tools/tiff2ps.c:2662: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadEncodedStrip`.

tools/tiff2ps.c:2612:1: Parameter `tif->tif_rawdata`
2610. }
2611. 
2612. void
      ^
2613. PSDataBW(FILE* fd, TIFF* tif, uint32 w, uint32 h)
2614. {

tools/tiff2ps.c:2662:17: Call
2660. 
2661. 	for (s = 0; s < TIFFNumberOfStrips(tif); s++) {
2662. 		tmsize_t cc = TIFFReadEncodedStrip(tif, s, tf_buf, stripsize);
                      ^
2663. 		if (cc < 0) {
2664. 			TIFFError(filename, "Can't read strip");

libtiff/tif_read.c:516:1: Parameter `*tif->tif_rawdata`
  514.  * amount into the user-supplied buffer.
  515.  */
  516. tmsize_t
       ^
  517. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  518. {

libtiff/tif_read.c:547:7: Call
  545. 	if ((size!=(tmsize_t)(-1))&&(size<stripsize))
  546. 		stripsize=size;
  547. 	if (!TIFFFillStrip(tif,strip))
             ^
  548. 		return((tmsize_t)(-1));
  549. 	if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)

libtiff/tif_read.c:770:1: Parameter `*tif->tif_rawdata`
    768.  * expanded, as necessary, to hold the strip's data.
    769.  */
    770. int
         ^
    771. TIFFFillStrip(TIFF* tif, uint32 strip)
    772. {

libtiff/tif_read.c:957:5: Call
    955. 			if (!isFillOrder(tif, td->td_fillorder) &&
    956. 			    (tif->tif_flags & TIFF_NOBITREV) == 0)
    957. 				TIFFReverseBits(tif->tif_rawdata, bytecountm);
             ^
    958.                 }
    959. 	}

libtiff/tif_swab.c:283:1: <Length trace>
281. }
282. 
283. void
     ^
284. TIFFReverseBits(uint8* cp, tmsize_t n)  
285. {

libtiff/tif_swab.c:283:1: Parameter `*cp`
      281. }
      282. 
      283. void
           ^
      284. TIFFReverseBits(uint8* cp, tmsize_t n)  
      285. {

libtiff/tif_swab.c:294:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadEncodedStrip` 
      292. 		cp[5] = TIFFBitRevTable[cp[5]];
      293. 		cp[6] = TIFFBitRevTable[cp[6]];
      294. 		cp[7] = TIFFBitRevTable[cp[7]];
             ^
      295. 		cp += 8;
      296. 	}

