tools/tiff2pdf.c:1103: error: Buffer Overrun S2
  Offset: `t2p->tiff_pagecount` Size: [0, 1048544].

tools/tiff2pdf.c:1045:1: <Offset trace>
1043. */
1044. 
1045. void t2p_read_tiff_init(T2P* t2p, TIFF* input){
      ^
1046. 
1047. 	tdir_t directorycount=0;

tools/tiff2pdf.c:1045:1: Parameter `t2p->tiff_pagecount`
1043. */
1044. 
1045. void t2p_read_tiff_init(T2P* t2p, TIFF* input){
      ^
1046. 
1047. 	tdir_t directorycount=0;

tools/tiff2pdf.c:1064:44: <Length trace>
1062. 		return;
1063. 	}
1064. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
                                                 ^
1065. 	if(t2p->tiff_pages==NULL){
1066. 		TIFFError(

tools/tiff2pdf.c:1064:44: Assignment
1062. 		return;
1063. 	}
1064. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
                                                 ^
1065. 	if(t2p->tiff_pages==NULL){
1066. 		TIFFError(

tools/tiff2pdf.c:1064:32: Call
1062. 		return;
1063. 	}
1064. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
                                     ^
1065. 	if(t2p->tiff_pages==NULL){
1066. 		TIFFError(

libtiff/tif_unix.c:312:17: Assignment
  310. {
  311.         if (s == 0)
  312.                 return ((void *) NULL);
                       ^
  313. 
  314. 	return (malloc((size_t) s));

tools/tiff2pdf.c:1064:2: Assignment
1062. 		return;
1063. 	}
1064. 	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
       ^
1065. 	if(t2p->tiff_pages==NULL){
1066. 		TIFFError(

tools/tiff2pdf.c:1103:5: Array access: Offset: t2p->tiff_pagecount Size: [0, 1048544]
1101. 					paged;
1102. 			} else {
1103. 				t2p->tiff_pages[t2p->tiff_pagecount].page_number = 
          ^
1104. 					pagen;
1105. 			}

