tools/tiff2ps.c:1528: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `PS_FlipBytes`.

tools/tiff2ps.c:1509:18: Call
1507. 		} else {
1508. 			if (tiled_image)
1509. 				byte_count = TIFFReadEncodedTile(tif,
                       ^
1510. 						chunk_no, buf_data,
1511. 						chunk_size);

libtiff/tif_read.c:436:3: Assignment
  434. 
  435. 	if (!TIFFCheckRead(tif, 1))
  436. 		return ((tmsize_t)(-1));
         ^
  437. 	if (tile >= td->td_nstrips) {
  438. 		TIFFErrorExt(tif->tif_clientdata, module,

tools/tiff2ps.c:1509:5: Assignment
1507. 		} else {
1508. 			if (tiled_image)
1509. 				byte_count = TIFFReadEncodedTile(tif,
          ^
1510. 						chunk_no, buf_data,
1511. 						chunk_size);

tools/tiff2ps.c:1528:4: Call
1526. 		 */
1527. 		if (bitspersample == 16 && !TIFFIsBigEndian(tif)) {
1528. 			PS_FlipBytes(buf_data, byte_count);
         ^
1529. 		}
1530. 		/*

tools/tiff2ps.c:1410:7: <Offset trace>
1408. 	count--;
1409. 
1410. 	for (i = 0; i < count; i += 2) {
            ^
1411. 		temp = buf[i];
1412. 		buf[i] = buf[i + 1];

tools/tiff2ps.c:1410:7: Assignment
  1408. 	count--;
  1409. 
  1410. 	for (i = 0; i < count; i += 2) {
              ^
  1411. 		temp = buf[i];
  1412. 		buf[i] = buf[i + 1];

tools/tiff2ps.c:1398:1: <Length trace>
1396. 
1397. /* Flip the byte order of buffers with 16 bit samples */
1398. static void
      ^
1399. PS_FlipBytes(unsigned char* buf, tsize_t count)
1400. {

tools/tiff2ps.c:1398:1: Parameter `*buf`
  1396. 
  1397. /* Flip the byte order of buffers with 16 bit samples */
  1398. static void
        ^
  1399. PS_FlipBytes(unsigned char* buf, tsize_t count)
  1400. {

tools/tiff2ps.c:1412:12: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `PS_FlipBytes` 
  1410. 	for (i = 0; i < count; i += 2) {
  1411. 		temp = buf[i];
  1412. 		buf[i] = buf[i + 1];
                   ^
  1413. 		buf[i + 1] = temp;
  1414. 	}

