tools/tiff2ps.c:1509: error: Integer Overflow L2
  ([0, max(0, `tif->tif_dir.td_tilelength`)] - 1):unsigned32 by call to `TIFFReadEncodedTile`.

tools/tiff2ps.c:1419:1: Parameter `tif->tif_dir.td_tilelength`
1417. #define MAXLINE		36
1418. 
1419. int
      ^
1420. PS_Lvl2page(FILE* fd, TIFF* tif, uint32 w, uint32 h)
1421. {

tools/tiff2ps.c:1509:18: Call
1507. 		} else {
1508. 			if (tiled_image)
1509. 				byte_count = TIFFReadEncodedTile(tif,
                       ^
1510. 						chunk_no, buf_data,
1511. 						chunk_size);

libtiff/tif_read.c:428:1: Parameter `tif->tif_dir.td_tilelength`
  426.  * amount into the user-supplied buffer.
  427.  */
  428. tmsize_t
       ^
  429. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  430. {

libtiff/tif_read.c:447:6: Call
  445. 	else if (size > tilesize)
  446. 		size = tilesize;
  447. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
            ^
  448. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
  449. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:568:1: Parameter `tif->tif_dir.td_tilelength`
    566.  * expanded, as necessary, to hold the tile's data.
    567.  */
    568. int
         ^
    569. TIFFFillTile(TIFF* tif, uint32 tile)
    570. {

libtiff/tif_read.c:657:10: Call
    655. 		}
    656. 	}
    657. 	return (TIFFStartTile(tif, tile));
                  ^
    658. }
    659. 

libtiff/tif_read.c:737:1: <LHS trace>
735.  * tile has just been read in.
736.  */
737. static int
     ^
738. TIFFStartTile(TIFF* tif, uint32 tile)
739. {

libtiff/tif_read.c:737:1: Parameter `tif->tif_dir.td_tilelength`
      735.  * tile has just been read in.
      736.  */
      737. static int
           ^
      738. TIFFStartTile(TIFF* tif, uint32 tile)
      739. {

libtiff/tif_read.c:751:2: Binary operation: ([0, max(0, tif->tif_dir.td_tilelength)] - 1):unsigned32 by call to `TIFFReadEncodedTile` 
      749. 	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
      750. 		td->td_tilelength;
      751. 	tif->tif_col =
            ^
      752. 	    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
      753. 		td->td_tilewidth;