void t2p_read_tiff_init(T2P* t2p, TIFF* input){
	tdir_t directorycount=0;
	tdir_t i=0;
	uint16 pagen=0;
	uint16 paged=0;
	uint16 xuint16=0;
	uint16 tiff_transferfunctioncount=0;
	uint16* tiff_transferfunction[3];
	directorycount=TIFFNumberOfDirectories(input);
	if(directorycount > TIFF_DIR_MAX) {
		TIFFError(
			TIFF2PDF_MODULE,
			"TIFF contains too many directories, %s",
			TIFFFileName(input));
		t2p->t2p_error = T2P_ERR_ERROR;
		return;
	}
	t2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));
	if(t2p->tiff_pages==NULL){
		TIFFError(
			TIFF2PDF_MODULE,
			"Can't allocate " TIFF_SIZE_FORMAT " bytes of memory for tiff_pages array, %s",
			(TIFF_SIZE_T) directorycount * sizeof(T2P_PAGE),
			TIFFFileName(input));
		t2p->t2p_error = T2P_ERR_ERROR;
		return;
	}
	_TIFFmemset( t2p->tiff_pages, 0x00, directorycount * sizeof(T2P_PAGE));
	t2p->tiff_tiles = (T2P_TILES*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_TILES)));
	if(t2p->tiff_tiles==NULL){
		TIFFError(
			TIFF2PDF_MODULE,
			"Can't allocate " TIFF_SIZE_FORMAT " bytes of memory for tiff_tiles array, %s",
			(TIFF_SIZE_T) directorycount * sizeof(T2P_TILES),
			TIFFFileName(input));
		t2p->t2p_error = T2P_ERR_ERROR;
		return;
	}
	_TIFFmemset( t2p->tiff_tiles, 0x00, directorycount * sizeof(T2P_TILES));
	for(i=0;i<directorycount;i++){
		uint32 subfiletype = 0;
		if(!TIFFSetDirectory(input, i)){
			TIFFError(
				TIFF2PDF_MODULE,
				"Can't set directory %u of input file %s",
				i,
				TIFFFileName(input));
			t2p->t2p_error = T2P_ERR_ERROR;
			return;
		}
		if(TIFFGetField(input, TIFFTAG_PAGENUMBER, &pagen, &paged)){
			if((pagen>paged) && (paged != 0)){
				t2p->tiff_pages[t2p->tiff_pagecount].page_number =
					paged;
			} else {
				t2p->tiff_pages[t2p->tiff_pagecount].page_number =
					pagen;
			}
			goto ispage2;
		}
		if(TIFFGetField(input, TIFFTAG_SUBFILETYPE, &subfiletype)){
			if ( ((subfiletype & FILETYPE_PAGE) != 0)
                             || (subfiletype == 0)){
				goto ispage;
			} else {
				goto isnotpage;
			}
		}
		if(TIFFGetField(input, TIFFTAG_OSUBFILETYPE, &subfiletype)){
			if ((subfiletype == OFILETYPE_IMAGE)
				|| (subfiletype == OFILETYPE_PAGE)
				|| (subfiletype == 0) ){
				goto ispage;
			} else {
				goto isnotpage;
			}
		}
		ispage:
		t2p->tiff_pages[t2p->tiff_pagecount].page_number=t2p->tiff_pagecount;
		ispage2:
		t2p->tiff_pages[t2p->tiff_pagecount].page_directory=i;
		if(TIFFIsTiled(input)){
			t2p->tiff_pages[t2p->tiff_pagecount].page_tilecount =
				TIFFNumberOfTiles(input);
		}
		t2p->tiff_pagecount++;
		isnotpage:
		(void)0;
	}
	qsort((void*) t2p->tiff_pages, t2p->tiff_pagecount,
              sizeof(T2P_PAGE), t2p_cmp_t2p_page);
	for(i=0;i<t2p->tiff_pagecount;i++){
		t2p->pdf_xrefcount += 5;
		TIFFSetDirectory(input, t2p->tiff_pages[i].page_directory );
		if((TIFFGetField(input, TIFFTAG_PHOTOMETRIC, &xuint16)
                    && (xuint16==PHOTOMETRIC_PALETTE))
		   || TIFFGetField(input, TIFFTAG_INDEXED, &xuint16)) {
			t2p->tiff_pages[i].page_extra++;
			t2p->pdf_xrefcount++;
		}
#ifdef ZIP_SUPPORT
		if (TIFFGetField(input, TIFFTAG_COMPRESSION, &xuint16)) {
                        if( (xuint16== COMPRESSION_DEFLATE ||
                             xuint16== COMPRESSION_ADOBE_DEFLATE) &&
                            ((t2p->tiff_pages[i].page_tilecount != 0)
                             || TIFFNumberOfStrips(input)==1) &&
                            (t2p->pdf_nopassthrough==0)	){
                                if(t2p->pdf_minorversion<2){t2p->pdf_minorversion=2;}
                        }
                }
#endif
		if (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,
                                 &(tiff_transferfunction[0]),
                                 &(tiff_transferfunction[1]),
                                 &(tiff_transferfunction[2]))) {
                        if((tiff_transferfunction[1] != (uint16*) NULL) &&
                           (tiff_transferfunction[2] != (uint16*) NULL)