static void
PS_FlipBytes(unsigned char* buf, tsize_t count)
{
	int i;
	unsigned char temp;
	if (count <= 0 || bitspersample <= 8) {
		return;
	}
	count--;
	for (i = 0; i < count; i += 2) {
		temp = buf[i];
		buf[i] = buf[i + 1];
		buf[i + 1] = temp;
	}
}
['int\nPS_Lvl2page(FILE* fd, TIFF* tif, uint32 w, uint32 h)\n{\n\tuint16 fillorder;\n\tint use_rawdata, tiled_image, breaklen = MAXLINE;\n\tuint32 chunk_no, num_chunks;\n        uint64 *bc;\n\tunsigned char *buf_data, *cp;\n\ttsize_t chunk_size, byte_count;\n#if defined( EXP_ASCII85ENCODER )\n\ttsize_t\t\t\tascii85_l;\n\tuint8\t\t*\tascii85_p = 0;\n#endif\n\tPS_Lvl2colorspace(fd, tif);\n\tuse_rawdata = PS_Lvl2ImageDict(fd, tif, w, h);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%BeginData:\\n", fd);\n#endif\n\tfputs("exec\\n", fd);\n\ttiled_image = TIFFIsTiled(tif);\n\tif (tiled_image) {\n\t\tnum_chunks = TIFFNumberOfTiles(tif);\n\t\tTIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc);\n\t} else {\n\t\tnum_chunks = TIFFNumberOfStrips(tif);\n\t\tTIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);\n\t}\n\tif (use_rawdata) {\n\t\tchunk_size = (tsize_t) bc[0];\n\t\tfor (chunk_no = 1; chunk_no < num_chunks; chunk_no++)\n\t\t\tif ((tsize_t) bc[chunk_no] > chunk_size)\n\t\t\t\tchunk_size = (tsize_t) bc[chunk_no];\n\t} else {\n\t\tif (tiled_image)\n\t\t\tchunk_size = TIFFTileSize(tif);\n\t\telse\n\t\t\tchunk_size = TIFFStripSize(tif);\n\t}\n\tbuf_data = (unsigned char *)_TIFFmalloc(chunk_size);\n\tif (!buf_data) {\n\t\tTIFFError(filename, "Can\'t alloc %lu bytes for %s.",\n\t\t\t(unsigned long) chunk_size, tiled_image ? "tiles" : "strips");\n\t\treturn(FALSE);\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85 ) {\n\t    ascii85_p = _TIFFmalloc( (chunk_size+(chunk_size/2)) + 8 );\n\t    if ( !ascii85_p ) {\n\t\t_TIFFfree( buf_data );\n\t\tTIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );\n\t\treturn ( FALSE );\n\t    }\n\t}\n#endif\n\tTIFFGetFieldDefaulted(tif, TIFFTAG_FILLORDER, &fillorder);\n\tfor (chunk_no = 0; chunk_no < num_chunks; chunk_no++) {\n\t\tif (ascii85)\n\t\t\tAscii85Init();\n\t\telse\n\t\t\tbreaklen = MAXLINE;\n\t\tif (use_rawdata) {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadRawTile(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadRawStrip(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\tif (fillorder == FILLORDER_LSB2MSB)\n\t\t\t    TIFFReverseBits(buf_data, byte_count);\n\t\t} else {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadEncodedTile(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadEncodedStrip(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t}\n\t\tif (byte_count < 0) {\n\t\t\tTIFFError(filename, "Can\'t read %s %d.",\n\t\t\t\ttiled_image ? "tile" : "strip", chunk_no);\n\t\t\tif (ascii85)\n\t\t\t\tAscii85Put(\'\\0\', fd);\n\t\t}\n\t\tif (bitspersample == 16 && !TIFFIsBigEndian(tif)) {\n\t\t\tPS_FlipBytes(buf_data, byte_count);\n\t\t}\n\t\tif (alpha) {\n\t\t\tint adjust, i, j = 0;\n\t\t\tint ncomps = samplesperpixel - extrasamples;\n\t\t\tfor (i = 0; i < byte_count; i+=samplesperpixel) {\n\t\t\t\tadjust = 255 - buf_data[i + ncomps];\n\t\t\t\tswitch (ncomps) {\n\t\t\t\t\tcase 1:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 2:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 3:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+2] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbyte_count -= j;\n\t\t}\n\t\tif (ascii85) {\n#if defined( EXP_ASCII85ENCODER )\n\t\t\tascii85_l = Ascii85EncodeBlock(ascii85_p, 1, buf_data, byte_count );\n\t\t\tif ( ascii85_l > 0 )\n\t\t\t\tfwrite( ascii85_p, ascii85_l, 1, fd );\n#else\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--)\n\t\t\t\tAscii85Put(*cp++, fd);\n#endif\n\t\t}\n\t\telse\n\t\t{\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--) {\n\t\t\t\tputc(hex[((*cp)>>4)&0xf], fd);\n\t\t\t\tputc(hex[(*cp)&0xf], fd);\n\t\t\t\tcp++;\n\t\t\t\tif (--breaklen <= 0) {\n\t\t\t\t\tputc(\'\\n\', fd);\n\t\t\t\t\tbreaklen = MAXLINE;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif ( !ascii85 ) {\n\t\t\tif ( level2 || level3 )\n\t\t\t\tputc( \'>\', fd );\n\t\t\tputc(\'\\n\', fd);\n\t\t}\n#if !defined( EXP_ASCII85ENCODER )\n\t\telse\n\t\t\tAscii85Flush(fd);\n#endif\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85_p )\n\t    _TIFFfree( ascii85_p );\n#endif\n\t_TIFFfree(buf_data);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%EndData\\n", fd);\n#endif\n\treturn(TRUE);\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'static void\nPS_FlipBytes(unsigned char* buf, tsize_t count)\n{\n\tint i;\n\tunsigned char temp;\n\tif (count <= 0 || bitspersample <= 8) {\n\t\treturn;\n\t}\n\tcount--;\n\tfor (i = 0; i < count; i += 2) {\n\t\ttemp = buf[i];\n\t\tbuf[i] = buf[i + 1];\n\t\tbuf[i + 1] = temp;\n\t}\n}']