tools/tiff2ps.c:1957: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `Ascii85EncodeBlock`.

tools/tiff2ps.c:1891:2: Assignment
1889. #if defined( EXP_ASCII85ENCODER )
1890. 	tsize_t	ascii85_l;		/* Length, in bytes, of ascii85_p[] data */
1891. 	uint8	*ascii85_p = 0;		/* Holds ASCII85 encoded data */
       ^
1892. #endif
1893. 

tools/tiff2ps.c:1957:16: Call
1955. 			}
1956. 
1957. 			ascii85_l = Ascii85EncodeBlock( ascii85_p, 1, cp, cc );
                     ^
1958. 
1959. 			if ( ascii85_l > 0 )

tools/tiff2ps.c:2227:5: <Offset trace>
2225.     uint32                      val32;          /* Unencoded 4 tuple */
2226. 
2227.     ascii85_l = 0;                              /* Nothing written yet */
          ^
2228. 
2229.     if ( raw_p )

tools/tiff2ps.c:2227:5: Assignment
  2225.     uint32                      val32;          /* Unencoded 4 tuple */
  2226. 
  2227.     ascii85_l = 0;                              /* Nothing written yet */
            ^
  2228. 
  2229.     if ( raw_p )

tools/tiff2ps.c:2264:13: Assignment
  2262.             }
  2263.     
  2264.             ascii85_l += rc;
                    ^
  2265.     
  2266.             if ( (A85BREAKCNTR -= rc) <= 0 )

tools/tiff2ps.c:2219:1: <Length trace>
2217. *****************************************************************************/
2218. 
2219. tsize_t Ascii85EncodeBlock( uint8 * ascii85_p, unsigned f_eod, const uint8 * raw_p, tsize_t raw_l )
      ^
2220. 
2221. {

tools/tiff2ps.c:2219:1: Parameter `*ascii85_p`
  2217. *****************************************************************************/
  2218. 
  2219. tsize_t Ascii85EncodeBlock( uint8 * ascii85_p, unsigned f_eod, const uint8 * raw_p, tsize_t raw_l )
        ^
  2220. 
  2221. {

tools/tiff2ps.c:2268:17: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `Ascii85EncodeBlock` 
  2266.             if ( (A85BREAKCNTR -= rc) <= 0 )
  2267.             {
  2268.                 ascii85_p[ascii85_l] = '\n';
                        ^
  2269.                 ++ascii85_l;
  2270.                 A85BREAKCNTR = A85BREAKLEN;

