libtiff/tif_write.c:405: error: Buffer Overrun S2
  Offset: `tile` Size: [0, +oo].

libtiff/tif_write.c:378:1: <Offset trace>
376.  *     the image on each write (as TIFFWriteScanline does).
377.  */
378. tmsize_t
     ^
379. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
380. {

libtiff/tif_write.c:378:1: Parameter `tile`
376.  *     the image on each write (as TIFFWriteScanline does).
377.  */
378. tmsize_t
     ^
379. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
380. {

libtiff/tif_write.c:378:1: <Length trace>
376.  *     the image on each write (as TIFFWriteScanline does).
377.  */
378. tmsize_t
     ^
379. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
380. {

libtiff/tif_write.c:378:1: Parameter `*tif->tif_dir.td_stripbytecount`
376.  *     the image on each write (as TIFFWriteScanline does).
377.  */
378. tmsize_t
     ^
379. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
380. {

libtiff/tif_write.c:405:6: Array access: Offset: tile Size: [0, +oo]
403. 	tif->tif_curtile = tile;
404. 
405. 	if( td->td_stripbytecount[tile] > 0 )
          ^
406.         {
407.             /* Make sure that at the first attempt of rewriting the tile, we will have */

tmsize_t
TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
{
	static const char module[] = "TIFFWriteEncodedTile";
	TIFFDirectory *td;
	uint16 sample;
        uint32 howmany32;
	if (!WRITECHECKTILES(tif, module))
		return ((tmsize_t)(-1));
	td = &tif->tif_dir;
	if (tile >= td->td_nstrips) {
		TIFFErrorExt(tif->tif_clientdata, module, "Tile %lu out of range, max %lu",
		    (unsigned long) tile, (unsigned long) td->td_nstrips);
		return ((tmsize_t)(-1));
	}
	if (!BUFFERCHECK(tif))
		return ((tmsize_t)(-1));
        tif->tif_flags |= TIFF_BUF4WRITE;
	tif->tif_curtile = tile;
	if( td->td_stripbytecount[tile] > 0 )
        {
            if( tif->tif_rawdatasize <= (tmsize_t) td->td_stripbytecount[tile] )
            {
                if( !(TIFFWriteBufferSetup(tif, NULL,
                    (tmsize_t)TIFFroundup_64((uint64)(td->td_stripbytecount[tile] + 1), 1024))) )
                    return ((tmsize_t)(-1));
            }
            tif->tif_curoff = 0;
        }
	tif->tif_rawcc = 0;
	tif->tif_rawcp = tif->tif_rawdata;
        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
        if (howmany32 == 0) {
                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
                return ((tmsize_t)(-1));
        }
	tif->tif_row = (tile % howmany32) * td->td_tilelength;
        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
        if (howmany32 == 0) {
                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
                return ((tmsize_t)(-1));
        }
	tif->tif_col = (tile % howmany32) * td->td_tilewidth;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupencode)(tif))
			return ((tmsize_t)(-1));
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_flags &= ~TIFF_POSTENCODE;
	if ( cc < 1 || cc > tif->tif_tilesize)
		cc = tif->tif_tilesize;
    if( td->td_compression == COMPRESSION_NONE )
    {
        tif->tif_postdecode( tif, (uint8*) data, cc );
        if (!isFillOrder(tif, td->td_fillorder) &&
            (tif->tif_flags & TIFF_NOBITREV) == 0)
            TIFFReverseBits((uint8*) data, cc);
        if (cc > 0 &&
            !TIFFAppendToStrip(tif, tile, (uint8*) data, cc))
            return ((tmsize_t) -1);
        return (cc);
    }
    sample = (uint16)(tile/td->td_stripsperimage);
    if (!(*tif->tif_preencode)(tif, sample))
        return ((tmsize_t)(-1));
