tools/tiffcrop.c:7511: error: Null Dereference
  pointer `crop_buff` last assigned on line 7507 could be null and is dereferenced by call to `_TIFFmemset()` at line 7511, column 7.

tools/tiffcrop.c:7472:1: start of procedure createCroppedImage()
7470.  * the most optimized path when no Zones or Regions are required.
7471.  */
7472. static int
      ^
7473. createCroppedImage(struct image_data *image, struct crop_mask *crop, 
7474.                    unsigned char **read_buff_ptr, unsigned char **crop_buff_ptr)

tools/tiffcrop.c:7477:3: 
7475.   {
7476.   tsize_t   cropsize;
7477.   unsigned  char *read_buff = NULL;
        ^
7478.   unsigned  char *crop_buff = NULL;
7479.   unsigned  char *new_buff  = NULL;

tools/tiffcrop.c:7478:3: 
7476.   tsize_t   cropsize;
7477.   unsigned  char *read_buff = NULL;
7478.   unsigned  char *crop_buff = NULL;
        ^
7479.   unsigned  char *new_buff  = NULL;
7480.   static    tsize_t  prev_cropsize = 0;

tools/tiffcrop.c:7479:3: 
7477.   unsigned  char *read_buff = NULL;
7478.   unsigned  char *crop_buff = NULL;
7479.   unsigned  char *new_buff  = NULL;
        ^
7480.   static    tsize_t  prev_cropsize = 0;
7481. 

tools/tiffcrop.c:7480:3: 
7478.   unsigned  char *crop_buff = NULL;
7479.   unsigned  char *new_buff  = NULL;
7480.   static    tsize_t  prev_cropsize = 0;
        ^
7481. 
7482.   read_buff = *read_buff_ptr;

tools/tiffcrop.c:7482:3: 
7480.   static    tsize_t  prev_cropsize = 0;
7481. 
7482.   read_buff = *read_buff_ptr;
        ^
7483. 
7484.   /* process full image, no crop buffer needed */

tools/tiffcrop.c:7485:3: 
7483. 
7484.   /* process full image, no crop buffer needed */
7485.   crop_buff = read_buff;
        ^
7486.   *crop_buff_ptr = read_buff;
7487.   crop->combined_width = image->width;

tools/tiffcrop.c:7486:3: 
7484.   /* process full image, no crop buffer needed */
7485.   crop_buff = read_buff;
7486.   *crop_buff_ptr = read_buff;
        ^
7487.   crop->combined_width = image->width;
7488.   crop->combined_length = image->length;

tools/tiffcrop.c:7487:3: 
7485.   crop_buff = read_buff;
7486.   *crop_buff_ptr = read_buff;
7487.   crop->combined_width = image->width;
        ^
7488.   crop->combined_length = image->length;
7489. 

tools/tiffcrop.c:7488:3: 
7486.   *crop_buff_ptr = read_buff;
7487.   crop->combined_width = image->width;
7488.   crop->combined_length = image->length;
        ^
7489. 
7490.   cropsize = crop->bufftotal;

tools/tiffcrop.c:7490:3: 
7488.   crop->combined_length = image->length;
7489. 
7490.   cropsize = crop->bufftotal;
        ^
7491.   crop_buff = *crop_buff_ptr;
7492.   if (!crop_buff)

tools/tiffcrop.c:7491:3: 
7489. 
7490.   cropsize = crop->bufftotal;
7491.   crop_buff = *crop_buff_ptr;
        ^
7492.   if (!crop_buff)
7493.     {

tools/tiffcrop.c:7492:8: Taking false branch
7490.   cropsize = crop->bufftotal;
7491.   crop_buff = *crop_buff_ptr;
7492.   if (!crop_buff)
             ^
7493.     {
7494.     crop_buff = (unsigned char *)_TIFFmalloc(cropsize);

tools/tiffcrop.c:7501:9: Taking true branch
7499.   else
7500.     {
7501.     if (prev_cropsize < cropsize)
              ^
7502.       {
7503.       new_buff = _TIFFrealloc(crop_buff, cropsize);

tools/tiffcrop.c:7503:7: 
7501.     if (prev_cropsize < cropsize)
7502.       {
7503.       new_buff = _TIFFrealloc(crop_buff, cropsize);
            ^
7504.       if (!new_buff)
7505.         {

libtiff/tif_unix.c:272:1: start of procedure _TIFFrealloc()
  270. }
  271. 
  272. void*
       ^
  273. _TIFFrealloc(void* p, tmsize_t s)
  274. {

libtiff/tif_unix.c:275:2: 
  273. _TIFFrealloc(void* p, tmsize_t s)
  274. {
  275. 	return (realloc(p, (size_t) s));
        ^
  276. }
  277. 

