tools/tiffcrop.c:7939: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `reverseSamples32bits`.

tools/tiffcrop.c:7846:1: Parameter `bps`
7844. 
7845. /* Mirror an image horizontally or vertically */
7846. static int
      ^
7847. mirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length, unsigned char *ibuff)
7848.   {

tools/tiffcrop.c:7857:3: Assignment
7855. 
7856.   src = ibuff;
7857.   rowsize = ((width * bps * spp) + 7) / 8;
        ^
7858.   switch (mirror)
7859.     {

tools/tiffcrop.c:7898:52: Call
7896. 	      else
7897.                 { /* non 8 bit per sample  data */
7898.                 if (!(line_buff = (unsigned char *)_TIFFmalloc(rowsize + 1)))
                                                         ^
7899.                   {
7900.                   TIFFError("mirrorImage", "Unable to allocate mirror line buffer");

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

tools/tiffcrop.c:7898:23: Assignment
7896. 	      else
7897.                 { /* non 8 bit per sample  data */
7898.                 if (!(line_buff = (unsigned char *)_TIFFmalloc(rowsize + 1)))
                            ^
7899.                   {
7900.                   TIFFError("mirrorImage", "Unable to allocate mirror line buffer");

tools/tiffcrop.c:7939:33: Call
7937.                              break;
7938.                     case 4: 
7939.                     case 5: if (reverseSamples32bits(spp, bps, width, src, line_buff))
                                      ^
7940.                               {
7941. 		              _TIFFfree(line_buff);

tools/tiffcrop.c:7672:1: <Length trace>
7670. 
7671. 
7672. static int
      ^
7673. reverseSamples32bits (uint16 spp, uint16 bps, uint32 width, 
7674.                       uint8 *ibuff, uint8 *obuff)

tools/tiffcrop.c:7672:1: Parameter `*obuff`
  7670. 
  7671. 
  7672. static int
        ^
  7673. reverseSamples32bits (uint16 spp, uint16 bps, uint32 width, 
  7674.                       uint8 *ibuff, uint8 *obuff)

tools/tiffcrop.c:7699:3: Assignment
  7697.   ready_bits = 0;
  7698.   maskbits =  (uint64)-1 >> (64 - bps);
  7699.   dst = obuff;
          ^
  7700. 
  7701.   bytes_per_sample = (bps + 7) / 8;

tools/tiffcrop.c:7771:10: Assignment
  7769.         {
  7770.         bytebuff1 = (buff2 >> 56);
  7771.         *dst++ = bytebuff1;
                 ^
  7772.         bytebuff2 = (buff2 >> 48);
  7773.         *dst++ = bytebuff2;

tools/tiffcrop.c:7773:9: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `reverseSamples32bits` 
  7771.         *dst++ = bytebuff1;
  7772.         bytebuff2 = (buff2 >> 48);
  7773.         *dst++ = bytebuff2;
                ^
  7774.         bytebuff3 = (buff2 >> 40);
  7775.         *dst++ = bytebuff3;