static int
TIFFStartTile(TIFF* tif, uint32 tile)
{
	TIFFDirectory *td = &tif->tif_dir;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupdecode)(tif))
			return (0);
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_curtile = tile;
	tif->tif_row =
	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
		td->td_tilelength;
	tif->tif_col =
	    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
		td->td_tilewidth;
        tif->tif_flags &= ~TIFF_BUF4WRITE;
	if (tif->tif_flags&TIFF_NOREADRAW)
	{
		tif->tif_rawcp = NULL;
		tif->tif_rawcc = 0;
	}
	else
	{
		tif->tif_rawcp = tif->tif_rawdata;
		tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
	}
	return ((*tif->tif_predecode)(tif,
			(uint16)(tile/td->td_stripsperimage)));
}
['int\nPS_Lvl2page(FILE* fd, TIFF* tif, uint32 w, uint32 h)\n{\n\tuint16 fillorder;\n\tint use_rawdata, tiled_image, breaklen = MAXLINE;\n\tuint32 chunk_no, num_chunks;\n        uint64 *bc;\n\tunsigned char *buf_data, *cp;\n\ttsize_t chunk_size, byte_count;\n#if defined( EXP_ASCII85ENCODER )\n\ttsize_t\t\t\tascii85_l;\n\tuint8\t\t*\tascii85_p = 0;\n#endif\n\tPS_Lvl2colorspace(fd, tif);\n\tuse_rawdata = PS_Lvl2ImageDict(fd, tif, w, h);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%BeginData:\\n", fd);\n#endif\n\tfputs("exec\\n", fd);\n\ttiled_image = TIFFIsTiled(tif);\n\tif (tiled_image) {\n\t\tnum_chunks = TIFFNumberOfTiles(tif);\n\t\tTIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc);\n\t} else {\n\t\tnum_chunks = TIFFNumberOfStrips(tif);\n\t\tTIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);\n\t}\n\tif (use_rawdata) {\n\t\tchunk_size = (tsize_t) bc[0];\n\t\tfor (chunk_no = 1; chunk_no < num_chunks; chunk_no++)\n\t\t\tif ((tsize_t) bc[chunk_no] > chunk_size)\n\t\t\t\tchunk_size = (tsize_t) bc[chunk_no];\n\t} else {\n\t\tif (tiled_image)\n\t\t\tchunk_size = TIFFTileSize(tif);\n\t\telse\n\t\t\tchunk_size = TIFFStripSize(tif);\n\t}\n\tbuf_data = (unsigned char *)_TIFFmalloc(chunk_size);\n\tif (!buf_data) {\n\t\tTIFFError(filename, "Can\'t alloc %lu bytes for %s.",\n\t\t\t(unsigned long) chunk_size, tiled_image ? "tiles" : "strips");\n\t\treturn(FALSE);\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85 ) {\n\t    ascii85_p = _TIFFmalloc( (chunk_size+(chunk_size/2)) + 8 );\n\t    if ( !ascii85_p ) {\n\t\t_TIFFfree( buf_data );\n\t\tTIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );\n\t\treturn ( FALSE );\n\t    }\n\t}\n#endif\n\tTIFFGetFieldDefaulted(tif, TIFFTAG_FILLORDER, &fillorder);\n\tfor (chunk_no = 0; chunk_no < num_chunks; chunk_no++) {\n\t\tif (ascii85)\n\t\t\tAscii85Init();\n\t\telse\n\t\t\tbreaklen = MAXLINE;\n\t\tif (use_rawdata) {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadRawTile(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadRawStrip(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\tif (fillorder == FILLORDER_LSB2MSB)\n\t\t\t    TIFFReverseBits(buf_data, byte_count);\n\t\t} else {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadEncodedTile(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadEncodedStrip(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t}\n\t\tif (byte_count < 0) {\n\t\t\tTIFFError(filename, "Can\'t read %s %d.",\n\t\t\t\ttiled_image ? "tile" : "strip", chunk_no);\n\t\t\tif (ascii85)\n\t\t\t\tAscii85Put(\'\\0\', fd);\n\t\t}\n\t\tif (bitspersample == 16 && !TIFFIsBigEndian(tif)) {\n\t\t\tPS_FlipBytes(buf_data, byte_count);\n\t\t}\n\t\tif (alpha) {\n\t\t\tint adjust, i, j = 0;\n\t\t\tint ncomps = samplesperpixel - extrasamples;\n\t\t\tfor (i = 0; i < byte_count; i+=samplesperpixel) {\n\t\t\t\tadjust = 255 - buf_data[i + ncomps];\n\t\t\t\tswitch (ncomps) {\n\t\t\t\t\tcase 1:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 2:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 3:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+2] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbyte_count -= j;\n\t\t}\n\t\tif (ascii85) {\n#if defined( EXP_ASCII85ENCODER )\n\t\t\tascii85_l = Ascii85EncodeBlock(ascii85_p, 1, buf_data, byte_count );\n\t\t\tif ( ascii85_l > 0 )\n\t\t\t\tfwrite( ascii85_p, ascii85_l, 1, fd );\n#else\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--)\n\t\t\t\tAscii85Put(*cp++, fd);\n#endif\n\t\t}\n\t\telse\n\t\t{\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--) {\n\t\t\t\tputc(hex[((*cp)>>4)&0xf], fd);\n\t\t\t\tputc(hex[(*cp)&0xf], fd);\n\t\t\t\tcp++;\n\t\t\t\tif (--breaklen <= 0) {\n\t\t\t\t\tputc(\'\\n\', fd);\n\t\t\t\t\tbreaklen = MAXLINE;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif ( !ascii85 ) {\n\t\t\tif ( level2 || level3 )\n\t\t\t\tputc( \'>\', fd );\n\t\t\tputc(\'\\n\', fd);\n\t\t}\n#if !defined( EXP_ASCII85ENCODER )\n\t\telse\n\t\t\tAscii85Flush(fd);\n#endif\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85_p )\n\t    _TIFFfree( ascii85_p );\n#endif\n\t_TIFFfree(buf_data);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%EndData\\n", fd);\n#endif\n\treturn(TRUE);\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif (bytecount <= 0) {\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\treturn (0);\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata, bytecountm);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'static int\nTIFFStartTile(TIFF* tif, uint32 tile)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupdecode)(tif))\n\t\t\treturn (0);\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_curtile = tile;\n\ttif->tif_row =\n\t    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *\n\t\ttd->td_tilelength;\n\ttif->tif_col =\n\t    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *\n\t\ttd->td_tilewidth;\n        tif->tif_flags &= ~TIFF_BUF4WRITE;\n\tif (tif->tif_flags&TIFF_NOREADRAW)\n\t{\n\t\ttif->tif_rawcp = NULL;\n\t\ttif->tif_rawcc = 0;\n\t}\n\telse\n\t{\n\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\ttif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];\n\t}\n\treturn ((*tif->tif_predecode)(tif,\n\t\t\t(uint16)(tile/td->td_stripsperimage)));\n}']