libtiff/tif_zip.c:169: error: Integer Overflow L2
  ([min(1, `occ`), 4294967295] - [min(1, `occ`), 4294967295]):unsigned32.

libtiff/tif_zip.c:164:41: <LHS trace>
162.                 int state;
163.                 uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                                             ^
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;

libtiff/tif_zip.c:164:41: Assignment
162.                 int state;
163.                 uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                                             ^
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;

libtiff/tif_zip.c:164:17: Assignment
162.                 int state;
163.                 uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                     ^
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;

libtiff/tif_zip.c:164:41: <RHS trace>
162.                 int state;
163.                 uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                                             ^
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;

libtiff/tif_zip.c:164:41: Assignment
162.                 int state;
163.                 uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                                             ^
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;

libtiff/tif_zip.c:164:17: Assignment
162.                 int state;
163.                 uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                     ^
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;

libtiff/tif_zip.c:166:17: Assignment
164.                 uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
165.                 sp->stream.avail_in = avail_in_before;
166.                 sp->stream.avail_out = avail_out_before;
                     ^
167. 		state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
168. 		tif->tif_rawcc -= (avail_in_before - sp->stream.avail_in);

libtiff/tif_zip.c:169:17: Binary operation: ([min(1, occ), 4294967295] - [min(1, occ), 4294967295]):unsigned32
167. 		state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
168. 		tif->tif_rawcc -= (avail_in_before - sp->stream.avail_in);
169.                 occ -= (avail_out_before - sp->stream.avail_out);
                     ^
170. 		if (state == Z_STREAM_END)
171. 			break;

static int
ZIPDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)
{
	static const char module[] = "ZIPDecode";
	ZIPState* sp = DecoderState(tif);
	(void) s;
	assert(sp != NULL);
	assert(sp->state == ZSTATE_INIT_DECODE);
        sp->stream.next_in = tif->tif_rawcp;
	sp->stream.next_out = op;
	assert(sizeof(sp->stream.avail_out)==4);
	do {
                int state;
                uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;
                uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;
                sp->stream.avail_in = avail_in_before;
                sp->stream.avail_out = avail_out_before;
		state = inflate(&sp->stream, Z_PARTIAL_FLUSH);
		tif->tif_rawcc -= (avail_in_before - sp->stream.avail_in);
                occ -= (avail_out_before - sp->stream.avail_out);
		if (state == Z_STREAM_END)
			break;
		if (state == Z_DATA_ERROR) {
			TIFFErrorExt(tif->tif_clientdata, module,
			    "Decoding error at scanline %lu, %s",
			     (unsigned long) tif->tif_row, SAFE_MSG(sp));
			return (0);
			continue;
		}
		if (state != Z_OK) {
			TIFFErrorExt(tif->tif_clientdata, module,
				     "ZLib error: %s", SAFE_MSG(sp));
			return (0);
		}
	} while (occ > 0);
	if (occ != 0) {
		TIFFErrorExt(tif->tif_clientdata, module,
		    "Not enough data at scanline %lu (short " TIFF_UINT64_FORMAT " bytes)",
		    (unsigned long) tif->tif_row, (TIFF_UINT64_T) occ);
		return (0);
	}
        tif->tif_rawcp = sp->stream.next_in;
	return (1);
}
['static int\nZIPDecode(TIFF* tif, uint8* op, tmsize_t occ, uint16 s)\n{\n\tstatic const char module[] = "ZIPDecode";\n\tZIPState* sp = DecoderState(tif);\n\t(void) s;\n\tassert(sp != NULL);\n\tassert(sp->state == ZSTATE_INIT_DECODE);\n        sp->stream.next_in = tif->tif_rawcp;\n\tsp->stream.next_out = op;\n\tassert(sizeof(sp->stream.avail_out)==4);\n\tdo {\n                int state;\n                uInt avail_in_before = (uint64)tif->tif_rawcc <= 0xFFFFFFFFU ? (uInt)tif->tif_rawcc : 0xFFFFFFFFU;\n                uInt avail_out_before = (uint64)occ < 0xFFFFFFFFU ? (uInt) occ : 0xFFFFFFFFU;\n                sp->stream.avail_in = avail_in_before;\n                sp->stream.avail_out = avail_out_before;\n\t\tstate = inflate(&sp->stream, Z_PARTIAL_FLUSH);\n\t\ttif->tif_rawcc -= (avail_in_before - sp->stream.avail_in);\n                occ -= (avail_out_before - sp->stream.avail_out);\n\t\tif (state == Z_STREAM_END)\n\t\t\tbreak;\n\t\tif (state == Z_DATA_ERROR) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "Decoding error at scanline %lu, %s",\n\t\t\t     (unsigned long) tif->tif_row, SAFE_MSG(sp));\n\t\t\treturn (0);\n\t\t\tcontinue;\n\t\t}\n\t\tif (state != Z_OK) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t     "ZLib error: %s", SAFE_MSG(sp));\n\t\t\treturn (0);\n\t\t}\n\t} while (occ > 0);\n\tif (occ != 0) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "Not enough data at scanline %lu (short " TIFF_UINT64_FORMAT " bytes)",\n\t\t    (unsigned long) tif->tif_row, (TIFF_UINT64_T) occ);\n\t\treturn (0);\n\t}\n        tif->tif_rawcp = sp->stream.next_in;\n\treturn (1);\n}']