libtiff/tif_fax3.c:512: error: Integer Overflow L2
  (2 × [0, 8589934528]):unsigned32.

libtiff/tif_fax3.c:508:10: <RHS trace>
506. 
507. 	/* TIFFroundup_32 returns zero on internal overflow */
508. 	nruns = TIFFroundup_32(rowpixels,32);
              ^
509. 	if (needsRefLine) {
510. 		nruns *= 2;

libtiff/tif_fax3.c:508:10: Assignment
506. 
507. 	/* TIFFroundup_32 returns zero on internal overflow */
508. 	nruns = TIFFroundup_32(rowpixels,32);
              ^
509. 	if (needsRefLine) {
510. 		nruns *= 2;

libtiff/tif_fax3.c:508:2: Assignment
506. 
507. 	/* TIFFroundup_32 returns zero on internal overflow */
508. 	nruns = TIFFroundup_32(rowpixels,32);
      ^
509. 	if (needsRefLine) {
510. 		nruns *= 2;

libtiff/tif_fax3.c:512:24: Binary operation: (2 × [0, 8589934528]):unsigned32
510. 		nruns *= 2;
511. 	}
512. 	dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32),
                            ^
513. 					  "for Group 3/4 run arrays");
514. 	if (dsp->runs == NULL)

static int
Fax3SetupState(TIFF* tif)
{
	static const char module[] = "Fax3SetupState";
	TIFFDirectory* td = &tif->tif_dir;
	Fax3BaseState* sp = Fax3State(tif);
	int needsRefLine;
	Fax3CodecState* dsp = (Fax3CodecState*) Fax3State(tif);
	tmsize_t rowbytes;
	uint32 rowpixels, nruns;
	if (td->td_bitspersample != 1) {
		TIFFErrorExt(tif->tif_clientdata, module,
		    "Bits/sample must be 1 for Group 3/4 encoding/decoding");
		return (0);
	}
	if (isTiled(tif)) {
		rowbytes = TIFFTileRowSize(tif);
		rowpixels = td->td_tilewidth;
	} else {
		rowbytes = TIFFScanlineSize(tif);
		rowpixels = td->td_imagewidth;
	}
	sp->rowbytes = rowbytes;
	sp->rowpixels = rowpixels;
	needsRefLine = (
	    (sp->groupoptions & GROUP3OPT_2DENCODING) ||
	    td->td_compression == COMPRESSION_CCITTFAX4
	);
	nruns = TIFFroundup_32(rowpixels,32);
	if (needsRefLine) {
		nruns *= 2;
	}
	dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32),
					  "for Group 3/4 run arrays");
	if (dsp->runs == NULL)
		return (0);
	dsp->curruns = dsp->runs;
	if (needsRefLine)
		dsp->refruns = dsp->runs + nruns;
	else
		dsp->refruns = NULL;
	if (td->td_compression == COMPRESSION_CCITTFAX3
	    && is2DEncoding(dsp)) {
		tif->tif_decoderow = Fax3Decode2D;
		tif->tif_decodestrip = Fax3Decode2D;
		tif->tif_decodetile = Fax3Decode2D;
	}
	if (needsRefLine) {
		Fax3CodecState* esp = EncoderState(tif);
		esp->refline = (unsigned char*) _TIFFmalloc(rowbytes);
		if (esp->refline == NULL) {
			TIFFErrorExt(tif->tif_clientdata, module,
			    "No space for Group 3/4 reference line");
			return (0);
		}
	} else
		EncoderState(tif)->refline = NULL;
	return (1);
}
['static int\nFax3SetupState(TIFF* tif)\n{\n\tstatic const char module[] = "Fax3SetupState";\n\tTIFFDirectory* td = &tif->tif_dir;\n\tFax3BaseState* sp = Fax3State(tif);\n\tint needsRefLine;\n\tFax3CodecState* dsp = (Fax3CodecState*) Fax3State(tif);\n\ttmsize_t rowbytes;\n\tuint32 rowpixels, nruns;\n\tif (td->td_bitspersample != 1) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "Bits/sample must be 1 for Group 3/4 encoding/decoding");\n\t\treturn (0);\n\t}\n\tif (isTiled(tif)) {\n\t\trowbytes = TIFFTileRowSize(tif);\n\t\trowpixels = td->td_tilewidth;\n\t} else {\n\t\trowbytes = TIFFScanlineSize(tif);\n\t\trowpixels = td->td_imagewidth;\n\t}\n\tsp->rowbytes = rowbytes;\n\tsp->rowpixels = rowpixels;\n\tneedsRefLine = (\n\t    (sp->groupoptions & GROUP3OPT_2DENCODING) ||\n\t    td->td_compression == COMPRESSION_CCITTFAX4\n\t);\n\tnruns = TIFFroundup_32(rowpixels,32);\n\tif (needsRefLine) {\n\t\tnruns *= 2;\n\t}\n\tdsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32),\n\t\t\t\t\t  "for Group 3/4 run arrays");\n\tif (dsp->runs == NULL)\n\t\treturn (0);\n\tdsp->curruns = dsp->runs;\n\tif (needsRefLine)\n\t\tdsp->refruns = dsp->runs + nruns;\n\telse\n\t\tdsp->refruns = NULL;\n\tif (td->td_compression == COMPRESSION_CCITTFAX3\n\t    && is2DEncoding(dsp)) {\n\t\ttif->tif_decoderow = Fax3Decode2D;\n\t\ttif->tif_decodestrip = Fax3Decode2D;\n\t\ttif->tif_decodetile = Fax3Decode2D;\n\t}\n\tif (needsRefLine) {\n\t\tFax3CodecState* esp = EncoderState(tif);\n\t\tesp->refline = (unsigned char*) _TIFFmalloc(rowbytes);\n\t\tif (esp->refline == NULL) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "No space for Group 3/4 reference line");\n\t\t\treturn (0);\n\t\t}\n\t} else\n\t\tEncoderState(tif)->refline = NULL;\n\treturn (1);\n}']