversion = 2;
                } else {
			t2p->tiff_transferfunctioncount=0;
		}
		if( TIFFGetField(
			input,
			TIFFTAG_ICCPROFILE,
			&(t2p->tiff_iccprofilelength),
			&(t2p->tiff_iccprofile)) != 0){
			t2p->tiff_pages[i].page_extra++;
			t2p->pdf_xrefcount++;
			if(t2p->pdf_minorversion<3){t2p->pdf_minorversion=3;}
		}
		t2p->tiff_tiles[i].tiles_tilecount=
			t2p->tiff_pages[i].page_tilecount;
		if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)
			&& (xuint16 == PLANARCONFIG_SEPARATE ) ){
				TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);
				t2p->tiff_tiles[i].tiles_tilecount/= xuint16;
		}
		if( t2p->tiff_tiles[i].tiles_tilecount > 0){
			t2p->pdf_xrefcount +=
				(t2p->tiff_tiles[i].tiles_tilecount -1)*2;
			TIFFGetField(input,
				TIFFTAG_TILEWIDTH,
				&( t2p->tiff_tiles[i].tiles_tilewidth) );
			TIFFGetField(input,
				TIFFTAG_TILELENGTH,
				&( t2p->tiff_tiles[i].tiles_tilelength) );
			t2p->tiff_tiles[i].tiles_tiles =
			(T2P_TILE*) _TIFFmalloc(
				t2p->tiff_tiles[i].tiles_tilecount
				* sizeof(T2P_TILE) );
			if( t2p->tiff_tiles[i].tiles_tiles == NULL){
				TIFFError(
					TIFF2PDF_MODULE,
					"Can't allocate %lu bytes of memory for t2p_read_tiff_init, %s",
					(unsigned long) t2p->tiff_tiles[i].tiles_tilecount * sizeof(T2P_TILE),
					TIFFFileName(input));
				t2p->t2p_error = T2P_ERR_ERROR;
				return;
			}
		}
	}
	return;
}
['void t2p_read_tiff_init(T2P* t2p, TIFF* input){\n\ttdir_t directorycount=0;\n\ttdir_t i=0;\n\tuint16 pagen=0;\n\tuint16 paged=0;\n\tuint16 xuint16=0;\n\tdirectorycount=TIFFNumberOfDirectories(input);\n\tt2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(directorycount * sizeof(T2P_PAGE));\n\tif(t2p->tiff_pages==NULL){\n\t\tTIFFError(\n\t\t\tTIFF2PDF_MODULE,\n\t\t\t"Can\'t allocate %lu bytes of memory for tiff_pages array, %s",\n\t\t\t(unsigned long) directorycount * sizeof(T2P_PAGE),\n\t\t\tTIFFFileName(input));\n\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\treturn;\n\t}\n\t_TIFFmemset( t2p->tiff_pages, 0x00, directorycount * sizeof(T2P_PAGE));\n\tt2p->tiff_tiles = (T2P_TILES*) _TIFFmalloc(directorycount * sizeof(T2P_TILES));\n\tif(t2p->tiff_tiles==NULL){\n\t\tTIFFError(\n\t\t\tTIFF2PDF_MODULE,\n\t\t\t"Can\'t allocate %lu bytes of memory for tiff_tiles array, %s",\n\t\t\t(unsigned long) directorycount * sizeof(T2P_TILES),\n\t\t\tTIFFFileName(input));\n\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\treturn;\n\t}\n\t_TIFFmemset( t2p->tiff_tiles, 0x00, directorycount * sizeof(T2P_TILES));\n\tfor(i=0;i<directorycount;i++){\n\t\tuint32 subfiletype = 0;\n\t\tif(!TIFFSetDirectory(input, i)){\n\t\t\tTIFFError(\n\t\t\t\tTIFF2PDF_MODULE,\n\t\t\t\t"Can\'t set directory %u of input file %s",\n\t\t\t\ti,\n\t\t\t\tTIFFFileName(input));\n\t\t\treturn;\n\t\t}\n\t\tif(TIFFGetField(input, TIFFTAG_PAGENUMBER, &pagen, &paged)){\n\t\t\tif((pagen>paged) && (paged != 0)){\n\t\t\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_number =\n\t\t\t\t\tpaged;\n\t\t\t} else {\n\t\t\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_number =\n\t\t\t\t\tpagen;\n\t\t\t}\n\t\t\tgoto ispage2;\n\t\t}\n\t\tif(TIFFGetField(input, TIFFTAG_SUBFILETYPE, &subfiletype)){\n\t\t\tif ( ((subfiletype & FILETYPE_PAGE) != 0)\n                             || (subfiletype == 0)){\n\t\t\t\tgoto ispage;\n\t\t\t} else {\n\t\t\t\tgoto isnotpage;\n\t\t\t}\n\t\t}\n\t\tif(TIFFGetField(input, TIFFTAG_OSUBFILETYPE, &subfiletype)){\n\t\t\tif ((subfiletype == OFILETYPE_IMAGE)\n\t\t\t\t|| (subfiletype == OFILETYPE_PAGE)\n\t\t\t\t|| (subfiletype == 0) ){\n\t\t\t\tgoto ispage;\n\t\t\t} else {\n\t\t\t\tgoto isnotpage;\n\t\t\t}\n\t\t}\n\t\tispage:\n\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_number=t2p->tiff_pagecount;\n\t\tispage2:\n\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_directory=i;\n\t\tif(TIFFIsTiled(input)){\n\t\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_tilecount =\n\t\t\t\tTIFFNumberOfTiles(input);\n\t\t}\n\t\tt2p->tiff_pagecount++;\n\t\tisnotpage:\n\t\t(void)0;\n\t}\n\tqsort((void*) t2p->tiff_pages, t2p->tiff_pagecount,\n              sizeof(T2P_PAGE), t2p_cmp_t2p_page);\n\tfor(i=0;i<t2p->tiff_pagecount;i++){\n\t\tt2p->pdf_xrefcount += 5;\n\t\tTIFFSetDirectory(input, t2p->tiff_pages[i].page_directory );\n\t\tif((TIFFGetField(input, TIFFTAG_PHOTOMETRIC, &xuint16)\n                    && (xuint16==PHOTOMETRIC_PALETTE))\n\t\t   || TIFFGetField(input, TIFFTAG_INDEXED, &xuint16)) {\n\t\t\tt2p->tiff_pages[i].page_extra++;\n\t\t\tt2p->pdf_xrefcount++;\n\t\t}\n#ifdef ZIP_SUPPORT\n\t\tif (TIFFGetField(input, TIFFTAG_COMPRESSION, &xuint16)) {\n                        if( (xuint16== COMPRESSION_DEFLATE ||\n                             xuint16== COMPRESSION_ADOBE_DEFLATE) &&\n                            ((t2p->tiff_pages[i].page_tilecount != 0)\n                             || TIFFNumberOfStrips(input)==1) &&\n                            (t2p->pdf_nopassthrough==0)\t){\n                                if(t2p->pdf_minorversion<2){t2p->pdf_minorversion=2;}\n                        }\n                }\n#endif\n\t\tif (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,\n                                 &(t2p->tiff_transferfunction[0]),\n                                 &(t2p->tiff_transferfunction[1]),\n                                 &(t2p->tiff_transferfunction[2]))) {\n\t\t\tif(t2p->tiff_transferfunction[1] !=\n\t\t\t   t2p->tiff_transferfunction[0]) {\n\t\t\t\tt2p->tiff_transferfunctioncount = 3;\n\t\t\t\tt2p->tiff_pages[i].page_extra += 4;\n\t\t\t\tt2p->pdf_xrefcount += 4;\n\t\t\t} else {\n\t\t\t\tt2p->tiff_transferfunctioncount = 1;\n\t\t\t\tt2p->tiff_pages[i].page_extra += 2;\n\t\t\t\tt2p->pdf_xrefcount += 2;\n\t\t\t}\n\t\t\tif(t2p->pdf_minorversion < 2)\n\t\t\t\tt2p->pdf_minorversion = 2;\n                } else {\n\t\t\tt2p->tiff_transferfunctioncount=0;\n\t\t}\n\t\tif( TIFFGetField(\n\t\t\tinput,\n\t\t\tTIFFTAG_ICCPROFILE,\n\t\t\t&(t2p->tiff_iccprofilelength),\n\t\t\t&(t2p->tiff_iccprofile)) != 0){\n\t\t\tt2p->tiff_pages[i].page_extra++;\n\t\t\tt2p->pdf_xrefcount++;\n\t\t\tif(t2p->pdf_minorversion<3){t2p->pdf_minorversion=3;}\n\t\t}\n\t\tt2p->tiff_tiles[i].tiles_tilecount=\n\t\t\tt2p->tiff_pages[i].page_tilecount;\n\t\tif( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)\n\t\t\t&& (xuint16 == PLANARCONFIG_SEPARATE ) ){\n\t\t\t\tTIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);\n\t\t\t\tt2p->tiff_tiles[i].tiles_tilecount/= xuint16;\n\t\t}\n\t\tif( t2p->tiff_tiles[i].tiles_tilecount > 0){\n\t\t\tt2p->pdf_xrefcount +=\n\t\t\t\t(t2p->tiff_tiles[i].tiles_tilecount -1)*2;\n\t\t\tTIFFGetField(input,\n\t\t\t\tTIFFTAG_TILEWIDTH,\n\t\t\t\t&( t2p->tiff_tiles[i].tiles_tilewidth) );\n\t\t\tTIFFGetField(input,\n\t\t\t\tTIFFTAG_TILELENGTH,\n\t\t\t\t&( t2p->tiff_tiles[i].tiles_tilelength) );\n\t\t\tt2p->tiff_tiles[i].tiles_tiles =\n\t\t\t(T2P_TILE*) _TIFFmalloc(\n\t\t\t\tt2p->tiff_tiles[i].tiles_tilecount\n\t\t\t\t* sizeof(T2P_TILE) );\n\t\t\tif( t2p->tiff_tiles[i].tiles_tiles == NULL){\n\t\t\t\tTIFFError(\n\t\t\t\t\tTIFF2PDF_MODULE,\n\t\t\t\t\t"Can\'t allocate %lu bytes of memory for t2p_read_tiff_init, %s",\n\t\t\t\t\t(unsigned long) t2p->tiff_tiles[i].tiles_tilecount * sizeof(T2P_TILE),\n\t\t\t\t\tTIFFFileName(input));\n\t\t\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t}\n\treturn;\n}', 'uint16\nTIFFNumberOfDirectories(TIFF* tif)\n{\n\tuint64 nextdir;\n\tuint16 n;\n\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t\tnextdir = tif->tif_header.classic.tiff_diroff;\n\telse\n\t\tnextdir = tif->tif_header.big.tiff_diroff;\n\tn = 0;\n\twhile (nextdir != 0 && TIFFAdvanceDirectory(tif, &nextdir, NULL))\n\t\tn++;\n\treturn (n);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n\treturn (malloc((size_t) s));\n}']