tools/tiffsplit.c:285: error: Integer Overflow L2
  ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `TIFFWriteRawTile`.

tools/tiffsplit.c:262:1: Parameter `out->tif_dir.td_imagelength`
260. }
261. 
262. static int
     ^
263. cpTiles(TIFF* in, TIFF* out)
264. {

tools/tiffsplit.c:285:8: Call
283. 			}
284. 			if (TIFFReadRawTile(in, t, buf, (tmsize_t)bytecounts[t]) < 0 ||
285. 			    TIFFWriteRawTile(out, t, buf, (tmsize_t)bytecounts[t]) < 0) {
            ^
286. 				_TIFFfree(buf);
287. 				return (0);

libtiff/tif_write.c:502:1: Parameter `tif->tif_dir.td_imagelength`
  500.  *     the image on each write (as TIFFWriteScanline does).
  501.  */
  502. tmsize_t
       ^
  503. TIFFWriteRawTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
  504. {

libtiff/tif_write.c:507:7: Call
  505. 	static const char module[] = "TIFFWriteRawTile";
  506. 
  507. 	if (!WRITECHECKTILES(tif, module))
             ^
  508. 		return ((tmsize_t)(-1));
  509. 	if (tile >= tif->tif_dir.td_nstrips) {

libtiff/tif_write.c:564:1: Parameter `tif->tif_dir.td_imagelength`
    562.  * that important information is not changed.
    563.  */
    564. int
         ^
    565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    566. {

libtiff/tif_write.c:611:48: Call
    609. 		}
    610. 	}
    611. 	if (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif)) {
                                                        ^
    612. 		tif->tif_dir.td_nstrips = 0;
    613. 		TIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",

libtiff/tif_write.c:522:1: Parameter `tif->tif_dir.td_imagelength`
      520.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
      521. 
      522. int
           ^
      523. TIFFSetupStrips(TIFF* tif)
      524. {

libtiff/tif_write.c:530:29: Call
      528. 		td->td_stripsperimage =
      529. 		    isUnspecified(tif, FIELD_TILEDIMENSIONS) ?
      530. 			td->td_samplesperpixel : TIFFNumberOfTiles(tif);
                                       ^
      531. 	else
      532. 		td->td_stripsperimage =

libtiff/tif_tile.c:112:1: <LHS trace>
110.  * Compute how many tiles are in an image.
111.  */
112. uint32
     ^
113. TIFFNumberOfTiles(TIFF* tif)
114. {

libtiff/tif_tile.c:112:1: Parameter `tif->tif_dir.td_imagelength`
        110.  * Compute how many tiles are in an image.
        111.  */
        112. uint32
             ^
        113. TIFFNumberOfTiles(TIFF* tif)
        114. {

libtiff/tif_tile.c:112:1: <RHS trace>
110.  * Compute how many tiles are in an image.
111.  */
112. uint32
     ^
113. TIFFNumberOfTiles(TIFF* tif)
114. {

libtiff/tif_tile.c:112:1: Parameter `tif->tif_dir.td_imagelength`
        110.  * Compute how many tiles are in an image.
        111.  */
        112. uint32
             ^
        113. TIFFNumberOfTiles(TIFF* tif)
        114. {

libtiff/tif_tile.c:129:6: Binary operation: ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `TIFFWriteRawTile` 
        127. 	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
        128. 	    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
        129. 	    TIFFhowmany_32(td->td_imagelength, dy),
                  ^
        130. 	    "TIFFNumberOfTiles"),
        131. 	    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");

