tools/tiffinfo.c:339: error: Integer Overflow L2
  ([0, `tif->tif_dir.td_tilelength`] - 1):unsigned32 by call to `TIFFReadTile`.

tools/tiffinfo.c:319:1: Parameter `tif->tif_dir.td_tilelength`
317. }
318. 
319. void
     ^
320. TIFFReadSeparateTileData(TIFF* tif)
321. {

tools/tiffinfo.c:323:20: Call
321. {
322. 	unsigned char *buf;
323. 	tsize_t rowsize = TIFFTileRowSize(tif);
                        ^
324. 
325. 	buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif));

libtiff/tif_tile.c:184:1: Parameter `tif->tif_dir.td_tilelength`
  182. 	return (TIFFhowmany8_64(rowsize));
  183. }
  184. tmsize_t
       ^
  185. TIFFTileRowSize(TIFF* tif)
  186. {

libtiff/tif_tile.c:190:4: Call
  188. 	uint64 m;
  189. 	tmsize_t n;
  190. 	m=TIFFTileRowSize64(tif);
          ^
  191. 	n=(tmsize_t)m;
  192. 	if ((uint64)n!=m)

libtiff/tif_tile.c:169:1: Parameter `tif->tif_dir.td_tilelength`
    167.  * Compute the # bytes in each row of a tile.
    168.  */
    169. uint64
         ^
    170. TIFFTileRowSize64(TIFF* tif)
    171. {

tools/tiffinfo.c:325:37: Call
323. 	tsize_t rowsize = TIFFTileRowSize(tif);
324. 
325. 	buf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif));
                                         ^
326. 	if (buf) {
327. 		uint32 tw, th, w, h;

libtiff/tif_tile.c:274:1: Parameter `tif->tif_dir.td_tilelength`
  272. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  273. }
  274. tmsize_t
       ^
  275. TIFFTileSize(TIFF* tif)
  276. {

libtiff/tif_tile.c:280:4: Call
  278. 	uint64 m;
  279. 	tmsize_t n;
  280. 	m=TIFFTileSize64(tif);
          ^
  281. 	n=(tmsize_t)m;
  282. 	if ((uint64)n!=m)

libtiff/tif_tile.c:269:1: Parameter `tif->tif_dir.td_tilelength`
    267.  * Compute the # bytes in a row-aligned tile.
    268.  */
    269. uint64
         ^
    270. TIFFTileSize64(TIFF* tif)
    271. {

libtiff/tif_tile.c:272:10: Call
    270. TIFFTileSize64(TIFF* tif)
    271. {
    272. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    273. }
    274. tmsize_t

libtiff/tif_tile.c:203:1: Parameter `tif->tif_dir.td_tilelength`
      201.  * Compute the # bytes in a variable length, row-aligned tile.
      202.  */
      203. uint64
           ^
      204. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      205. {

tools/tiffinfo.c:339:10: Call
337. 			for (col = 0; col < w; col += tw) {
338. 				for (s = 0; s < samplesperpixel; s++) {
339. 					if (TIFFReadTile(tif, buf, col, row, 0, s) < 0) {
              ^
340. 						if (stoponerr)
341. 							break;

libtiff/tif_read.c:604:1: Parameter `tif->tif_dir.td_tilelength`
  602.  * tile is selected by the (x,y,z,s) coordinates.
  603.  */
  604. tmsize_t
       ^
  605. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  606. {

libtiff/tif_read.c:609:10: Call
  607. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  608. 		return ((tmsize_t)(-1));
  609. 	return (TIFFReadEncodedTile(tif,
                ^
  610. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  611. }

libtiff/tif_read.c:617:1: Parameter `tif->tif_dir.td_tilelength`
    615.  * amount into the user-supplied buffer.
    616.  */
    617. tmsize_t
         ^
    618. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
    619. {

libtiff/tif_read.c:636:6: Call
    634. 	else if (size > tilesize)
    635. 		size = tilesize;
    636. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
              ^
    637. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
    638. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:757:1: Parameter `tif->tif_dir.td_tilelength`
      755.  * expanded, as necessary, to hold the tile's data.
      756.  */
      757. int
           ^
      758. TIFFFillTile(TIFF* tif, uint32 tile)
      759. {

libtiff/tif_read.c:853:10: Call
      851. 		}
      852. 	}
      853. 	return (TIFFStartTile(tif, tile));
                    ^
      854. }
      855. 

