libtiff/tif_getimage.c:934: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip`.

libtiff/tif_getimage.c:907:37: Call
905. 	}
906. 
907. 	buf = (unsigned char*) _TIFFmalloc(TIFFStripSize(tif));
                                         ^
908. 	if (buf == 0) {
909. 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");

libtiff/tif_strip.c:211:1: Parameter `tif->tif_dir.td_imagelength`
  209. 	return (TIFFVStripSize64(tif, rps));
  210. }
  211. tmsize_t
       ^
  212. TIFFStripSize(TIFF* tif)
  213. {

libtiff/tif_strip.c:217:4: Call
  215. 	uint64 m;
  216. 	tmsize_t n;
  217. 	m=TIFFStripSize64(tif);
          ^
  218. 	n=(tmsize_t)m;
  219. 	if ((uint64)n!=m)

libtiff/tif_strip.c:202:1: Parameter `tif->tif_dir.td_imagelength`
    200.  * to hold the strip.
    201.  */
    202. uint64
         ^
    203. TIFFStripSize64(TIFF* tif)
    204. {

libtiff/tif_getimage.c:912:22: Call
910. 		return (0);
911. 	}
912. 	_TIFFmemset(buf, 0, TIFFStripSize(tif));
                          ^
913. 
914. 	flip = setorientation(img);

libtiff/tif_strip.c:211:1: Parameter `tif->tif_dir.td_imagelength`
  209. 	return (TIFFVStripSize64(tif, rps));
  210. }
  211. tmsize_t
       ^
  212. TIFFStripSize(TIFF* tif)
  213. {

libtiff/tif_strip.c:217:4: Call
  215. 	uint64 m;
  216. 	tmsize_t n;
  217. 	m=TIFFStripSize64(tif);
          ^
  218. 	n=(tmsize_t)m;
  219. 	if ((uint64)n!=m)

libtiff/tif_strip.c:202:1: Parameter `tif->tif_dir.td_imagelength`
    200.  * to hold the strip.
    201.  */
    202. uint64
         ^
    203. TIFFStripSize64(TIFF* tif)
    204. {

libtiff/tif_getimage.c:934:7: Call
932. 		if ((nrowsub%subsamplingver)!=0)
933. 			nrowsub+=subsamplingver-nrowsub%subsamplingver;
934. 		if (TIFFReadEncodedStrip(tif,
           ^
935. 		    TIFFComputeStrip(tif,row+img->row_offset, 0),
936. 		    buf,

libtiff/tif_read.c:316:1: <LHS trace>
314.  * amount into the user-supplied buffer.
315.  */
316. tmsize_t
     ^
317. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
318. {

libtiff/tif_read.c:316:1: Parameter `tif->tif_dir.td_imagelength`
  314.  * amount into the user-supplied buffer.
  315.  */
  316. tmsize_t
       ^
  317. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  318. {

libtiff/tif_read.c:344:2: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip` 
  342. 	if (rowsperstrip>td->td_imagelength)
  343. 		rowsperstrip=td->td_imagelength;
  344. 	stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
        ^
  345. 	stripinplane=(strip%stripsperplane);
  346. 	plane=(uint16)(strip/stripsperplane);

