tools/tiffcrop.c:4844: error: Buffer Overrun L3
  Offset: [2, 4294967294] Size: [3, 4294967295].

tools/tiffcrop.c:4776:26: <Offset trace>
4774.   tstrip_t  strip;
4775.   tsize_t scanlinesize = TIFFScanlineSize(in);
4776.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4777.   unsigned char *srcbuffs[MAX_SAMPLES];
4778.   unsigned char *buff = NULL;

tools/tiffcrop.c:4776:26: Call
4774.   tstrip_t  strip;
4775.   tsize_t scanlinesize = TIFFScanlineSize(in);
4776.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4777.   unsigned char *srcbuffs[MAX_SAMPLES];
4778.   unsigned char *buff = NULL;

libtiff/tif_strip.c:206:4: Call
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
          ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:199:10: Call
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
                  ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:104:4: Assignment
      102. 			TIFFErrorExt(tif->tif_clientdata,module,
      103. 			    "Invalid td_samplesperpixel value");
      104. 			return 0;
              ^
      105. 		}
      106. 		TIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,

libtiff/tif_strip.c:199:2: Assignment
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
          ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:206:2: Assignment
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
        ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:207:9: Call
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  208. }
  209. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:207:2: Assignment
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  208. }
  209. 

tools/tiffcrop.c:4776:3: Assignment
4774.   tstrip_t  strip;
4775.   tsize_t scanlinesize = TIFFScanlineSize(in);
4776.   tsize_t stripsize    = TIFFStripSize(in);
        ^
4777.   unsigned char *srcbuffs[MAX_SAMPLES];
4778.   unsigned char *buff = NULL;

tools/tiffcrop.c:4776:26: <Length trace>
4774.   tstrip_t  strip;
4775.   tsize_t scanlinesize = TIFFScanlineSize(in);
4776.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4777.   unsigned char *srcbuffs[MAX_SAMPLES];
4778.   unsigned char *buff = NULL;

tools/tiffcrop.c:4776:26: Call
4774.   tstrip_t  strip;
4775.   tsize_t scanlinesize = TIFFScanlineSize(in);
4776.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4777.   unsigned char *srcbuffs[MAX_SAMPLES];
4778.   unsigned char *buff = NULL;

libtiff/tif_strip.c:206:4: Call
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
          ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:199:10: Call
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
                  ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:104:4: Assignment
      102. 			TIFFErrorExt(tif->tif_clientdata,module,
      103. 			    "Invalid td_samplesperpixel value");
      104. 			return 0;
              ^
      105. 		}
      106. 		TIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,

libtiff/tif_strip.c:199:2: Assignment
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
          ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:206:2: Assignment
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
        ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:207:9: Call
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  208. }
  209. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:207:2: Assignment
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  208. }
  209. 

tools/tiffcrop.c:4776:3: Assignment
4774.   tstrip_t  strip;
4775.   tsize_t scanlinesize = TIFFScanlineSize(in);
4776.   tsize_t stripsize    = TIFFStripSize(in);
        ^
4777.   unsigned char *srcbuffs[MAX_SAMPLES];
4778.   unsigned char *buff = NULL;

tools/tiffcrop.c:4833:12: Call
4831.     {
4832.     srcbuffs[s] = NULL;
4833.     buff = _TIFFmalloc(stripsize + 3);
                 ^
4834.     if (!buff)
4835.       {

libtiff/tif_unix.c:312:17: Assignment
  310. {
  311.         if (s == 0)
  312.                 return ((void *) NULL);
                       ^
  313. 
  314. 	return (malloc((size_t) s));

tools/tiffcrop.c:4833:5: Assignment
4831.     {
4832.     srcbuffs[s] = NULL;
4833.     buff = _TIFFmalloc(stripsize + 3);
          ^
4834.     if (!buff)
4835.       {

tools/tiffcrop.c:4844:5: Array access: Offset: [2, 4294967294] Size: [3, 4294967295]
4842.     buff[stripsize] = 0;
4843.     buff[stripsize+1] = 0;
4844.     buff[stripsize+2] = 0;
          ^
4845.     srcbuffs[s] = buff;
4846.     }