static int
reverseSamples32bits (uint16 spp, uint16 bps, uint32 width,
                      uint8 *ibuff, uint8 *obuff)
  {
  int    ready_bits = 0, shift_width = 0;
  int    bytes_per_sample, bytes_per_pixel;
  uint32 bit_offset;
  uint32 src_byte = 0, src_bit = 0;
  uint32 col;
  uint32 longbuff1 = 0, longbuff2 = 0;
  uint64 maskbits = 0, matchbits = 0;
  uint64 buff1 = 0, buff2 = 0, buff3 = 0;
  uint8  bytebuff1 = 0, bytebuff2 = 0, bytebuff3 = 0, bytebuff4 = 0;
  unsigned char *src;
  unsigned char *dst;
  unsigned char  swapbuff1[4];
  unsigned char  swapbuff2[4];
  tsample_t sample;
  if ((ibuff == NULL) || (obuff == NULL))
    {
    TIFFError("reverseSamples32bits","Invalid image or work buffer");
    return (1);
    }
  ready_bits = 0;
  maskbits =  (uint64)-1 >> (64 - bps);
  dst = obuff;
  bytes_per_sample = (bps + 7) / 8;
  bytes_per_pixel  = ((bps * spp) + 7) / 8;
  if (bytes_per_pixel < (bytes_per_sample + 1))
    shift_width = bytes_per_pixel;
  else
    shift_width = bytes_per_sample + 1;
  for (col = width; col > 0; col--)
    {
    bit_offset = (col - 1) * bps * spp;
    for (sample = 0; sample < spp; sample++)
      {
      if (sample == 0)
        {
        src_byte = bit_offset / 8;
        src_bit  = bit_offset % 8;
        }
      else
        {
        src_byte = (bit_offset + (sample * bps)) / 8;
        src_bit  = (bit_offset + (sample * bps)) % 8;
        }
      src = ibuff + src_byte;
      matchbits = maskbits << (64 - src_bit - bps);
      if (little_endian)
        {
        swapbuff1[3] = *src;
        swapbuff1[2] = *(src + 1);
        swapbuff1[1] = *(src + 2);
        swapbuff1[0] = *(src + 3);
        }
      else
        {
        swapbuff1[0] = *src;
        swapbuff1[1] = *(src + 1);
        swapbuff1[2] = *(src + 2);
        swapbuff1[3] = *(src + 3);
	}
      longbuff1 = *((uint32 *)swapbuff1);
      memset (swapbuff2, '\0', sizeof(swapbuff2));
      if (little_endian)
        {
        swapbuff2[3] = *src;
        swapbuff2[2] = *(src + 1);
        swapbuff2[1] = *(src + 2);
        swapbuff2[0] = *(src + 3);
        }
      else
        {
        swapbuff2[0] = *src;
        swapbuff2[1] = *(src + 1);
        swapbuff2[2] = *(src + 2);
        swapbuff2[3] = *(src + 3);
	}
      longbuff2 = *((uint32 *)swapbuff2);
      buff3 = ((uint64)longbuff1 << 32) | longbuff2;
      buff1 = (buff3 & matchbits) << (src_bit);
      if (ready_bits < 32)
        {
        bytebuff1 = bytebuff2 = bytebuff3 = bytebuff4 = 0;
        buff2 = (buff2 | (buff1 >> ready_bits));
        }
      else
        {
        bytebuff1 = (buff2 >> 56);
        *dst++ = bytebuff1;
        bytebuff2 = (buff2 >> 48);
        *dst++ = bytebuff2;
        bytebuff3 = (buff2 >> 40);
        *dst++ = bytebuff3;
        bytebuff4 = (buff2 >> 32);
        *dst++ = bytebuff4;
        ready_bits -= 32;
        buff2 = ((buff2 << 32) | (buff1 >> ready_bits));
        }
      ready_bits += bps;
      }
    }
  while (ready_bits > 0)
    {
    bytebuff1 = (buff2 >> 56);
    *dst++ = bytebuff1;
    buff2 = (buff2 << 8);
    ready_bits -= 8;
    }
  return (0);
  }
['static int\nmirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length, unsigned char *ibuff)\n  {\n  int      shift_width;\n  uint32   bytes_per_pixel, bytes_per_sample;\n  uint32   row, rowsize, row_offset;\n  unsigned char *line_buff = NULL;\n  unsigned char *src;\n  unsigned char *dst;\n  src = ibuff;\n  rowsize = ((width * bps * spp) + 7) / 8;\n  switch (mirror)\n    {\n    case MIRROR_BOTH:\n    case MIRROR_VERT:\n             line_buff = (unsigned char *)_TIFFmalloc(rowsize);\n             if (line_buff == NULL)\n               {\n\t       TIFFError ("mirrorImage", "Unable to allocate mirror line buffer of %1u bytes", rowsize);\n               return (-1);\n               }\n             dst = ibuff + (rowsize * (length - 1));\n             for (row = 0; row < length / 2; row++)\n               {\n\t      _TIFFmemcpy(line_buff, src, rowsize);\n\t      _TIFFmemcpy(src, dst,  rowsize);\n\t      _TIFFmemcpy(dst, line_buff, rowsize);\n               src += (rowsize);\n               dst -= (rowsize);\n               }\n             if (line_buff)\n               _TIFFfree(line_buff);\n             if (mirror == MIRROR_VERT)\n               break;\n    case MIRROR_HORIZ :\n              if ((bps % 8) == 0)\n                {\n                for (row = 0; row < length; row++)\n                  {\n\t\t  row_offset = row * rowsize;\n                  src = ibuff + row_offset;\n                  dst = ibuff + row_offset + rowsize;\n                  if (reverseSamplesBytes(spp, bps, width, src, dst))\n                    {\n\t\t    return (-1);\n                    }\n\t\t  }\n\t\t}\n\t      else\n                {\n                if (!