tmsize_t
TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
{
	static const char module[] = "TIFFReadEncodedStrip";
	TIFFDirectory *td = &tif->tif_dir;
	uint32 rowsperstrip;
	uint32 stripsperplane;
	uint32 stripinplane;
	uint16 plane;
	uint32 rows;
	tmsize_t stripsize;
	if (!TIFFCheckRead(tif,0))
		return((tmsize_t)(-1));
	if (strip>=td->td_nstrips)
	{
		TIFFErrorExt(tif->tif_clientdata,module,
		    "%lu: Strip out of range, max %lu",(unsigned long)strip,
		    (unsigned long)td->td_nstrips);
		return((tmsize_t)(-1));
	}
	rowsperstrip=td->td_rowsperstrip;
	if (rowsperstrip>td->td_imagelength)
		rowsperstrip=td->td_imagelength;
	stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
	stripinplane=(strip%stripsperplane);
	plane=(uint16)(strip/stripsperplane);
	rows=td->td_imagelength-stripinplane*rowsperstrip;
	if (rows>rowsperstrip)
		rows=rowsperstrip;
	stripsize=TIFFVStripSize(tif,rows);
	if (stripsize==0)
		return((tmsize_t)(-1));
	if ((size!=(tmsize_t)(-1))&&(size<stripsize))
		stripsize=size;
	if (!TIFFFillStrip(tif,strip))
		return((tmsize_t)(-1));
	if ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)
		return((tmsize_t)(-1));
	(*tif->tif_postdecode)(tif,buf,stripsize);
	return(stripsize);
}
['static int\ngtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)\n{\n\tTIFF* tif = img->tif;\n\ttileContigRoutine put = img->put.contig;\n\tuint32 row, y, nrow, nrowsub, rowstoread;\n\ttmsize_t pos;\n\tunsigned char* buf;\n\tuint32 rowsperstrip;\n\tuint16 subsamplinghor,subsamplingver;\n\tuint32 imagewidth = img->width;\n\ttmsize_t scanline;\n\tint32 fromskew, toskew;\n\tint ret = 1, flip;\n\tTIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, &subsamplingver);\n\tif( subsamplingver == 0 ) {\n\t\tTIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Invalid vertical YCbCr subsampling");\n\t\treturn (0);\n\t}\n\tbuf = (unsigned char*) _TIFFmalloc(TIFFStripSize(tif));\n\tif (buf == 0) {\n\t\tTIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");\n\t\treturn (0);\n\t}\n\t_TIFFmemset(buf, 0, TIFFStripSize(tif));\n\tflip = setorientation(img);\n\tif (flip & FLIP_VERTICALLY) {\n\t\ty = h - 1;\n\t\ttoskew = -(int32)(w + w);\n\t} else {\n\t\ty = 0;\n\t\ttoskew = -(int32)(w - w);\n\t}\n\tTIFFGetFieldDefaulted(tif, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);\n\tscanline = TIFFScanlineSize(tif);\n\tfromskew = (w < imagewidth ? imagewidth - w : 0);\n\tfor (row = 0; row < h; row += nrow)\n\t{\n\t\trowstoread = rowsperstrip - (row + img->row_offset) % rowsperstrip;\n\t\tnrow = (row + rowstoread > h ? h - row : rowstoread);\n\t\tnrowsub = nrow;\n\t\tif ((nrowsub%subsamplingver)!=0)\n\t\t\tnrowsub+=subsamplingver-nrowsub%subsamplingver;\n\t\tif (TIFFReadEncodedStrip(tif,\n\t\t    TIFFComputeStrip(tif,row+img->row_offset, 0),\n\t\t    buf,\n\t\t    ((row + img->row_offset)%rowsperstrip + nrowsub) * scanline)==(tmsize_t)(-1)\n\t\t    && img->stoponerr)\n\t\t{\n\t\t\tret = 0;\n\t\t\tbreak;\n\t\t}\n\t\tpos = ((row + img->row_offset) % rowsperstrip) * scanline + \\\n\t\t\t((tmsize_t) img->col_offset * img->samplesperpixel);\n\t\t(*put)(img, raster+y*w, 0, y, w, nrow, fromskew, toskew, buf + pos);\n\t\ty += (flip & FLIP_VERTICALLY ? -(int32) nrow : (int32) nrow);\n\t}\n\tif (flip & FLIP_HORIZONTALLY) {\n\t\tuint32 line;\n\t\tfor (line = 0; line < h; line++) {\n\t\t\tuint32 *left = raster + (line * w);\n\t\t\tuint32 *right = left + w - 1;\n\t\t\twhile ( left < right ) {\n\t\t\t\tuint32 temp = *left;\n\t\t\t\t*left = *right;\n\t\t\t\t*right = temp;\n\t\t\t\tleft++, right--;\n\t\t\t}\n\t\t}\n\t}\n\t_TIFFfree(buf);\n\treturn (ret);\n}', 'tmsize_t\nTIFFStripSize(TIFF* tif)\n{\n\tstatic const char module[] = "TIFFStripSize";\n\tuint64 m;\n\ttmsize_t n;\n\tm=TIFFStripSize64(tif);\n\tn=(tmsize_t)m;\n\tif ((uint64)n!=m)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\tn=0;\n\t}\n\treturn(n);\n}', 'uint64\nTIFFStripSize64(TIFF* tif)\n{\n\tTIFFDirectory* td = &tif->tif_dir;\n\tuint32 rps = td->td_rowsperstrip;\n\tif (rps > td->td_imagelength)\n\t\trps = td->td_imagelength;\n\treturn (TIFFVStripSize64(tif, rps));\n}', 'tmsize_t\nTIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedStrip";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tuint32 rowsperstrip;\n\tuint32 stripsperplane;\n\tuint32 stripinplane;\n\tuint16 plane;\n\tuint32 rows;\n\ttmsize_t stripsize;\n\tif (!TIFFCheckRead(tif,0))\n\t\treturn((tmsize_t)(-1));\n\tif (strip>=td->td_nstrips)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t    "%lu: Strip out of range, max %lu",(unsigned long)strip,\n\t\t    (unsigned long)td->td_nstrips);\n\t\treturn((tmsize_t)(-1));\n\t}\n\trowsperstrip=td->td_rowsperstrip;\n\tif (rowsperstrip>td->td_imagelength)\n\t\trowsperstrip=td->td_imagelength;\n\tstripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);\n\tstripinplane=(strip%stripsperplane);\n\tplane=(uint16)(strip/stripsperplane);\n\trows=td->td_imagelength-stripinplane*rowsperstrip;\n\tif (rows>rowsperstrip)\n\t\trows=rowsperstrip;\n\tstripsize=TIFFVStripSize(tif,rows);\n\tif (stripsize==0)\n\t\treturn((tmsize_t)(-1));\n\tif ((size!=(tmsize_t)(-1))&&(size<stripsize))\n\t\tstripsize=size;\n\tif (!TIFFFillStrip(tif,strip))\n\t\treturn((tmsize_t)(-1));\n\tif ((*tif->tif_decodestrip)(tif,buf,stripsize,plane)<=0)\n\t\treturn((tmsize_t)(-1));\n\t(*tif->tif_postdecode)(tif,buf,stripsize);\n\treturn(stripsize);\n}']