tsize_t Ascii85EncodeBlock( uint8 * ascii85_p, unsigned f_eod, const uint8 * raw_p, tsize_t raw_l )
{
    char                        ascii85[5];
    tsize_t                     ascii85_l;
    int                         rc;
    uint32                      val32;
    ascii85_l = 0;
    if ( raw_p )
    {
        --raw_p;
        for ( ; raw_l > 3; raw_l -= 4 )
        {
            val32  = *(++raw_p) << 24;
            val32 += *(++raw_p) << 16;
            val32 += *(++raw_p) <<  8;
            val32 += *(++raw_p);
            if ( val32 == 0 )
            {
                ascii85_p[ascii85_l] = 'z';
                rc = 1;
            }
            else
            {
                ascii85[4] = (char) ((val32 % 85) + 33);
                val32 /= 85;
                ascii85[3] = (char) ((val32 % 85) + 33);
                val32 /= 85;
                ascii85[2] = (char) ((val32 % 85) + 33);
                val32 /= 85;
                ascii85[1] = (char) ((val32 % 85) + 33);
                ascii85[0] = (char) ((val32 / 85) + 33);
                _TIFFmemcpy( &ascii85_p[ascii85_l], ascii85, sizeof(ascii85) );
                rc = sizeof(ascii85);
            }
            ascii85_l += rc;
            if ( (A85BREAKCNTR -= rc) <= 0 )
            {
                ascii85_p[ascii85_l] = '\n';
                ++ascii85_l;
                A85BREAKCNTR = A85BREAKLEN;
            }
        }
        if ( raw_l > 0 )
        {
            tsize_t         len;
            len = raw_l + 1;
            val32 = *++raw_p << 24;
            if ( --raw_l > 0 )  val32 += *(++raw_p) << 16;
            if ( --raw_l > 0 )  val32 += *(++raw_p) <<  8;
            val32 /= 85;
            ascii85[3] = (char) ((val32 % 85) + 33);
            val32 /= 85;
            ascii85[2] = (char) ((val32 % 85) + 33);
            val32 /= 85;
            ascii85[1] = (char) ((val32 % 85) + 33);
            ascii85[0] = (char) ((val32 / 85) + 33);
            _TIFFmemcpy( &ascii85_p[ascii85_l], ascii85, len );
            ascii85_l += len;
        }
    }
    if ( f_eod )
    {
        ascii85_p[ascii85_l++] = '~';
        ascii85_p[ascii85_l++] = '>';
        ascii85_p[ascii85_l++] = '\n';
    }
    return ( ascii85_l );
}
['void\nPSDataBW(FILE* fd, TIFF* tif, uint32 w, uint32 h)\n{\n\tint breaklen = MAXLINE;\n\tunsigned char* tf_buf;\n\tunsigned char* cp;\n\ttsize_t stripsize = TIFFStripSize(tif);\n\ttstrip_t s;\n#if defined( EXP_ASCII85ENCODER )\n\ttsize_t\tascii85_l;\n\tuint8\t*ascii85_p = 0;\n#endif\n\t(void) w; (void) h;\n\ttf_buf = (unsigned char *) _TIFFmalloc(stripsize);\n        memset(tf_buf, 0, stripsize);\n\tif (tf_buf == NULL) {\n\t\tTIFFError(filename, "No space for scanline buffer");\n\t\treturn;\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85 ) {\n\t    ascii85_p = _TIFFmalloc( (stripsize+(stripsize/2)) + 8 );\n\t    if ( !ascii85_p ) {\n\t\t_TIFFfree( tf_buf );\n\t\tTIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );\n\t\treturn;\n\t    }\n\t}\n#endif\n\tif (ascii85)\n\t\tAscii85Init();\n\tfor (s = 0; s < TIFFNumberOfStrips(tif); s++) {\n\t\ttmsize_t cc = TIFFReadEncodedStrip(tif, s, tf_buf, stripsize);\n\t\tif (cc < 0) {\n\t\t\tTIFFError(filename, "Can\'t read strip");\n\t\t\tbreak;\n\t\t}\n\t\tcp = tf_buf;\n\t\tif (photometric == PHOTOMETRIC_MINISWHITE) {\n\t\t\tfor (cp += cc; --cp >= tf_buf;)\n\t\t\t\t*cp = ~*cp;\n\t\t\tcp++;\n\t\t}\n\t\tif (bitspersample == 16 && !HOST_BIGENDIAN) {\n\t\t\tPS_FlipBytes(cp, cc);\n\t\t}\n\t\tif (ascii85) {\n#if defined( EXP_ASCII85ENCODER )\n\t\t\tif (alpha) {\n\t\t\t\tint adjust, i;\n\t\t\t\tfor (i = 0; i < cc; i+=2) {\n\t\t\t\t\tadjust = 255 - cp[i + 1];\n\t\t\t\t    cp[i / 2] = cp[i] + adjust;\n\t\t\t\t}\n\t\t\t\tcc /= 2;\n\t\t\t}\n\t\t\tascii85_l = Ascii85EncodeBlock( ascii85_p, 1, cp, cc );\n\t\t\tif ( ascii85_l > 0 )\n\t\t\t    fwrite( ascii85_p, ascii85_l, 1, fd );\n#else\n\t\t\twhile (cc-- > 0)\n\t\t\t\tAscii85Put(*cp++, fd);\n#endif\n\t\t} else {\n\t\t\tunsigned char c;\n\t\t\tif (alpha) {\n\t\t\t\tint adjust;\n\t\t\t\twhile (cc-- > 0) {\n\t\t\t\t\tDOBREAK(breaklen, 1, fd);\n\t\t\t\t\tadjust = 255 - cp[1];\n\t\t\t\t\tc = *cp++ + adjust; PUTHEX(c,fd);\n\t\t\t\t\tcp++, cc--;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\twhile (cc-- > 0) {\n\t\t\t\t\tc = *cp++;\n\t\t\t\t\tDOBREAK(breaklen, 1, fd);\n\t\t\t\t\tPUTHEX(c, fd);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif ( !ascii85 )\n\t{\n\t    if ( level2 || level3)\n\t\tfputs(">\\n", fd);\n\t}\n#if !defined( EXP_ASCII85ENCODER )\n\telse\n\t    Ascii85Flush(fd);\n#else\n\tif ( ascii85_p )\n\t    _TIFFfree( ascii85_p );\n#endif\n\t_TIFFfree(tf_buf);\n}', "tsize_t Ascii85EncodeBlock( uint8 * ascii85_p, unsigned f_eod, const uint8 * raw_p, tsize_t raw_l )\n{\n    char                        ascii85[5];\n    tsize_t                     ascii85_l;\n    int                         rc;\n    uint32                      val32;\n    ascii85_l = 0;\n    if ( raw_p )\n    {\n        --raw_p;\n        for ( ; raw_l > 3; raw_l -= 4 )\n        {\n            val32  = *(++raw_p) << 24;\n            val32 += *(++raw_p) << 16;\n            val32 += *(++raw_p) <<  8;\n            val32 += *(++raw_p);\n            if ( val32 == 0 )\n            {\n                ascii85_p[ascii85_l] = 'z';\n                rc = 1;\n            }\n            else\n            {\n                ascii85[4] = (char) ((val32 % 85) + 33);\n                val32 /= 85;\n                ascii85[3] = (char) ((val32 % 85) + 33);\n                val32 /= 85;\n                ascii85[2] = (char) ((val32 % 85) + 33);\n                val32 /= 85;\n                ascii85[1] = (char) ((val32 % 85) + 33);\n                ascii85[0] = (char) ((val32 / 85) + 33);\n                _TIFFmemcpy( &ascii85_p[ascii85_l], ascii85, sizeof(ascii85) );\n                rc = sizeof(ascii85);\n            }\n            ascii85_l += rc;\n            if ( (A85BREAKCNTR -= rc) <= 0 )\n            {\n                ascii85_p[ascii85_l] = '\\n';\n                ++ascii85_l;\n                A85BREAKCNTR = A85BREAKLEN;\n            }\n        }\n        if ( raw_l > 0 )\n        {\n            tsize_t         len;\n            len = raw_l + 1;\n            val32 = *++raw_p << 24;\n            if ( --raw_l > 0 )  val32 += *(++raw_p) << 16;\n            if ( --raw_l > 0 )  val32 += *(++raw_p) <<  8;\n            val32 /= 85;\n            ascii85[3] = (char) ((val32 % 85) + 33);\n            val32 /= 85;\n            ascii85[2] = (char) ((val32 % 85) + 33);\n            val32 /= 85;\n            ascii85[1] = (char) ((val32 % 85) + 33);\n            ascii85[0] = (char) ((val32 / 85) + 33);\n            _TIFFmemcpy( &ascii85_p[ascii85_l], ascii85, len );\n            ascii85_l += len;\n        }\n    }\n    if ( f_eod )\n    {\n        ascii85_p[ascii85_l++] = '~';\n        ascii85_p[ascii85_l++] = '>';\n        ascii85_p[ascii85_l++] = '\\n';\n    }\n    return ( ascii85_l );\n}"]