tools/tiffcp.c:1490: error: Integer Overflow L2
  ([0, max(0, `out->tif_dir.td_imagelength`)] - 1):unsigned32 by call to `TIFFWriteTile`.

tools/tiffcp.c:1443:1: Parameter `out->tif_dir.td_imagelength`
1441. }
1442. 
1443. DECLAREwriteFunc(writeBufferToSeparateTiles)
      ^
1444. {
1445. 	uint32 imagew = TIFFScanlineSize(out);

tools/tiffcp.c:1490:9: Call
1488. 					    0, iskew, spp,
1489. 					    bytes_per_sample);
1490. 				if (TIFFWriteTile(out, obuf, col, row, 0, s) < 0) {
              ^
1491. 					TIFFError(TIFFFileName(out),
1492. 					    "Error, can't write tile at %lu %lu "

libtiff/tif_write.c:312:1: Parameter `tif->tif_dir.td_imagelength`
  310.  * tile is selected by the (x,y,z,s) coordinates.
  311.  */
  312. tmsize_t
       ^
  313. TIFFWriteTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  314. {

libtiff/tif_write.c:315:7: Call
  313. TIFFWriteTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  314. {
  315. 	if (!TIFFCheckTile(tif, x, y, z, s))
             ^
  316. 		return ((tmsize_t)(-1));
  317. 	/*

libtiff/tif_tile.c:100:1: <LHS trace>
 98.  * against the image bounds.
 99.  */
100. int
     ^
101. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
102. {

libtiff/tif_tile.c:100:1: Parameter `y`
     98.  * against the image bounds.
     99.  */
    100. int
         ^
    101. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
    102. {

libtiff/tif_tile.c:113:3: Binary operation: ([0, max(0, out->tif_dir.td_imagelength)] - 1):unsigned32 by call to `TIFFWriteTile` 
    111. 	}
    112. 	if (y >= td->td_imagelength) {
    113. 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
           ^
    114. 			     "%lu: Row out of range, max %lu",
    115. 			     (unsigned long) y,

int
TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
{
	TIFFDirectory *td = &tif->tif_dir;
	if (x >= td->td_imagewidth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Col out of range, max %lu",
			     (unsigned long) x,
			     (unsigned long) (td->td_imagewidth - 1));
		return (0);
	}
	if (y >= td->td_imagelength) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Row out of range, max %lu",
			     (unsigned long) y,
			     (unsigned long) (td->td_imagelength - 1));
		return (0);
	}
	if (z >= td->td_imagedepth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Depth out of range, max %lu",
			     (unsigned long) z,
			     (unsigned long) (td->td_imagedepth - 1));
		return (0);
	}
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE &&
	    s >= td->td_samplesperpixel) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Sample out of range, max %lu",
			     (unsigned long) s,
			     (unsigned long) (td->td_samplesperpixel - 1));
		return (0);
	}
	return (1);
}
['DECLAREwriteFunc(writeBufferToSeparateTiles)\n{\n\tuint32 imagew = TIFFScanlineSize(out);\n\ttsize_t tilew  = TIFFTileRowSize(out);\n\tuint32 iimagew = TIFFRasterScanlineSize(out);\n\tint iskew = iimagew - tilew*spp;\n\ttdata_t obuf = _TIFFmalloc(TIFFTileSize(out));\n\tuint8* bufp = (uint8*) buf;\n\tuint32 tl, tw;\n\tuint32 row;\n\tuint16 bps, bytes_per_sample;\n\tif (obuf == NULL)\n\t\treturn 0;\n\t(void) TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);\n\t(void) TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);\n\t(void) TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);\n\tassert( bps % 8 == 0 );\n\tbytes_per_sample = bps/8;\n\tfor (row = 0; row < imagelength; row += tl) {\n\t\tuint32 nrow = (row+tl > imagelength) ? imagelength-row : tl;\n\t\tuint32 colb = 0;\n\t\tuint32 col;\n\t\tfor (col = 0; col < imagewidth; col += tw) {\n\t\t\ttsample_t s;\n\t\t\tfor (s = 0; s < spp; s++) {\n\t\t\t\tif (colb + tilew > imagew) {\n\t\t\t\t\tuint32 width = (imagew - colb);\n\t\t\t\t\tint oskew = tilew - width;\n\t\t\t\t\tcpContigBufToSeparateBuf(obuf,\n\t\t\t\t\t    bufp + (colb*spp) + s,\n\t\t\t\t\t    nrow, width/bytes_per_sample,\n\t\t\t\t\t    oskew, (oskew*spp)+iskew, spp,\n\t\t\t\t\t    bytes_per_sample);\n\t\t\t\t} else\n\t\t\t\t\tcpContigBufToSeparateBuf(obuf,\n\t\t\t\t\t    bufp + (colb*spp) + s,\n\t\t\t\t\t    nrow, tilewidth,\n\t\t\t\t\t    0, iskew, spp,\n\t\t\t\t\t    bytes_per_sample);\n\t\t\t\tif (TIFFWriteTile(out, obuf, col, row, 0, s) < 0) {\n\t\t\t\t\tTIFFError(TIFFFileName(out),\n\t\t\t\t\t    "Error, can\'t write tile at %lu %lu "\n\t\t\t\t\t    "sample %lu",\n\t\t\t\t\t    (unsigned long) col,\n\t\t\t\t\t    (unsigned long) row,\n\t\t\t\t\t    (unsigned long) s);\n\t\t\t\t\t_TIFFfree(obuf);\n\t\t\t\t\treturn 0;\n\t\t\t\t}\n\t\t\t}\n\t\t\tcolb += tilew;\n\t\t}\n\t\tbufp += nrow * iimagew;\n\t}\n\t_TIFFfree(obuf);\n\treturn 1;\n}', 'tmsize_t\nTIFFWriteTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tif (!TIFFCheckTile(tif, x, y, z, s))\n\t\treturn ((tmsize_t)(-1));\n\treturn (TIFFWriteEncodedTile(tif,\n\t    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));\n}', 'int\nTIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (x >= td->td_imagewidth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Col out of range, max %lu",\n\t\t\t     (unsigned long) x,\n\t\t\t     (unsigned long) (td->td_imagewidth - 1));\n\t\treturn (0);\n\t}\n\tif (y >= td->td_imagelength) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Row out of range, max %lu",\n\t\t\t     (unsigned long) y,\n\t\t\t     (unsigned long) (td->td_imagelength - 1));\n\t\treturn (0);\n\t}\n\tif (z >= td->td_imagedepth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Depth out of range, max %lu",\n\t\t\t     (unsigned long) z,\n\t\t\t     (unsigned long) (td->td_imagedepth - 1));\n\t\treturn (0);\n\t}\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE &&\n\t    s >= td->td_samplesperpixel) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Sample out of range, max %lu",\n\t\t\t     (unsigned long) s,\n\t\t\t     (unsigned long) (td->td_samplesperpixel - 1));\n\t\treturn (0);\n\t}\n\treturn (1);\n}']