tools/tiffcp.c:1008: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadEncodedStrip`.

tools/tiffcp.c:995:1: Parameter `in->tif_rawdata`
993.  * Strip -> strip for change in encoding.
994.  */
995. DECLAREcpFunc(cpDecodedStrips)
     ^
996. {
997. 	tsize_t stripsize  = TIFFStripSize(in);

tools/tiffcp.c:1008:8: Call
1006. 			tsize_t cc = (row + rowsperstrip > imagelength) ?
1007. 			    TIFFVStripSize(in, imagelength - row) : stripsize;
1008. 			if (TIFFReadEncodedStrip(in, s, buf, cc) < 0
             ^
1009. 			    && !ignore) {
1010. 				TIFFError(TIFFFileName(in),

libtiff/tif_read.c:516:1: Parameter `*tif->tif_rawdata`
  514.  * amount into the user-supplied buffer.
  515.  */
  516. tmsize_t
       ^
  517. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  518. {

libtiff/tif_read.c:547:7: Call
  545. 	if ((size!=(tmsize_t)(-1))&&(size<stripsize))
  546. 		stripsize=size;
  547. 	if (!TIFFFillStrip(tif,strip))
             ^
  548. 		return((tmsize_t)(-1));
  549. 	if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)

libtiff/tif_read.c:770:1: Parameter `*tif->tif_rawdata`
    768.  * expanded, as necessary, to hold the strip's data.
    769.  */
    770. int
         ^
    771. TIFFFillStrip(TIFF* tif, uint32 strip)
    772. {

libtiff/tif_read.c:957:5: Call
    955. 			if (!isFillOrder(tif, td->td_fillorder) &&
    956. 			    (tif->tif_flags & TIFF_NOBITREV) == 0)
    957. 				TIFFReverseBits(tif->tif_rawdata, bytecountm);
             ^
    958.                 }
    959. 	}

libtiff/tif_swab.c:283:1: <Length trace>
281. }
282. 
283. void
     ^
284. TIFFReverseBits(uint8* cp, tmsize_t n)  
285. {

libtiff/tif_swab.c:283:1: Parameter `*cp`
      281. }
      282. 
      283. void
           ^
      284. TIFFReverseBits(uint8* cp, tmsize_t n)  
      285. {

libtiff/tif_swab.c:294:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadEncodedStrip` 
      292. 		cp[5] = TIFFBitRevTable[cp[5]];
      293. 		cp[6] = TIFFBitRevTable[cp[6]];
      294. 		cp[7] = TIFFBitRevTable[cp[7]];
             ^
      295. 		cp += 8;
      296. 	}