libtiff/tif_read.c:933:1: <LHS trace>
931.  * tile has just been read in.
932.  */
933. static int
     ^
934. TIFFStartTile(TIFF* tif, uint32 tile)
935. {

libtiff/tif_read.c:933:1: Parameter `tif->tif_dir.td_tilelength`
        931.  * tile has just been read in.
        932.  */
        933. static int
             ^
        934. TIFFStartTile(TIFF* tif, uint32 tile)
        935. {

libtiff/tif_read.c:947:2: Binary operation: ([0, tif->tif_dir.td_tilelength] - 1):unsigned32 by call to `TIFFReadTile` 
        945. 	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
        946. 		td->td_tilelength;
        947. 	tif->tif_col =
              ^
        948. 	    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
        949. 		td->td_tilewidth;

static int
TIFFStartTile(TIFF* tif, uint32 tile)
{
	TIFFDirectory *td = &tif->tif_dir;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupdecode)(tif))
			return (0);
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_curtile = tile;
	tif->tif_row =
	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
		td->td_tilelength;
	tif->tif_col =
	    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
		td->td_tilewidth;
        tif->tif_flags &= ~TIFF_BUF4WRITE;
	if (tif->tif_flags&TIFF_NOREADRAW)
	{
		tif->tif_rawcp = NULL;
		tif->tif_rawcc = 0;
	}
	else
	{
		tif->tif_rawcp = tif->tif_rawdata;
		tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
	}
	return ((*tif->tif_predecode)(tif,
			(uint16)(tile/td->td_stripsperimage)));
}
['void\nTIFFReadSeparateTileData(TIFF* tif)\n{\n\tunsigned char *buf;\n\ttsize_t rowsize = TIFFTileRowSize(tif);\n\tbuf = (unsigned char *)_TIFFmalloc(TIFFTileSize(tif));\n\tif (buf) {\n\t\tuint32 tw, th, w, h;\n\t\tuint32 row, col;\n\t\ttsample_t s, samplesperpixel;\n\t\tTIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w);\n\t\tTIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h);\n\t\tTIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);\n\t\tTIFFGetField(tif, TIFFTAG_TILELENGTH, &th);\n\t\tTIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samplesperpixel);\n\t\tfor (row = 0; row < h; row += th) {\n\t\t\tfor (col = 0; col < w; col += tw) {\n\t\t\t\tfor (s = 0; s < samplesperpixel; s++) {\n\t\t\t\t\tif (TIFFReadTile(tif, buf, col, row, 0, s) < 0) {\n\t\t\t\t\t\tif (stoponerr)\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t} else if (showdata)\n\t\t\t\t\t\tShowTile(row, col, s, buf, th, rowsize);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t_TIFFfree(buf);\n\t}\n}', 'tmsize_t\nTIFFTileRowSize(TIFF* tif)\n{\n\tstatic const char module[] = "TIFFTileRowSize";\n\tuint64 m;\n\ttmsize_t n;\n\tm=TIFFTileRowSize64(tif);\n\tn=(tmsize_t)m;\n\tif ((uint64)n!=m)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\tn=0;\n\t}\n\treturn(n);\n}', 'uint64\nTIFFTileRowSize64(TIFF* tif)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tuint64 rowsize;\n\tif (td->td_tilelength == 0 || td->td_tilewidth == 0)\n\t\treturn (0);\n\trowsize = multiply_64(tif, td->td_bitspersample, td->td_tilewidth,\n\t    "TIFFTileRowSize");\n\tif (td->td_planarconfig == PLANARCONFIG_CONTIG)\n\t\trowsize = multiply_64(tif, rowsize, td->td_samplesperpixel,\n\t\t    "TIFFTileRowSize");\n\treturn (TIFFhowmany8_64(rowsize));\n}', 'tmsize_t\nTIFFTileSize(TIFF* tif)\n{\n\tstatic const char module[] = "TIFFTileSize";\n\tuint64 m;\n\ttmsize_t n;\n\tm=TIFFTileSize64(tif);\n\tn=(tmsize_t)m;\n\tif ((uint64)n!