libtiff/tif_unix.c:276:1: return from a call to _TIFFrealloc
  274. {
  275. 	return (realloc(p, (size_t) s));
  276. }
       ^
  277. 
  278. void

tools/tiffcrop.c:7504:12: Taking true branch
7502.       {
7503.       new_buff = _TIFFrealloc(crop_buff, cropsize);
7504.       if (!new_buff)
                 ^
7505.         {
7506. 	free (crop_buff);

tools/tiffcrop.c:7506:2: 
7504.       if (!new_buff)
7505.         {
7506. 	free (crop_buff);
       ^
7507.         crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
7508.         }

tools/tiffcrop.c:7507:9: 
7505.         {
7506. 	free (crop_buff);
7507.         crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
              ^
7508.         }
7509.       else

libtiff/tif_unix.c:257:1: start of procedure _TIFFmalloc()
  255. #endif
  256. 
  257. void*
       ^
  258. _TIFFmalloc(tmsize_t s)
  259. {

libtiff/tif_unix.c:260:13: Taking false branch
  258. _TIFFmalloc(tmsize_t s)
  259. {
  260.         if (s == 0)
                   ^
  261.                 return ((void *) NULL);
  262. 

libtiff/tif_unix.c:263:2: 
  261.                 return ((void *) NULL);
  262. 
  263. 	return (malloc((size_t) s));
        ^
  264. }
  265. 

libtiff/tif_unix.c:264:1: return from a call to _TIFFmalloc
  262. 
  263. 	return (malloc((size_t) s));
  264. }
       ^
  265. 
  266. void

tools/tiffcrop.c:7511:7: 
7509.       else
7510.         crop_buff = new_buff;
7511.       _TIFFmemset(crop_buff, 0, cropsize);
            ^
7512.       }
7513.     }

libtiff/tif_unix.c:278:1: start of procedure _TIFFmemset()
  276. }
  277. 
  278. void
       ^
  279. _TIFFmemset(void* p, int v, tmsize_t c)
  280. {

libtiff/tif_unix.c:281:2: 
  279. _TIFFmemset(void* p, int v, tmsize_t c)
  280. {
  281. 	memset(p, v, (size_t) c);
        ^
  282. }
  283. 

libtiff/tif_unix.c:282:1: return from a call to _TIFFmemset
  280. {
  281. 	memset(p, v, (size_t) c);
  282. }
       ^
  283. 
  284. void