static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,
                                         uint32 width, uint16 spp,
                                         struct dump_opts *dump)
  {
  int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;
  uint32 j;
  int32  bytes_read = 0;
  uint16 bps = 0, planar;
  uint32 nstrips;
  uint32 strips_per_sample;
  uint32 src_rowsize, dst_rowsize, rows_processed, rps;
  uint32 rows_this_strip = 0;
  tsample_t s;
  tstrip_t  strip;
  tsize_t scanlinesize = TIFFScanlineSize(in);
  tsize_t stripsize    = TIFFStripSize(in);
  unsigned char *srcbuffs[MAX_SAMPLES];
  unsigned char *buff = NULL;
  unsigned char *dst = NULL;
  if (obuf == NULL)
    {
    TIFFError("readSeparateStripsIntoBuffer","Invalid buffer argument");
    return (0);
    }
  memset (srcbuffs, '\0', sizeof(srcbuffs));
  TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps);
  TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &planar);
  TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);
  if (rps > length)
    rps = length;
  bytes_per_sample = (bps + 7) / 8;
  bytes_per_pixel  = ((bps * spp) + 7) / 8;
  if (bytes_per_pixel < (bytes_per_sample + 1))
    shift_width = bytes_per_pixel;
  else
    shift_width = bytes_per_sample + 1;
  src_rowsize = ((bps * width) + 7) / 8;
  dst_rowsize = ((bps * width * spp) + 7) / 8;
  dst = obuf;
  if ((dump->infile != NULL) && (dump->level == 3))
    {
    dump_info  (dump->infile, dump->format, "",
                "Image width %d, length %d, Scanline size, %4d bytes",
                width, length,  scanlinesize);
    dump_info  (dump->infile, dump->format, "",
                "Bits per sample %d, Samples per pixel %d, Shift width %d",
		bps, spp, shift_width);
    }
  nstrips = TIFFNumberOfStrips(in);
  strips_per_sample = nstrips /spp;
  if( (size_t) stripsize > 0xFFFFFFFFU - 3U )
  {
      TIFFError("readSeparateStripsIntoBuffer", "Integer overflow when calculating buffer size.");
      exit(-1);
  }
  for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
    {
    srcbuffs[s] = NULL;
    buff = _TIFFmalloc(stripsize + 3);
    if (!buff)
      {
      TIFFError ("readSeparateStripsIntoBuffer",
                 "Unable to allocate strip read buffer for sample %d", s);
      for (i = 0; i < s; i++)
        _TIFFfree (srcbuffs[i]);
      return 0;
      }
    buff[stripsize] = 0;
    buff[stripsize+1] = 0;
    buff[stripsize+2] = 0;
    srcbuffs[s] = buff;
    }
  rows_processed = 0;
  for (j = 0; (j < strips_per_sample) && (result == 1); j++)
    {
    for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
      {
      buff = srcbuffs[s];
      strip = (s * strips_per_sample) + j;
      bytes_read = TIFFReadEncodedStrip (in, strip, buff, stripsize);
      rows_this_strip = bytes_read / src_rowsize;
      if (bytes_read < 0 && !ignore)
        {
        TIFFError(TIFFFileName(in),
	          "Error, can't read strip %lu for sample %d",
         	   (unsigned long) strip, s + 1);
        result = 0;
        break;
        }
#ifdef DEVELMODE
      TIFFError("", "Strip %2d, read %5d bytes for %4d scanlines, shift width %d",
		strip, bytes_read, rows_this_strip, shift_width);
#endif
      }
    if (rps > rows_this_strip)
      rps = rows_this_strip;
    dst = obuf + (dst_rowsize * rows_processed);
    if ((bps % 8) == 0)
      {
      if (combineSeparateSamplesBytes (srcbuffs, dst, width, rps,
                                       spp, bps, dump->infile,
                                       dump->format, dump->level))
        {
        result = 0;
        break;
	}
      }
    else
      {
      switch (shift_width)
        {
        case 1: if (combineSeparateSamples8bits (srcbuffs, dst, width, rps,
                                                 spp, bps, dump->infile,
                                                 dump->format, dump->level))
	          {
                  result = 0;
                  break;
      	          }
	        break;
        case 2: if (combineSeparateSamples16bits (srcbuffs, dst, width, rps,
                                                  spp, bps, dump->infile,
                                                  dump->format, dump->level))
	          {
                  result = 0;
                  break;
		  }
	        break;
        case 3: if (combineSeparateSamples24bits (srcbuffs, dst, width, rps,
                                                  spp, bps, dump->infile,
                                                  dump->format, dump->level))
	          {
                  result = 0;
                  break;