uint32
TIFFNumberOfTiles(TIFF* tif)
{
	TIFFDirectory *td = &tif->tif_dir;
	uint32 dx = td->td_tilewidth;
	uint32 dy = td->td_tilelength;
	uint32 dz = td->td_tiledepth;
	uint32 ntiles;
	if (dx == (uint32) -1)
		dx = td->td_imagewidth;
	if (dy == (uint32) -1)
		dy = td->td_imagelength;
	if (dz == (uint32) -1)
		dz = td->td_imagedepth;
	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
	    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
	    TIFFhowmany_32(td->td_imagelength, dy),
	    "TIFFNumberOfTiles"),
	    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
		ntiles = _TIFFMultiply32(tif, ntiles, td->td_samplesperpixel,
		    "TIFFNumberOfTiles");
	return (ntiles);
}
['static int\ncpTiles(TIFF* in, TIFF* out)\n{\n\ttmsize_t bufsize = TIFFTileSize(in);\n\tunsigned char *buf = (unsigned char *)_TIFFmalloc(bufsize);\n\tif (buf) {\n\t\tttile_t t, nt = TIFFNumberOfTiles(in);\n\t\tuint64 *bytecounts;\n\t\tif (!TIFFGetField(in, TIFFTAG_TILEBYTECOUNTS, &bytecounts)) {\n\t\t\tfprintf(stderr, "tiffsplit: tile byte counts are missing\\n");\n                        _TIFFfree(buf);\n\t\t\treturn (0);\n\t\t}\n\t\tfor (t = 0; t < nt; t++) {\n\t\t\tif (bytecounts[t] > (uint64) bufsize) {\n\t\t\t\tbuf = (unsigned char *)_TIFFrealloc(buf, (tmsize_t)bytecounts[t]);\n\t\t\t\tif (!buf)\n\t\t\t\t\treturn (0);\n\t\t\t\tbufsize = (tmsize_t)bytecounts[t];\n\t\t\t}\n\t\t\tif (TIFFReadRawTile(in, t, buf, (tmsize_t)bytecounts[t]) < 0 ||\n\t\t\t    TIFFWriteRawTile(out, t, buf, (tmsize_t)bytecounts[t]) < 0) {\n\t\t\t\t_TIFFfree(buf);\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\t_TIFFfree(buf);\n\t\treturn (1);\n\t}\n\treturn (0);\n}', 'tmsize_t\nTIFFWriteRawTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)\n{\n\tstatic const char module[] = "TIFFWriteRawTile";\n\tif (!WRITECHECKTILES(tif, module))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= tif->tif_dir.td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "Tile %lu out of range, max %lu",\n\t\t    (unsigned long) tile,\n\t\t    (unsigned long) tif->tif_dir.td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\treturn (TIFFAppendToStrip(tif, tile, (uint8*) data, cc) ?\n\t    cc : (tmsize_t)(-1));\n}', 'int\nTIFFWriteCheck(TIFF* tif, int tiles, const char* module)\n{\n\tif (tif->tif_mode == O_RDONLY) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "File not open for writing");\n\t\treturn (0);\n\t}\n\tif (tiles ^ isTiled(tif)) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, tiles ?\n\t\t    "Can not write tiles to a stripped image" :\n\t\t    "Can not write scanlines to a tiled image");\n\t\treturn (0);\n\t}\n        _TIFFFillStriles( tif );\n\tif (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS)) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "Must set \\"ImageWidth\\" before writing data");\n\t\treturn (0);\n\t}\n\tif (tif->tif_dir.td_samplesperpixel == 1) {\n\t\tif (!TIFFFieldSet(tif, FIELD_PLANARCONFIG))\n                    tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG;\n\t} else {\n\t\tif (!TIFFFieldSet(tif, FIELD_PLANARCONFIG)) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "Must set \\"PlanarConfiguration\\" before writing data");\n\t\t\treturn (0);\n\t\t}\n\t}\n\tif (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif)) {\n\t\ttif->tif_dir.td_nstrips = 0;\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",\n\t\t    isTiled(tif) ? "tile" : "strip");\n\t\treturn (0);\n\t}\n\tif (isTiled(tif))\n\t{\n\t\ttif->tif_tilesize = TIFFTileSize(tif);\n\t\tif (tif->tif_tilesize == 0)\n\t\t\treturn (0);\n\t}\n\telse\n\t\ttif->tif_tilesize = (tmsize_t)(-1);\n\ttif->tif_scanlinesize = TIFFScanlineSize(tif);\n\tif (tif->tif_scanlinesize == 0)\n\t\treturn (0);\n\ttif->tif_flags |= TIFF_BEENWRITING;\n\treturn (1);\n}', 'int\nTIFFSetupStrips(TIFF* tif)\n{\n\tTIFFDirectory* td = &tif->tif_dir;\n\tif (isTiled(tif))\n\t\ttd->td_stripsperimage =\n\t\t    isUnspecified(tif, FIELD_TILEDIMENSIONS) ?\n\t\t\ttd->td_samplesperpixel : TIFFNumberOfTiles(tif);\n\telse\n\t\ttd->td_stripsperimage =\n\t\t    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?\n\t\t\ttd->td_samplesperpixel : TIFFNumberOfStrips(tif);\n\ttd->td_nstrips = td->td_stripsperimage;\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\ttd->td_stripsperimage /= td->td_samplesperpixel;\n\ttd->td_stripoffset_p = (uint64 *)\n            _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),\n                             "for \\"StripOffsets\\" array");\n\ttd->td_stripbytecount_p = (uint64 *)\n            _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),\n                             "for \\"StripByteCounts\\" array");\n\tif (td->td_stripoffset_p == NULL || td->td_stripbytecount_p == NULL)\n\t\treturn (0);\n\t_TIFFmemset(td->td_stripoffset_p, 0, td->td_nstrips*sizeof (uint64));\n\t_TIFFmemset(td->td_stripbytecount_p, 0, td->td_nstrips*sizeof (uint64));\n\tTIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);\n\tTIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);\n\treturn (1);\n}', 'uint32\nTIFFNumberOfTiles(TIFF* tif)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tuint32 dx = td->td_tilewidth;\n\tuint32 dy = td->td_tilelength;\n\tuint32 dz = td->td_tiledepth;\n\tuint32 ntiles;\n\tif (dx == (uint32) -1)\n\t\tdx = td->td_imagewidth;\n\tif (dy == (uint32) -1)\n\t\tdy = td->td_imagelength;\n\tif (dz == (uint32) -1)\n\t\tdz = td->td_imagedepth;\n\tntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :\n\t    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),\n\t    TIFFhowmany_32(td->td_imagelength, dy),\n\t    "TIFFNumberOfTiles"),\n\t    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\tntiles = _TIFFMultiply32(tif, ntiles, td->td_samplesperpixel,\n\t\t    "TIFFNumberOfTiles");\n\treturn (ntiles);\n}']