void
TIFFReverseBits(uint8* cp, tmsize_t n)
{
	for (; n > 8; n -= 8) {
		cp[0] = TIFFBitRevTable[cp[0]];
		cp[1] = TIFFBitRevTable[cp[1]];
		cp[2] = TIFFBitRevTable[cp[2]];
		cp[3] = TIFFBitRevTable[cp[3]];
		cp[4] = TIFFBitRevTable[cp[4]];
		cp[5] = TIFFBitRevTable[cp[5]];
		cp[6] = TIFFBitRevTable[cp[6]];
		cp[7] = TIFFBitRevTable[cp[7]];
		cp += 8;
	}
	while (n-- > 0) {
		*cp = TIFFBitRevTable[*cp];
		cp++;
	}
}
['void\nPSDataBW(FILE* fd, TIFF* tif, uint32 w, uint32 h)\n{\n\tint breaklen = MAXLINE;\n\tunsigned char* tf_buf;\n\tunsigned char* cp;\n\ttsize_t stripsize = TIFFStripSize(tif);\n\ttstrip_t s;\n#if defined( EXP_ASCII85ENCODER )\n\ttsize_t\tascii85_l;\n\tuint8\t*ascii85_p = 0;\n#endif\n\t(void) w; (void) h;\n\ttf_buf = (unsigned char *) _TIFFmalloc(stripsize);\n\tif (tf_buf == NULL) {\n\t\tTIFFError(filename, "No space for scanline buffer");\n\t\treturn;\n\t}\n\tmemset(tf_buf, 0, stripsize);\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85 ) {\n\t    ascii85_p = _TIFFmalloc( (stripsize+(stripsize/2)) + 8 );\n\t    if ( !ascii85_p ) {\n\t\t_TIFFfree( tf_buf );\n\t\tTIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );\n\t\treturn;\n\t    }\n\t}\n#endif\n\tif (ascii85)\n\t\tAscii85Init();\n\tfor (s = 0; s < TIFFNumberOfStrips(tif); s++) {\n\t\ttmsize_t cc = TIFFReadEncodedStrip(tif, s, tf_buf, stripsize);\n\t\tif (cc < 0) {\n\t\t\tTIFFError(filename, "Can\'t read strip");\n\t\t\tbreak;\n\t\t}\n\t\tcp = tf_buf;\n\t\tif (photometric == PHOTOMETRIC_MINISWHITE) {\n\t\t\tfor (cp += cc; --cp >= tf_buf;)\n\t\t\t\t*cp = ~*cp;\n\t\t\tcp++;\n\t\t}\n\t\tif (bitspersample == 16 && !HOST_BIGENDIAN) {\n\t\t\tPS_FlipBytes(cp, cc);\n\t\t}\n\t\tif (ascii85) {\n#if defined( EXP_ASCII85ENCODER )\n\t\t\tif (alpha) {\n\t\t\t\tint adjust, i;\n\t\t\t\tfor (i = 0; i < cc; i+=2) {\n\t\t\t\t\tadjust = 255 - cp[i + 1];\n\t\t\t\t    cp[i / 2] = cp[i] + adjust;\n\t\t\t\t}\n\t\t\t\tcc /= 2;\n\t\t\t}\n\t\t\tascii85_l = Ascii85EncodeBlock( ascii85_p, 1, cp, cc );\n\t\t\tif ( ascii85_l > 0 )\n\t\t\t    fwrite( ascii85_p, ascii85_l, 1, fd );\n#else\n\t\t\twhile (cc-- > 0)\n\t\t\t\tAscii85Put(*cp++, fd);\n#endif\n\t\t} else {\n\t\t\tunsigned char c;\n\t\t\tif (alpha) {\n\t\t\t\tint adjust;\n\t\t\t\twhile (cc-- > 1) {\n\t\t\t\t\tDOBREAK(breaklen, 1, fd);\n\t\t\t\t\tadjust = 255 - cp[1];\n\t\t\t\t\tc = *cp++ + adjust; PUTHEX(c,fd);\n\t\t\t\t\tcp++, cc--;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\twhile (cc-- > 0) {\n\t\t\t\t\tc = *cp++;\n\t\t\t\t\tDOBREAK(breaklen, 1, fd);\n\t\t\t\t\tPUTHEX(c, fd);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\tif ( !ascii85 )\n\t{\n\t    if ( level2 || level3)\n\t\tfputs(">\\n", fd);\n\t}\n#if !defined( EXP_ASCII85ENCODER )\n\telse\n\t    Ascii85Flush(fd);\n#else\n\tif ( ascii85_p )\n\t    _TIFFfree( ascii85_p );\n#endif\n\t_TIFFfree(tf_buf);\n}', 'tmsize_t\nTIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedStrip";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t stripsize;\n\tuint16 plane;\n\tstripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);\n\tif (stripsize==((tmsize_t)(-1)))\n\t\treturn((tmsize_t)(-1));\n    if( td->td_compression == COMPRESSION_NONE &&\n        size!=(tmsize_t)(-1) && size >= stripsize &&\n        !isMapped(tif) &&\n        ((tif->tif_flags&TIFF_NOREADRAW)==0) )\n    {\n        if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize)\n            return ((tmsize_t)(-1));\n        if (!isFillOrder(tif, td->td_fillorder) &&\n            (tif->tif_flags & TIFF_NOBITREV) == 0)\n            TIFFReverseBits(buf,stripsize);\n        (*tif->tif_postdecode)(tif,buf,stripsize);\n        return (stripsize);\n    }\n\tif ((size!