void
TIFFReverseBits(uint8* cp, tmsize_t n)
{
	for (; n > 8; n -= 8) {
		cp[0] = TIFFBitRevTable[cp[0]];
		cp[1] = TIFFBitRevTable[cp[1]];
		cp[2] = TIFFBitRevTable[cp[2]];
		cp[3] = TIFFBitRevTable[cp[3]];
		cp[4] = TIFFBitRevTable[cp[4]];
		cp[5] = TIFFBitRevTable[cp[5]];
		cp[6] = TIFFBitRevTable[cp[6]];
		cp[7] = TIFFBitRevTable[cp[7]];
		cp += 8;
	}
	while (n-- > 0) {
		*cp = TIFFBitRevTable[*cp];
		cp++;
	}
}
['DECLAREcpFunc(cpDecodedStrips)\n{\n\ttsize_t stripsize  = TIFFStripSize(in);\n\ttdata_t buf = _TIFFmalloc(stripsize);\n\t(void) imagewidth; (void) spp;\n\tif (buf) {\n\t\ttstrip_t s, ns = TIFFNumberOfStrips(in);\n\t\tuint32 row = 0;\n\t\t_TIFFmemset(buf, 0, stripsize);\n\t\tfor (s = 0; s < ns && row < imagelength; s++) {\n\t\t\ttsize_t cc = (row + rowsperstrip > imagelength) ?\n\t\t\t    TIFFVStripSize(in, imagelength - row) : stripsize;\n\t\t\tif (TIFFReadEncodedStrip(in, s, buf, cc) < 0\n\t\t\t    && !ignore) {\n\t\t\t\tTIFFError(TIFFFileName(in),\n\t\t\t\t    "Error, can\'t read strip %lu",\n\t\t\t\t    (unsigned long) s);\n\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFWriteEncodedStrip(out, s, buf, cc) < 0) {\n\t\t\t\tTIFFError(TIFFFileName(out),\n\t\t\t\t    "Error, can\'t write strip %lu",\n\t\t\t\t    (unsigned long) s);\n\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\trow += rowsperstrip;\n\t\t}\n\t\t_TIFFfree(buf);\n\t\treturn 1;\n\t} else {\n\t\tTIFFError(TIFFFileName(in),\n\t\t    "Error, can\'t allocate memory buffer of size %lu "\n\t\t    "to read strips", (unsigned long) stripsize);\n\t\treturn 0;\n\t}\nbad:\n\t_TIFFfree(buf);\n\treturn 0;\n}', 'tmsize_t\nTIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedStrip";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t stripsize;\n\tuint16 plane;\n\tstripsize=TIFFReadEncodedStripGetStripSize(tif, strip, &plane);\n\tif (stripsize==((tmsize_t)(-1)))\n\t\treturn((tmsize_t)(-1));\n    if( td->td_compression == COMPRESSION_NONE &&\n        size!=(tmsize_t)(-1) && size >= stripsize &&\n        !isMapped(tif) &&\n        ((tif->tif_flags&TIFF_NOREADRAW)==0) )\n    {\n        if (TIFFReadRawStrip1(tif, strip, buf, stripsize, module) != stripsize)\n            return ((tmsize_t)(-1));\n        if (!isFillOrder(tif, td->td_fillorder) &&\n            (tif->tif_flags & TIFF_NOBITREV) == 0)\n            TIFFReverseBits(buf,stripsize);\n        (*tif->tif_postdecode)(tif,buf,stripsize);\n        return (stripsize);\n    }\n\tif ((size!=(tmsize_t)(-1))&&(size<stripsize))\n\t\tstripsize=size;\n\tif (!TIFFFillStrip(tif,strip))\n\t\treturn((tmsize_t)(-1));\n\tif ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)\n\t\treturn((tmsize_t)(-1));\n\t(*tif->tif_postdecode)(tif,buf,stripsize);\n\treturn(stripsize);\n}', 'int\nTIFFFillStrip(TIFF* tif, uint32 strip)\n{\n\tstatic const char module[] = "TIFFFillStrip";\n\tTIFFDirectory *td = &tif->tif_dir;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n            return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[strip];\n\t\tif ((int64)bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"Invalid strip byte count %I64u, strip %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) strip);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"Invalid strip byte count %llu, strip %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) strip);\n#endif\n\t\t\treturn (0);\n\t\t}\n                if( bytecount > 1024 * 1024 )\n                {\n\t\t\ttmsize_t stripsize = TIFFStripSize(tif);\n\t\t\tif( stripsize != 0 &&\n\t\t\t    (bytecount - 4096) / 10 > (uint64)stripsize  )\n\t\t\t{\n\t\t\t\tuint64 newbytecount = (uint64)stripsize * 10 + 4096;\n\t\t\t\tif( (int64)newbytecount >= 0 )\n\t\t\t\t{\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\t\t\tTIFFWarningExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large strip byte count %I64u, strip %lu. Limiting to %I64u",\n\t\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t\t     (unsigned long) strip,\n\t\t\t\t\t     (unsigned __int64) newbytecount);\n#else\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large strip byte count %llu, strip %lu. Limiting to %llu",\n\t\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t\t     (unsigned long) strip,\n\t\t\t\t\t     (unsigned long long) newbytecount);\n#endif\n\t\t\t\t\tbytecount = newbytecount;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif)) {\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[strip] > (uint64)tif->tif_size - bytecount) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t"Read error on strip %lu; "\n\t\t\t\t\t"got %I64u bytes, expected %I64u",\n\t\t\t\t\t(unsigned long) strip,\n\t\t\t\t\t(unsigned __int64) tif->tif_size - td->td_stripoffset[strip],\n\t\t\t\t\t(unsigned __int64) bytecount);\n#else\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t"Read error on strip %lu; "\n\t\t\t\t\t"got %llu bytes, expected %llu",\n\t\t\t\t\t(unsigned long) strip,\n\t\t\t\t\t(unsigned long long) tif->tif_size - td->td_stripoffset[strip],\n\t\t\t\t\t(unsigned long long) bytecount);\n#endif\n\t\t\t\ttif->tif_curstrip = NOSTRIP;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t    || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata = tif->tif_base + (tmsize_t)td->td_stripoffset[strip];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curstrip = NOSTRIP;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold strip %lu",\n\t\t\t\t\t    (unsigned long) strip);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curstrip = NOSTRIP;\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t\ttif->tif_flags &= ~TIFF_BUFFERMMAP;\n\t\t\t}\n\t\t\tif( isMapped(tif) )\n\t\t\t{\n\t\t\t\tif (bytecountm > tif->tif_rawdatasize &&\n\t\t\t\t    !TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (TIFFReadRawStrip1(tif, strip, tif->tif_rawdata,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tif (TIFFReadRawStripOrTile2(tif, strip, 1,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata, bytecountm);\n                }\n\t}\n\treturn (TIFFStartStrip(tif, strip));\n}', 'void\nTIFFReverseBits(uint8* cp, tmsize_t n)\n{\n\tfor (; n > 8; n -= 8) {\n\t\tcp[0] = TIFFBitRevTable[cp[0]];\n\t\tcp[1] = TIFFBitRevTable[cp[1]];\n\t\tcp[2] = TIFFBitRevTable[cp[2]];\n\t\tcp[3] = TIFFBitRevTable[cp[3]];\n\t\tcp[4] = TIFFBitRevTable[cp[4]];\n\t\tcp[5] = TIFFBitRevTable[cp[5]];\n\t\tcp[6] = TIFFBitRevTable[cp[6]];\n\t\tcp[7] = TIFFBitRevTable[cp[7]];\n\t\tcp += 8;\n\t}\n\twhile (n-- > 0) {\n\t\t*cp = TIFFBitRevTable[*cp];\n\t\tcp++;\n\t}\n}']