=m)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\tn=0;\n\t}\n\treturn(n);\n}', 'uint64\nTIFFTileSize64(TIFF* tif)\n{\n\treturn (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));\n}', 'uint64\nTIFFVTileSize64(TIFF* tif, uint32 nrows)\n{\n\tstatic const char module[] = "TIFFVTileSize64";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (td->td_tilelength == 0 || td->td_tilewidth == 0 ||\n\t    td->td_tiledepth == 0)\n\t\treturn (0);\n\tif ((td->td_planarconfig==PLANARCONFIG_CONTIG)&&\n\t    (td->td_photometric==PHOTOMETRIC_YCBCR)&&\n\t    (td->td_samplesperpixel==3)&&\n\t    (!isUpSampled(tif)))\n\t{\n\t\tuint16 ycbcrsubsampling[2];\n\t\tuint16 samplingblock_samples;\n\t\tuint32 samplingblocks_hor;\n\t\tuint32 samplingblocks_ver;\n\t\tuint64 samplingrow_samples;\n\t\tuint64 samplingrow_size;\n\t\tTIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,\n\t\t    ycbcrsubsampling+1);\n\t\tassert((ycbcrsubsampling[0]==1)||(ycbcrsubsampling[0]==2)||(ycbcrsubsampling[0]==4));\n\t\tassert((ycbcrsubsampling[1]==1)||(ycbcrsubsampling[1]==2)||(ycbcrsubsampling[1]==4));\n\t\tif (ycbcrsubsampling[0]*ycbcrsubsampling[1]==0)\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t    "Invalid YCbCr subsampling");\n\t\t\treturn 0;\n\t\t}\n\t\tsamplingblock_samples=ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;\n\t\tsamplingblocks_hor=TIFFhowmany_32(td->td_tilewidth,ycbcrsubsampling[0]);\n\t\tsamplingblocks_ver=TIFFhowmany_32(nrows,ycbcrsubsampling[1]);\n\t\tsamplingrow_samples=multiply_64(tif,samplingblocks_hor,samplingblock_samples,module);\n\t\tsamplingrow_size=TIFFhowmany8_64(multiply_64(tif,samplingrow_samples,td->td_bitspersample,module));\n\t\treturn(multiply_64(tif,samplingrow_size,samplingblocks_ver,module));\n\t}\n\telse\n\t\treturn(multiply_64(tif,nrows,TIFFTileRowSize64(tif),module));\n}', 'tmsize_t\nTIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tif (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))\n\t\treturn ((tmsize_t)(-1));\n\treturn (TIFFReadEncodedTile(tif,\n\t    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif (bytecount <= 0) {\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\treturn (0);\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata,\n                                                tif->tif_rawdataloaded);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'static int\nTIFFStartTile(TIFF* tif, uint32 tile)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupdecode)(tif))\n\t\t\treturn (0);\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_curtile = tile;\n\ttif->tif_row =\n\t    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *\n\t\ttd->td_tilelength;\n\ttif->tif_col =\n\t    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *\n\t\ttd->td_tilewidth;\n        tif->tif_flags &= ~TIFF_BUF4WRITE;\n\tif (tif->tif_flags&TIFF_NOREADRAW)\n\t{\n\t\ttif->tif_rawcp = NULL;\n\t\ttif->tif_rawcc = 0;\n\t}\n\telse\n\t{\n\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\ttif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];\n\t}\n\treturn ((*tif->tif_predecode)(tif,\n\t\t\t(uint16)(tile/td->td_stripsperimage)));\n}']