    tif->tif_postdecode( tif, (uint8*) data, cc );
    if (!(*tif->tif_encodetile)(tif, (uint8*) data, cc, sample))
            return ((tmsize_t) -1);
    if (!(*tif->tif_postencode)(tif))
            return ((tmsize_t)(-1));
    if (!isFillOrder(tif, td->td_fillorder) &&
        (tif->tif_flags & TIFF_NOBITREV) == 0)
            TIFFReverseBits((uint8*)tif->tif_rawdata, tif->tif_rawcc);
    if (tif->tif_rawcc > 0 && !TIFFAppendToStrip(tif, tile,
        tif->tif_rawdata, tif->tif_rawcc))
            return ((tmsize_t)(-1));
    tif->tif_rawcc = 0;
    tif->tif_rawcp = tif->tif_rawdata;
    return (cc);
}
['tmsize_t\nTIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)\n{\n\tstatic const char module[] = "TIFFWriteEncodedTile";\n\tTIFFDirectory *td;\n\tuint16 sample;\n        uint32 howmany32;\n\tif (!WRITECHECKTILES(tif, module))\n\t\treturn ((tmsize_t)(-1));\n\ttd = &tif->tif_dir;\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "Tile %lu out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (!BUFFERCHECK(tif))\n\t\treturn ((tmsize_t)(-1));\n        tif->tif_flags |= TIFF_BUF4WRITE;\n\ttif->tif_curtile = tile;\n\tif( td->td_stripbytecount[tile] > 0 )\n        {\n            if( tif->tif_rawdatasize <= (tmsize_t) td->td_stripbytecount[tile] )\n            {\n                if( !(TIFFWriteBufferSetup(tif, NULL,\n                    (tmsize_t)TIFFroundup_64((uint64)(td->td_stripbytecount[tile] + 1), 1024))) )\n                    return ((tmsize_t)(-1));\n            }\n            tif->tif_curoff = 0;\n        }\n\ttif->tif_rawcc = 0;\n\ttif->tif_rawcp = tif->tif_rawdata;\n        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);\n        if (howmany32 == 0) {\n                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");\n                return ((tmsize_t)(-1));\n        }\n\ttif->tif_row = (tile % howmany32) * td->td_tilelength;\n        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);\n        if (howmany32 == 0) {\n                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");\n                return ((tmsize_t)(-1));\n        }\n\ttif->tif_col = (tile % howmany32) * td->td_tilewidth;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupencode)(tif))\n\t\t\treturn ((tmsize_t)(-1));\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_flags &= ~TIFF_POSTENCODE;\n\tif ( cc < 1 || cc > tif->tif_tilesize)\n\t\tcc = tif->tif_tilesize;\n    if( td->td_compression == COMPRESSION_NONE )\n    {\n        tif->tif_postdecode( tif, (uint8*) data, cc );\n        if (!isFillOrder(tif, td->td_fillorder) &&\n            (tif->tif_flags & TIFF_NOBITREV) == 0)\n            TIFFReverseBits((uint8*) data, cc);\n        if (cc > 0 &&\n            !TIFFAppendToStrip(tif, tile, (uint8*) data, cc))\n            return ((tmsize_t) -1);\n        return (cc);\n    }\n    sample = (uint16)(tile/td->td_stripsperimage);\n    if (!(*tif->tif_preencode)(tif, sample))\n        return ((tmsize_t)(-1));\n    tif->tif_postdecode( tif, (uint8*) data, cc );\n    if (!(*tif->tif_encodetile)(tif, (uint8*) data, cc, sample))\n            return ((tmsize_t) -1);\n    if (!(*tif->tif_postencode)(tif))\n            return ((tmsize_t)(-1));\n    if (!isFillOrder(tif, td->td_fillorder) &&\n        (tif->tif_flags & TIFF_NOBITREV) == 0)\n            TIFFReverseBits((uint8*)tif->tif_rawdata, tif->tif_rawcc);\n    if (tif->tif_rawcc > 0 && !TIFFAppendToStrip(tif, tile,\n        tif->tif_rawdata, tif->tif_rawcc))\n            return ((tmsize_t)(-1));\n    tif->tif_rawcc = 0;\n    tif->tif_rawcp = tif->tif_rawdata;\n    return (cc);\n}']