                          ) {
                            tiff_transferfunctioncount=3;
                        } else {
                            tiff_transferfunctioncount=1;
                        }
                } else {
			tiff_transferfunctioncount=0;
		}
                if (i > 0){
                    if (tiff_transferfunctioncount != t2p->tiff_transferfunctioncount){
                        TIFFError(
                            TIFF2PDF_MODULE,
                            "Different transfer function on page %d",
                            i);
                        t2p->t2p_error = T2P_ERR_ERROR;
                        return;
                    }
                }
                t2p->tiff_transferfunctioncount = tiff_transferfunctioncount;
                t2p->tiff_transferfunction[0] = tiff_transferfunction[0];
                t2p->tiff_transferfunction[1] = tiff_transferfunction[1];
                t2p->tiff_transferfunction[2] = tiff_transferfunction[2];
                if(tiff_transferfunctioncount == 3){
                        t2p->tiff_pages[i].page_extra += 4;
                        t2p->pdf_xrefcount += 4;
                        if(t2p->pdf_minorversion < 2)
                                t2p->pdf_minorversion = 2;
                } else if (tiff_transferfunctioncount == 1){
                        t2p->tiff_pages[i].page_extra += 2;
                        t2p->pdf_xrefcount += 2;
                        if(t2p->pdf_minorversion < 2)
                                t2p->pdf_minorversion = 2;
                }
		if( TIFFGetField(
			input,
			TIFFTAG_ICCPROFILE,
			&(t2p->tiff_iccprofilelength),
			&(t2p->tiff_iccprofile)) != 0){
			t2p->tiff_pages[i].page_extra++;
			t2p->pdf_xrefcount++;
			if(t2p->pdf_minorversion<3){t2p->pdf_minorversion=3;}
		}
		t2p->tiff_tiles[i].tiles_tilecount=
			t2p->tiff_pages[i].page_tilecount;
		if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)
			&& (xuint16 == PLANARCONFIG_SEPARATE ) ){
				if( !TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16) )
				{
					TIFFError(
                        TIFF2PDF_MODULE,
                        "Missing SamplesPerPixel, %s",
                        TIFFFileName(input));
                    t2p->t2p_error = T2P_ERR_ERROR;
                    return;
				}
                if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )
                {
                    TIFFError(
                        TIFF2PDF_MODULE,
                        "Invalid tile count, %s",
                        TIFFFileName(input));
                    t2p->t2p_error = T2P_ERR_ERROR;
                    return;
                }
				t2p->tiff_tiles[i].tiles_tilecount/= xuint16;
		}
		if( t2p->tiff_tiles[i].tiles_tilecount > 0){
			t2p->pdf_xrefcount +=
				(t2p->tiff_tiles[i].tiles_tilecount -1)*2;
			TIFFGetField(input,
				TIFFTAG_TILEWIDTH,
				&( t2p->tiff_tiles[i].tiles_tilewidth) );
			TIFFGetField(input,
				TIFFTAG_TILELENGTH,
				&( t2p->tiff_tiles[i].tiles_tilelength) );
			t2p->tiff_tiles[i].tiles_tiles =
			(T2P_TILE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,t2p->tiff_tiles[i].tiles_tilecount,
                                                                 sizeof(T2P_TILE)) );
			if( t2p->tiff_tiles[i].tiles_tiles == NULL){
				TIFFError(
					TIFF2PDF_MODULE,
					"Can't allocate " TIFF_SIZE_FORMAT " bytes of memory for t2p_read_tiff_init, %s",
					(TIFF_SIZE_T) t2p->tiff_tiles[i].tiles_tilecount * sizeof(T2P_TILE),
					TIFFFileName(input));
				t2p->t2p_error = T2P_ERR_ERROR;
				return;
			}
		}
	}
	return;
}