(line_buff = (unsigned char *)_TIFFmalloc(rowsize + 1)))\n                  {\n                  TIFFError("mirrorImage", "Unable to allocate mirror line buffer");\n                  return (-1);\n                  }\n                bytes_per_sample = (bps + 7) / 8;\n                bytes_per_pixel  = ((bps * spp) + 7) / 8;\n                if (bytes_per_pixel < (bytes_per_sample + 1))\n                  shift_width = bytes_per_pixel;\n                else\n                  shift_width = bytes_per_sample + 1;\n                for (row = 0; row < length; row++)\n                  {\n\t\t  row_offset = row * rowsize;\n                  src = ibuff + row_offset;\n                  _TIFFmemset (line_buff, \'\\0\', rowsize);\n                  switch (shift_width)\n                    {\n                    case 1: if (reverseSamples8bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    case 2: if (reverseSamples16bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    case 3: if (reverseSamples24bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    case 4:\n                    case 5: if (reverseSamples32bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    default: TIFFError("mirrorImage","Unsupported bit depth %d", bps);\n\t\t             _TIFFfree(line_buff);\n                             return (-1);\n                    }\n\t\t  }\n                if (line_buff)\n                  _TIFFfree(line_buff);\n\t\t}\n             break;\n    default: TIFFError ("mirrorImage", "Invalid mirror axis %d", mirror);\n             return (-1);\n             break;\n    }\n  return (0);\n  }', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n\treturn (malloc((size_t) s));\n}', 'static int\nreverseSamples32bits (uint16 spp, uint16 bps, uint32 width,\n                      uint8 *ibuff, uint8 *obuff)\n  {\n  int    ready_bits = 0, shift_width = 0;\n  int    bytes_per_sample, bytes_per_pixel;\n  uint32 bit_offset;\n  uint32 src_byte = 0, src_bit = 0;\n  uint32 col;\n  uint32 longbuff1 = 0, longbuff2 = 0;\n  uint64 maskbits = 0, matchbits = 0;\n  uint64 buff1 = 0, buff2 = 0, buff3 = 0;\n  uint8  bytebuff1 = 0, bytebuff2 = 0, bytebuff3 = 0, bytebuff4 = 0;\n  unsigned char *src;\n  unsigned char *dst;\n  unsigned char  swapbuff1[4];\n  unsigned char  swapbuff2[4];\n  tsample_t sample;\n  if ((ibuff == NULL) || (obuff == NULL))\n    {\n    TIFFError("reverseSamples32bits","Invalid image or work buffer");\n    return (1);\n    }\n  ready_bits = 0;\n  maskbits =  (uint64)-1 >> (64 - bps);\n  dst = obuff;\n  bytes_per_sample = (bps + 7) / 8;\n  bytes_per_pixel  = ((bps * spp) + 7) / 8;\n  if (bytes_per_pixel < (bytes_per_sample + 1))\n    shift_width = bytes_per_pixel;\n  else\n    shift_width = bytes_per_sample + 1;\n  for (col = width; col > 0; col--)\n    {\n    bit_offset = (col - 1) * bps * spp;\n    for (sample = 0; sample < spp; sample++)\n      {\n      if (sample == 0)\n        {\n        src_byte = bit_offset / 8;\n        src_bit  = bit_offset % 8;\n        }\n      else\n        {\n        src_byte = (bit_offset + (sample * bps)) / 8;\n        src_bit  = (bit_offset + (sample * bps)) % 8;\n        }\n      src = ibuff + src_byte;\n      matchbits = maskbits << (64 - src_bit - bps);\n      if (little_endian)\n        {\n        swapbuff1[3] = *src;\n        swapbuff1[2] = *(src + 1);\n        swapbuff1[1] = *(src + 2);\n        swapbuff1[0] = *(src + 3);\n        }\n      else\n        {\n        swapbuff1[0] = *src;\n        swapbuff1[1] = *(src + 1);\n        swapbuff1[2] = *(src + 2);\n        swapbuff1[3] = *(src + 3);\n\t}\n      longbuff1 = *((uint32 *)swapbuff1);\n      memset (swapbuff2, \'\\0\', sizeof(swapbuff2));\n      if (little_endian)\n        {\n        swapbuff2[3] = *src;\n        swapbuff2[2] = *(src + 1);\n        swapbuff2[1] = *(src + 2);\n        swapbuff2[0] = *(src + 3);\n        }\n      else\n        {\n        swapbuff2[0] = *src;\n        swapbuff2[1] = *(src + 1);\n        swapbuff2[2] = *(src + 2);\n        swapbuff2[3] = *(src + 3);\n\t}\n      longbuff2 = *((uint32 *)swapbuff2);\n      buff3 = ((uint64)longbuff1 << 32) | longbuff2;\n      buff1 = (buff3 & matchbits) << (src_bit);\n      if (ready_bits < 32)\n        {\n        bytebuff1 = bytebuff2 = bytebuff3 = bytebuff4 = 0;\n        buff2 = (buff2 | (buff1 >> ready_bits));\n        }\n      else\n        {\n        bytebuff1 = (buff2 >> 56);\n        *dst++ = bytebuff1;\n        bytebuff2 = (buff2 >> 48);\n        *dst++ = bytebuff2;\n        bytebuff3 = (buff2 >> 40);\n        *dst++ = bytebuff3;\n        bytebuff4 = (buff2 >> 32);\n        *dst++ = bytebuff4;\n        ready_bits -= 32;\n        buff2 = ((buff2 << 32) | (buff1 >> ready_bits));\n        }\n      ready_bits += bps;\n      }\n    }\n  while (ready_bits > 0)\n    {\n    bytebuff1 = (buff2 >> 56);\n    *dst++ = bytebuff1;\n    buff2 = (buff2 << 8);\n    ready_bits -= 8;\n    }\n  return (0);\n  }']