       	          }
                break;
        case 4:
        case 5:
        case 6:
        case 7:
        case 8: if (combineSeparateSamples32bits (srcbuffs, dst, width, rps,
                                                  spp, bps, dump->infile,
                                                  dump->format, dump->level))
	          {
                  result = 0;
                  break;
		  }
	        break;
        default: TIFFError ("readSeparateStripsIntoBuffer", "Unsupported bit depth: %d", bps);
                  result = 0;
                  break;
        }
      }
    if ((rows_processed + rps) > length)
      {
      rows_processed = length;
      rps = length - rows_processed;
      }
    else
      rows_processed += rps;
    }
  for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)
    {
    buff = srcbuffs[s];
    if (buff != NULL)
      _TIFFfree(buff);
    }
  return (result);
  }
['static int readSeparateStripsIntoBuffer (TIFF *in, uint8 *obuf, uint32 length,\n                                         uint32 width, uint16 spp,\n                                         struct dump_opts *dump)\n  {\n  int i, bytes_per_sample, bytes_per_pixel, shift_width, result = 1;\n  uint32 j;\n  int32  bytes_read = 0;\n  uint16 bps = 0, planar;\n  uint32 nstrips;\n  uint32 strips_per_sample;\n  uint32 src_rowsize, dst_rowsize, rows_processed, rps;\n  uint32 rows_this_strip = 0;\n  tsample_t s;\n  tstrip_t  strip;\n  tsize_t scanlinesize = TIFFScanlineSize(in);\n  tsize_t stripsize    = TIFFStripSize(in);\n  unsigned char *srcbuffs[MAX_SAMPLES];\n  unsigned char *buff = NULL;\n  unsigned char *dst = NULL;\n  if (obuf == NULL)\n    {\n    TIFFError("readSeparateStripsIntoBuffer","Invalid buffer argument");\n    return (0);\n    }\n  memset (srcbuffs, \'\\0\', sizeof(srcbuffs));\n  TIFFGetFieldDefaulted(in, TIFFTAG_BITSPERSAMPLE, &bps);\n  TIFFGetFieldDefaulted(in, TIFFTAG_PLANARCONFIG, &planar);\n  TIFFGetFieldDefaulted(in, TIFFTAG_ROWSPERSTRIP, &rps);\n  if (rps > length)\n    rps = length;\n  bytes_per_sample = (bps + 7) / 8;\n  bytes_per_pixel  = ((bps * spp) + 7) / 8;\n  if (bytes_per_pixel < (bytes_per_sample + 1))\n    shift_width = bytes_per_pixel;\n  else\n    shift_width = bytes_per_sample + 1;\n  src_rowsize = ((bps * width) + 7) / 8;\n  dst_rowsize = ((bps * width * spp) + 7) / 8;\n  dst = obuf;\n  if ((dump->infile != NULL) && (dump->level == 3))\n    {\n    dump_info  (dump->infile, dump->format, "",\n                "Image width %d, length %d, Scanline size, %4d bytes",\n                width, length,  scanlinesize);\n    dump_info  (dump->infile, dump->format, "",\n                "Bits per sample %d, Samples per pixel %d, Shift width %d",\n\t\tbps, spp, shift_width);\n    }\n  nstrips = TIFFNumberOfStrips(in);\n  strips_per_sample = nstrips /spp;\n  if( (size_t) stripsize > 0xFFFFFFFFU - 3U )\n  {\n      TIFFError("readSeparateStripsIntoBuffer", "Integer overflow when calculating buffer size.");\n      exit(-1);\n  }\n  for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)\n    {\n    srcbuffs[s] = NULL;\n    buff = _TIFFmalloc(stripsize + 3);\n    if (!buff)\n      {\n      TIFFError ("readSeparateStripsIntoBuffer",\n                 "Unable to allocate strip read buffer for sample %d", s);\n      for (i = 0; i < s; i++)\n        _TIFFfree (srcbuffs[i]);\n      return 0;\n      }\n    buff[stripsize] = 0;\n    buff[stripsize+1] = 0;\n    buff[stripsize+2] = 0;\n    srcbuffs[s] = buff;\n    }\n  rows_processed = 0;\n  for (j = 0; (j < strips_per_sample) && (result == 1); j++)\n    {\n    for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)\n      {\n      buff = srcbuffs[s];\n      strip = (s * strips_per_sample) + j;\n      bytes_read = TIFFReadEncodedStrip (in, strip, buff, stripsize);\n      rows_this_strip = bytes_read / src_rowsize;\n      if (bytes_read < 0 && !ignore)\n        {\n        TIFFError(TIFFFileName(in),\n\t          "Error, can\'t read strip %lu for sample %d",\n         \t   (unsigned long) strip, s + 1);\n        result = 0;\n        break;\n        }\n#ifdef DEVELMODE\n      TIFFError("", "Strip %2d, read %5d bytes for %4d scanlines, shift width %d",\n\t\tstrip, bytes_read, rows_this_strip, shift_width);\n#endif\n      }\n    if (rps > rows_this_strip)\n      rps = rows_this_strip;\n    dst = obuf + (dst_rowsize * rows_processed);\n    if ((bps % 8) == 0)\n      {\n      if (combineSeparateSamplesBytes (srcbuffs, dst, width, rps,\n                                       spp, bps, dump->infile,\n                                       dump->format, dump->level))\n        {\n        result = 0;\n        break;\n\t}\n      }\n    else\n      {\n      switch (shift_width)\n        {\n        case 1: if (combineSeparateSamples8bits (srcbuffs, dst, width, rps,\n                                                 spp, bps, dump->infile,\n                                                 dump->format, dump->level))\n\t          {\n                  result = 0;\n                  break;\n      \t          }\n\t        break;\n        case 2: if (combineSeparateSamples16bits (srcbuffs, dst, width, rps,\n                                                  spp, bps, dump->infile,\n                                                  dump->format, dump->level))\n\t          {\n                  result = 0;\n                  break;\n\t\t  }\n\t        break;\n        case 3: if (combineSeparateSamples24bits (srcbuffs, dst, width, rps,\n                                                  spp, bps, dump->infile,\n                                                  dump->format, dump->level))\n\t          {\n                  result = 0;\n                  break;\n       \t          }\n                break;\n        case 4:\n        case 5:\n        case 6:\n        case 7:\n        case 8: if (combineSeparateSamples32bits (srcbuffs, dst, width, rps,\n                                                  spp, bps, dump->infile,\n                                                  dump->format, dump->level))\n\t          {\n                  result = 0;\n                  break;\n\t\t  }\n\t        break;\n        default: TIFFError ("readSeparateStripsIntoBuffer", "Unsupported bit depth: %d", bps);\n                  result = 0;\n                  break;\n        }\n      }\n    if ((rows_processed + rps) > length)\n      {\n      rows_processed = length;\n      rps = length - rows_processed;\n      }\n    else\n      rows_processed += rps;\n    }\n  for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++)\n    {\n    buff = srcbuffs[s];\n    if (buff != NULL)\n      _TIFFfree(buff);\n    }\n  return (result);\n  }', 'tmsize_t\nTIFFStripSize(TIFF* tif)\n{\n\tstatic const char module[] = "TIFFStripSize";\n\tuint64 m;\n\tm=TIFFStripSize64(tif);\n\treturn _TIFFCastUInt64ToSSize(tif, m, module);\n}', 'uint64\nTIFFStripSize64(TIFF* tif)\n{\n\tTIFFDirectory* td = &tif->tif_dir;\n\tuint32 rps = td->td_rowsperstrip;\n\tif (rps > td->td_imagelength)\n\t\trps = td->td_imagelength;\n\treturn (TIFFVStripSize64(tif, rps));\n}', 'uint64\nTIFFVStripSize64(TIFF* tif, uint32 nrows)\n{\n\tstatic const char module[] = "TIFFVStripSize64";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (nrows==(uint32)(-1))\n\t\tnrows=td->td_imagelength;\n\tif ((td->td_planarconfig==PLANARCONFIG_CONTIG)&&\n\t    (td->td_photometric == PHOTOMETRIC_YCBCR)&&\n\t    (!isUpSampled(tif)))\n\t{\n\t\tuint16 ycbcrsubsampling[2];\n\t\tuint16 samplingblock_samples;\n\t\tuint32 samplingblocks_hor;\n\t\tuint32 samplingblocks_ver;\n\t\tuint64 samplingrow_samples;\n\t\tuint64 samplingrow_size;\n\t\tif(td->td_samplesperpixel!=3)\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t    "Invalid td_samplesperpixel value");\n\t\t\treturn 0;\n\t\t}\n\t\tTIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,\n\t\t    ycbcrsubsampling+1);\n\t\tif ((ycbcrsubsampling[0] != 1 && ycbcrsubsampling[0] != 2 && ycbcrsubsampling[0] != 4)\n\t\t    ||(ycbcrsubsampling[1] != 1 && ycbcrsubsampling[1] != 2 && ycbcrsubsampling[1] != 4))\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t\t     "Invalid YCbCr subsampling (%dx%d)",\n\t\t\t\t     ycbcrsubsampling[0],\n\t\t\t\t     ycbcrsubsampling[1] );\n\t\t\treturn 0;\n\t\t}\n\t\tsamplingblock_samples=ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;\n\t\tsamplingblocks_hor=TIFFhowmany_32(td->td_imagewidth,ycbcrsubsampling[0]);\n\t\tsamplingblocks_ver=TIFFhowmany_32(nrows,ycbcrsubsampling[1]);\n\t\tsamplingrow_samples=_TIFFMultiply64(tif,samplingblocks_hor,samplingblock_samples,module);\n\t\tsamplingrow_size=TIFFhowmany8_64(_TIFFMultiply64(tif,samplingrow_samples,td->td_bitspersample,module));\n\t\treturn(_TIFFMultiply64(tif,samplingrow_size,samplingblocks_ver,module));\n\t}\n\telse\n\t\treturn(_TIFFMultiply64(tif,nrows,TIFFScanlineSize64(tif),module));\n}', 'tmsize_t _TIFFCastUInt64ToSSize(TIFF* tif, uint64 val, const char* module)\n{\n    if( val > (uint64)TIFF_TMSIZE_T_MAX )\n    {\n        if( tif != NULL && module != NULL )\n        {\n            TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n        }\n        return 0;\n    }\n    return (tmsize_t)val;\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}']