['void t2p_read_tiff_init(T2P* t2p, TIFF* input){\n\ttdir_t directorycount=0;\n\ttdir_t i=0;\n\tuint16 pagen=0;\n\tuint16 paged=0;\n\tuint16 xuint16=0;\n\tuint16 tiff_transferfunctioncount=0;\n\tuint16* tiff_transferfunction[3];\n\tdirectorycount=TIFFNumberOfDirectories(input);\n\tif(directorycount > TIFF_DIR_MAX) {\n\t\tTIFFError(\n\t\t\tTIFF2PDF_MODULE,\n\t\t\t"TIFF contains too many directories, %s",\n\t\t\tTIFFFileName(input));\n\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\treturn;\n\t}\n\tt2p->tiff_pages = (T2P_PAGE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_PAGE)));\n\tif(t2p->tiff_pages==NULL){\n\t\tTIFFError(\n\t\t\tTIFF2PDF_MODULE,\n\t\t\t"Can\'t allocate " TIFF_SIZE_FORMAT " bytes of memory for tiff_pages array, %s",\n\t\t\t(TIFF_SIZE_T) directorycount * sizeof(T2P_PAGE),\n\t\t\tTIFFFileName(input));\n\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\treturn;\n\t}\n\t_TIFFmemset( t2p->tiff_pages, 0x00, directorycount * sizeof(T2P_PAGE));\n\tt2p->tiff_tiles = (T2P_TILES*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,directorycount,sizeof(T2P_TILES)));\n\tif(t2p->tiff_tiles==NULL){\n\t\tTIFFError(\n\t\t\tTIFF2PDF_MODULE,\n\t\t\t"Can\'t allocate " TIFF_SIZE_FORMAT " bytes of memory for tiff_tiles array, %s",\n\t\t\t(TIFF_SIZE_T) directorycount * sizeof(T2P_TILES),\n\t\t\tTIFFFileName(input));\n\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\treturn;\n\t}\n\t_TIFFmemset( t2p->tiff_tiles, 0x00, directorycount * sizeof(T2P_TILES));\n\tfor(i=0;i<directorycount;i++){\n\t\tuint32 subfiletype = 0;\n\t\tif(!TIFFSetDirectory(input, i)){\n\t\t\tTIFFError(\n\t\t\t\tTIFF2PDF_MODULE,\n\t\t\t\t"Can\'t set directory %u of input file %s",\n\t\t\t\ti,\n\t\t\t\tTIFFFileName(input));\n\t\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\t\treturn;\n\t\t}\n\t\tif(TIFFGetField(input, TIFFTAG_PAGENUMBER, &pagen, &paged)){\n\t\t\tif((pagen>paged) && (paged != 0)){\n\t\t\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_number =\n\t\t\t\t\tpaged;\n\t\t\t} else {\n\t\t\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_number =\n\t\t\t\t\tpagen;\n\t\t\t}\n\t\t\tgoto ispage2;\n\t\t}\n\t\tif(TIFFGetField(input, TIFFTAG_SUBFILETYPE, &subfiletype)){\n\t\t\tif ( ((subfiletype & FILETYPE_PAGE) != 0)\n                             || (subfiletype == 0)){\n\t\t\t\tgoto ispage;\n\t\t\t} else {\n\t\t\t\tgoto isnotpage;\n\t\t\t}\n\t\t}\n\t\tif(TIFFGetField(input, TIFFTAG_OSUBFILETYPE, &subfiletype)){\n\t\t\tif ((subfiletype == OFILETYPE_IMAGE)\n\t\t\t\t|| (subfiletype == OFILETYPE_PAGE)\n\t\t\t\t|| (subfiletype == 0) ){\n\t\t\t\tgoto ispage;\n\t\t\t} else {\n\t\t\t\tgoto isnotpage;\n\t\t\t}\n\t\t}\n\t\tispage:\n\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_number=t2p->tiff_pagecount;\n\t\tispage2:\n\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_directory=i;\n\t\tif(TIFFIsTiled(input)){\n\t\t\tt2p->tiff_pages[t2p->tiff_pagecount].page_tilecount =\n\t\t\t\tTIFFNumberOfTiles(input);\n\t\t}\n\t\tt2p->tiff_pagecount++;\n\t\tisnotpage:\n\t\t(void)0;\n\t}\n\tqsort((void*) t2p->tiff_pages, t2p->tiff_pagecount,\n              sizeof(T2P_PAGE), t2p_cmp_t2p_page);\n\tfor(i=0;i<t2p->tiff_pagecount;i++){\n\t\tt2p->pdf_xrefcount += 5;\n\t\tTIFFSetDirectory(input, t2p->tiff_pages[i].page_directory );\n\t\tif((TIFFGetField(input, TIFFTAG_PHOTOMETRIC, &xuint16)\n                    && (xuint16==PHOTOMETRIC_PALETTE))\n\t\t   || TIFFGetField(input, TIFFTAG_INDEXED, &xuint16)) {\n\t\t\tt2p->tiff_pages[i].page_extra++;\n\t\t\tt2p->pdf_xrefcount++;\n\t\t}\n#ifdef ZIP_SUPPORT\n\t\tif (TIFFGetField(input, TIFFTAG_COMPRESSION, &xuint16)) {\n                        if( (xuint16== COMPRESSION_DEFLATE ||\n                             xuint16== COMPRESSION_ADOBE_DEFLATE) &&\n                            ((t2p->tiff_pages[i].page_tilecount != 0)\n                             || TIFFNumberOfStrips(input)==1) &&\n                            (t2p->pdf_nopassthrough==0)\t){\n                                if(t2p->pdf_minorversion<2){t2p->pdf_minorversion=2;}\n                        }\n                }\n#endif\n\t\tif (TIFFGetField(input, TIFFTAG_TRANSFERFUNCTION,\n                                 &(tiff_transferfunction[0]),\n                                 &(tiff_transferfunction[1]),\n                                 &(tiff_transferfunction[2]))) {\n                        