=(tmsize_t)(-1))&&(size<stripsize))\n\t\tstripsize=size;\n\tif (!TIFFFillStrip(tif,strip))\n\t\treturn((tmsize_t)(-1));\n\tif ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)\n\t\treturn((tmsize_t)(-1));\n\t(*tif->tif_postdecode)(tif,buf,stripsize);\n\treturn(stripsize);\n}', 'int\nTIFFFillStrip(TIFF* tif, uint32 strip)\n{\n\tstatic const char module[] = "TIFFFillStrip";\n\tTIFFDirectory *td = &tif->tif_dir;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n            return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[strip];\n\t\tif ((int64)bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"Invalid strip byte count %I64u, strip %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) strip);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"Invalid strip byte count %llu, strip %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) strip);\n#endif\n\t\t\treturn (0);\n\t\t}\n                if( bytecount > 1024 * 1024 )\n                {\n\t\t\ttmsize_t stripsize = TIFFStripSize(tif);\n\t\t\tif( stripsize != 0 &&\n\t\t\t    (bytecount - 4096) / 10 > (uint64)stripsize  )\n\t\t\t{\n\t\t\t\tuint64 newbytecount = (uint64)stripsize * 10 + 4096;\n\t\t\t\tif( (int64)newbytecount >= 0 )\n\t\t\t\t{\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\t\t\tTIFFWarningExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large strip byte count %I64u, strip %lu. Limiting to %I64u",\n\t\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t\t     (unsigned long) strip,\n\t\t\t\t\t     (unsigned __int64) newbytecount);\n#else\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large strip byte count %llu, strip %lu. Limiting to %llu",\n\t\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t\t     (unsigned long) strip,\n\t\t\t\t\t     (unsigned long long) newbytecount);\n#endif\n\t\t\t\t\tbytecount = newbytecount;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif)) {\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[strip] > (uint64)tif->tif_size - bytecount) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t"Read error on strip %lu; "\n\t\t\t\t\t"got %I64u bytes, expected %I64u",\n\t\t\t\t\t(unsigned long) strip,\n\t\t\t\t\t(unsigned __int64) tif->tif_size - td->td_stripoffset[strip],\n\t\t\t\t\t(unsigned __int64) bytecount);\n#else\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t"Read error on strip %lu; "\n\t\t\t\t\t"got %llu bytes, expected %llu",\n\t\t\t\t\t(unsigned long) strip,\n\t\t\t\t\t(unsigned long long) tif->tif_size - td->td_stripoffset[strip],\n\t\t\t\t\t(unsigned long long) bytecount);\n#endif\n\t\t\t\ttif->tif_curstrip = NOSTRIP;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t    || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata = tif->tif_base + (tmsize_t)td->td_stripoffset[strip];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curstrip = NOSTRIP;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold strip %lu",\n\t\t\t\t\t    (unsigned long) strip);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curstrip = NOSTRIP;\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t\ttif->tif_flags &= ~TIFF_BUFFERMMAP;\n\t\t\t}\n\t\t\tif( isMapped(tif) )\n\t\t\t{\n\t\t\t\tif (bytecountm > tif->tif_rawdatasize &&\n\t\t\t\t    !TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tif (TIFFReadRawStripOrTile2(tif, strip, 1,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata, bytecountm);\n                }\n\t}\n\treturn (TIFFStartStrip(tif, strip));\n}', 'void\nTIFFReverseBits(uint8* cp, tmsize_t n)\n{\n\tfor (; n > 8; n -= 8) {\n\t\tcp[0] = TIFFBitRevTable[cp[0]];\n\t\tcp[1] = TIFFBitRevTable[cp[1]];\n\t\tcp[2] = TIFFBitRevTable[cp[2]];\n\t\tcp[3] = TIFFBitRevTable[cp[3]];\n\t\tcp[4] = TIFFBitRevTable[cp[4]];\n\t\tcp[5] = TIFFBitRevTable[cp[5]];\n\t\tcp[6] = TIFFBitRevTable[cp[6]];\n\t\tcp[7] = TIFFBitRevTable[cp[7]];\n\t\tcp += 8;\n\t}\n\twhile (n-- > 0) {\n\t\t*cp = TIFFBitRevTable[*cp];\n\t\tcp++;\n\t}\n}']