static int
createCroppedImage(struct image_data *image, struct crop_mask *crop,
                   unsigned char **read_buff_ptr, unsigned char **crop_buff_ptr)
  {
  tsize_t   cropsize;
  unsigned  char *read_buff = NULL;
  unsigned  char *crop_buff = NULL;
  unsigned  char *new_buff  = NULL;
  static    tsize_t  prev_cropsize = 0;
  read_buff = *read_buff_ptr;
  crop_buff = read_buff;
  *crop_buff_ptr = read_buff;
  crop->combined_width = image->width;
  crop->combined_length = image->length;
  cropsize = crop->bufftotal;
  crop_buff = *crop_buff_ptr;
  if (!crop_buff)
    {
    crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
    *crop_buff_ptr = crop_buff;
    _TIFFmemset(crop_buff, 0, cropsize);
    prev_cropsize = cropsize;
    }
  else
    {
    if (prev_cropsize < cropsize)
      {
      new_buff = _TIFFrealloc(crop_buff, cropsize);
      if (!new_buff)
        {
	free (crop_buff);
        crop_buff = (unsigned char *)_TIFFmalloc(cropsize);
        }
      else
        crop_buff = new_buff;
      _TIFFmemset(crop_buff, 0, cropsize);
      }
    }
  if (!crop_buff)
    {
    TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");
    return (-1);
    }
  *crop_buff_ptr = crop_buff;
  if (crop->crop_mode & CROP_INVERT)
    {
    switch (crop->photometric)
      {
      case PHOTOMETRIC_MINISWHITE:
      case PHOTOMETRIC_MINISBLACK:
	   image->photometric = crop->photometric;
	   break;
      case INVERT_DATA_ONLY:
      case INVERT_DATA_AND_TAG:
           if (invertImage(image->photometric, image->spp, image->bps,
                           crop->combined_width, crop->combined_length, crop_buff))
             {
             TIFFError("createCroppedImage",
                       "Failed to invert colorspace for image or cropped selection");
             return (-1);
             }
           if (crop->photometric == INVERT_DATA_AND_TAG)
             {
             switch (image->photometric)
               {
               case PHOTOMETRIC_MINISWHITE:
 	            image->photometric = PHOTOMETRIC_MINISBLACK;
	            break;
               case PHOTOMETRIC_MINISBLACK:
 	            image->photometric = PHOTOMETRIC_MINISWHITE;
	            break;
               default:
	            break;
	       }
	     }
           break;
      default: break;
      }
    }
  if (crop->crop_mode & CROP_MIRROR)
    {
    if (mirrorImage(image->spp, image->bps, crop->mirror,
                    crop->combined_width, crop->combined_length, crop_buff))
      {
      TIFFError("createCroppedImage", "Failed to mirror image or cropped selection %s",
	       (crop->rotation == MIRROR_HORIZ) ? "horizontally" : "vertically");
      return (-1);
      }
    }
  if (crop->crop_mode & CROP_ROTATE)
    {
    if (rotateImage(crop->rotation, image, &crop->combined_width,
                    &crop->combined_length, crop_buff_ptr))
      {
      TIFFError("createCroppedImage",
                "Failed to rotate image or cropped selection by %d degrees", crop->rotation);
      return (-1);
      }
    }
  if (crop_buff == read_buff)
    *read_buff_ptr = NULL;
  return (0);
  }
['static int\ncreateCroppedImage(struct image_data *image, struct crop_mask *crop,\n                   unsigned char **read_buff_ptr, unsigned char **crop_buff_ptr)\n  {\n  tsize_t   cropsize;\n  unsigned  char *read_buff = NULL;\n  unsigned  char *crop_buff = NULL;\n  unsigned  char *new_buff  = NULL;\n  static    tsize_t  prev_cropsize = 0;\n  read_buff = *read_buff_ptr;\n  crop_buff = read_buff;\n  *crop_buff_ptr = read_buff;\n  crop->combined_width = image->width;\n  crop->combined_length = image->length;\n  cropsize = crop->bufftotal;\n  crop_buff = *crop_buff_ptr;\n  if (!crop_buff)\n    {\n    crop_buff = (unsigned char *)_TIFFmalloc(cropsize);\n    *crop_buff_ptr = crop_buff;\n    _TIFFmemset(crop_buff, 0, cropsize);\n    prev_cropsize = cropsize;\n    }\n  else\n    {\n    if (prev_cropsize < cropsize)\n      {\n      new_buff = _TIFFrealloc(crop_buff, cropsize);\n      if (!new_buff)\n        {\n\tfree (crop_buff);\n        crop_buff = (unsigned char *)_TIFFmalloc(cropsize);\n        }\n      else\n        crop_buff = new_buff;\n      _TIFFmemset(crop_buff, 0, cropsize);\n      }\n    }\n  if (!crop_buff)\n    {\n    TIFFError("createCroppedImage", "Unable to allocate/reallocate crop buffer");\n    return (-1);\n    }\n  *crop_buff_ptr = crop_buff;\n  if (crop->crop_mode & CROP_INVERT)\n    {\n    switch (crop->photometric)\n      {\n      case PHOTOMETRIC_MINISWHITE:\n      case PHOTOMETRIC_MINISBLACK:\n\t   image->photometric = crop->photometric;\n\t   break;\n      case INVERT_DATA_ONLY:\n      case INVERT_DATA_AND_TAG:\n           if (invertImage(image->photometric, image->spp, image->bps,\n                           crop->combined_width, crop->combined_length, crop_buff))\n             {\n             TIFFError("createCroppedImage",\n                       "Failed to invert colorspace for image or cropped selection");\n             return (-1);\n             }\n           if (crop->photometric == INVERT_DATA_AND_TAG)\n             {\n             switch (image->photometric)\n               {\n               case PHOTOMETRIC_MINISWHITE:\n \t            image->photometric = PHOTOMETRIC_MINISBLACK;\n\t            break;\n               case PHOTOMETRIC_MINISBLACK:\n \t            image->photometric = PHOTOMETRIC_MINISWHITE;\n\t            break;\n               default:\n\t            break;\n\t       }\n\t     }\n           break;\n      default: break;\n      }\n    }\n  if (crop->crop_mode & CROP_MIRROR)\n    {\n    if (mirrorImage(image->spp, image->bps, crop->mirror,\n                    crop->combined_width, crop->combined_length, crop_buff))\n      {\n      TIFFError("createCroppedImage", "Failed to mirror image or cropped selection %s",\n\t       (crop->rotation == MIRROR_HORIZ) ? "horizontally" : "vertically");\n      return (-1);\n      }\n    }\n  if (crop->crop_mode & CROP_ROTATE)\n    {\n    if (rotateImage(crop->rotation, image, &crop->combined_width,\n                    &crop->combined_length, crop_buff_ptr))\n      {\n      TIFFError("createCroppedImage",\n                "Failed to rotate image or cropped selection by %d degrees", crop->rotation);\n      return (-1);\n      }\n    }\n  if (crop_buff == read_buff)\n    *read_buff_ptr = NULL;\n  return (0);\n  }', 'void*\n_TIFFrealloc(void* p, tmsize_t s)\n{\n\treturn (realloc(p, (size_t) s));\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}', 'void\n_TIFFmemset(void* p, int v, tmsize_t c)\n{\n\tmemset(p, v, (size_t) c);\n}']