if((tiff_transferfunction[1] != (uint16*) NULL) &&\n                           (tiff_transferfunction[2] != (uint16*) NULL)\n                          ) {\n                            tiff_transferfunctioncount=3;\n                        } else {\n                            tiff_transferfunctioncount=1;\n                        }\n                } else {\n\t\t\ttiff_transferfunctioncount=0;\n\t\t}\n                if (i > 0){\n                    if (tiff_transferfunctioncount != t2p->tiff_transferfunctioncount){\n                        TIFFError(\n                            TIFF2PDF_MODULE,\n                            "Different transfer function on page %d",\n                            i);\n                        t2p->t2p_error = T2P_ERR_ERROR;\n                        return;\n                    }\n                }\n                t2p->tiff_transferfunctioncount = tiff_transferfunctioncount;\n                t2p->tiff_transferfunction[0] = tiff_transferfunction[0];\n                t2p->tiff_transferfunction[1] = tiff_transferfunction[1];\n                t2p->tiff_transferfunction[2] = tiff_transferfunction[2];\n                if(tiff_transferfunctioncount == 3){\n                        t2p->tiff_pages[i].page_extra += 4;\n                        t2p->pdf_xrefcount += 4;\n                        if(t2p->pdf_minorversion < 2)\n                                t2p->pdf_minorversion = 2;\n                } else if (tiff_transferfunctioncount == 1){\n                        t2p->tiff_pages[i].page_extra += 2;\n                        t2p->pdf_xrefcount += 2;\n                        if(t2p->pdf_minorversion < 2)\n                                t2p->pdf_minorversion = 2;\n                }\n\t\tif( TIFFGetField(\n\t\t\tinput,\n\t\t\tTIFFTAG_ICCPROFILE,\n\t\t\t&(t2p->tiff_iccprofilelength),\n\t\t\t&(t2p->tiff_iccprofile)) != 0){\n\t\t\tt2p->tiff_pages[i].page_extra++;\n\t\t\tt2p->pdf_xrefcount++;\n\t\t\tif(t2p->pdf_minorversion<3){t2p->pdf_minorversion=3;}\n\t\t}\n\t\tt2p->tiff_tiles[i].tiles_tilecount=\n\t\t\tt2p->tiff_pages[i].page_tilecount;\n\t\tif( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)\n\t\t\t&& (xuint16 == PLANARCONFIG_SEPARATE ) ){\n\t\t\t\tif( !TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16) )\n\t\t\t\t{\n\t\t\t\t\tTIFFError(\n                        TIFF2PDF_MODULE,\n                        "Missing SamplesPerPixel, %s",\n                        TIFFFileName(input));\n                    t2p->t2p_error = T2P_ERR_ERROR;\n                    return;\n\t\t\t\t}\n                if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )\n                {\n                    TIFFError(\n                        TIFF2PDF_MODULE,\n                        "Invalid tile count, %s",\n                        TIFFFileName(input));\n                    t2p->t2p_error = T2P_ERR_ERROR;\n                    return;\n                }\n\t\t\t\tt2p->tiff_tiles[i].tiles_tilecount/= xuint16;\n\t\t}\n\t\tif( t2p->tiff_tiles[i].tiles_tilecount > 0){\n\t\t\tt2p->pdf_xrefcount +=\n\t\t\t\t(t2p->tiff_tiles[i].tiles_tilecount -1)*2;\n\t\t\tTIFFGetField(input,\n\t\t\t\tTIFFTAG_TILEWIDTH,\n\t\t\t\t&( t2p->tiff_tiles[i].tiles_tilewidth) );\n\t\t\tTIFFGetField(input,\n\t\t\t\tTIFFTAG_TILELENGTH,\n\t\t\t\t&( t2p->tiff_tiles[i].tiles_tilelength) );\n\t\t\tt2p->tiff_tiles[i].tiles_tiles =\n\t\t\t(T2P_TILE*) _TIFFmalloc(TIFFSafeMultiply(tmsize_t,t2p->tiff_tiles[i].tiles_tilecount,\n                                                                 sizeof(T2P_TILE)) );\n\t\t\tif( t2p->tiff_tiles[i].tiles_tiles == NULL){\n\t\t\t\tTIFFError(\n\t\t\t\t\tTIFF2PDF_MODULE,\n\t\t\t\t\t"Can\'t allocate " TIFF_SIZE_FORMAT " bytes of memory for t2p_read_tiff_init, %s",\n\t\t\t\t\t(TIFF_SIZE_T) t2p->tiff_tiles[i].tiles_tilecount * sizeof(T2P_TILE),\n\t\t\t\t\tTIFFFileName(input));\n\t\t\t\tt2p->t2p_error = T2P_ERR_ERROR;\n\t\t\t\treturn;\n\t\t\t}\n\t\t}\n\t}\n\treturn;\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}']