libtiff/tif_getimage.c:2301: error: Buffer Overrun L3
  Offset: [0, 1] Size: [0, +oo] by call to `makebwmap`.

libtiff/tif_getimage.c:2279:9: Assignment
2277.     /* treat 16 bit the same as eight bit */
2278.     if( img->bitspersample == 16 )
2279.         range = (int32) 255;
              ^
2280. 
2281.     img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));

libtiff/tif_getimage.c:2281:32: Call
2279.         range = (int32) 255;
2280. 
2281.     img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));
                                     ^
2282.     if (img->Map == NULL) {
2283. 		TIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif),

libtiff/tif_unix.c:261:17: Assignment
  259. {
  260.         if (s == 0)
  261.                 return ((void *) NULL);
                       ^
  262. 
  263. 	return (malloc((size_t) s));

libtiff/tif_getimage.c:2281:5: Assignment
2279.         range = (int32) 255;
2280. 
2281.     img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));
          ^
2282.     if (img->Map == NULL) {
2283. 		TIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif),

libtiff/tif_getimage.c:2301:7: Call
2299. 	 * unpacking tables for samples <= 8 bits.
2300. 	 */
2301. 	if (!makebwmap(img))
            ^
2302. 	    return (0);
2303. 	/* no longer need Map, free it */

libtiff/tif_getimage.c:2230:10: <Offset trace>
2228.     }
2229.     p = (uint32*)(img->BWmap + 256);
2230.     for (i = 0; i < 256; i++) {
               ^
2231. 	TIFFRGBValue c;
2232. 	img->BWmap[i] = p;

libtiff/tif_getimage.c:2230:10: Assignment
  2228.     }
  2229.     p = (uint32*)(img->BWmap + 256);
  2230.     for (i = 0; i < 256; i++) {
                 ^
  2231. 	TIFFRGBValue c;
  2232. 	img->BWmap[i] = p;

libtiff/tif_getimage.c:2211:1: <Length trace>
2209.  * number.
2210.  */
2211. static int
      ^
2212. makebwmap(TIFFRGBAImage* img)
2213. {

libtiff/tif_getimage.c:2211:1: Parameter `*img->Map`
  2209.  * number.
  2210.  */
  2211. static int
        ^
  2212. makebwmap(TIFFRGBAImage* img)
  2213. {

libtiff/tif_getimage.c:2214:5: Assignment
  2212. makebwmap(TIFFRGBAImage* img)
  2213. {
  2214.     TIFFRGBValue* Map = img->Map;
            ^
  2215.     int bitspersample = img->bitspersample;
  2216.     int nsamples = 8 / bitspersample;

libtiff/tif_getimage.c:2236:6: Array access: Offset: [0, 1] Size: [0, +oo] by call to `makebwmap` 
  2234. #define	GREY(x)	c = Map[x]; *p++ = PACK(c,c,c);
  2235. 	case 1:
  2236. 	    GREY(i>>7);
             ^
  2237. 	    GREY((i>>6)&1);
  2238. 	    GREY((i>>5)&1);

static int
makebwmap(TIFFRGBAImage* img)
{
    TIFFRGBValue* Map = img->Map;
    int bitspersample = img->bitspersample;
    int nsamples = 8 / bitspersample;
    int i;
    uint32* p;
    if( nsamples == 0 )
        nsamples = 1;
    img->BWmap = (uint32**) _TIFFmalloc(
	256*sizeof (uint32 *)+(256*nsamples*sizeof(uint32)));
    if (img->BWmap == NULL) {
		TIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif), "No space for B&W mapping table");
		return (0);
    }
    p = (uint32*)(img->BWmap + 256);
    for (i = 0; i < 256; i++) {
	TIFFRGBValue c;
	img->BWmap[i] = p;
	switch (bitspersample) {
#define	GREY(x)	c = Map[x]; *p++ = PACK(c,c,c);
	case 1:
	    GREY(i>>7);
	    GREY((i>>6)&1);
	    GREY((i>>5)&1);
	    GREY((i>>4)&1);
	    GREY((i>>3)&1);
	    GREY((i>>2)&1);
	    GREY((i>>1)&1);
	    GREY(i&1);
	    break;
	case 2:
	    GREY(i>>6);
	    GREY((i>>4)&3);
	    GREY((i>>2)&3);
	    GREY(i&3);
	    break;
	case 4:
	    GREY(i>>4);
	    GREY(i&0xf);
	    break;
	case 8:
        case 16:
	    GREY(i);
	    break;
	}
#undef	GREY
    }
    return (1);
}
['static int\nsetupMap(TIFFRGBAImage* img)\n{\n    int32 x, range;\n    range = (int32)((1L<<img->bitspersample)-1);\n    if( img->bitspersample == 16 )\n        range = (int32) 255;\n    img->Map = (TIFFRGBValue*) _TIFFmalloc((range+1) * sizeof (TIFFRGBValue));\n    if (img->Map == NULL) {\n\t\tTIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif),\n\t\t\t"No space for photometric conversion table");\n\t\treturn (0);\n    }\n    if (img->photometric == PHOTOMETRIC_MINISWHITE) {\n\tfor (x = 0; x <= range; x++)\n\t    img->Map[x] = (TIFFRGBValue) (((range - x) * 255) / range);\n    } else {\n\tfor (x = 0; x <= range; x++)\n\t    img->Map[x] = (TIFFRGBValue) ((x * 255) / range);\n    }\n    if (img->bitspersample <= 16 &&\n\t(img->photometric == PHOTOMETRIC_MINISBLACK ||\n\t img->photometric == PHOTOMETRIC_MINISWHITE)) {\n\tif (!makebwmap(img))\n\t    return (0);\n\t_TIFFfree(img->Map), img->Map = NULL;\n    }\n    return (1);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}', 'static int\nmakebwmap(TIFFRGBAImage* img)\n{\n    TIFFRGBValue* Map = img->Map;\n    int bitspersample = img->bitspersample;\n    int nsamples = 8 / bitspersample;\n    int i;\n    uint32* p;\n    if( nsamples == 0 )\n        nsamples = 1;\n    img->BWmap = (uint32**) _TIFFmalloc(\n\t256*sizeof (uint32 *)+(256*nsamples*sizeof(uint32)));\n    if (img->BWmap == NULL) {\n\t\tTIFFErrorExt(img->tif->tif_clientdata, TIFFFileName(img->tif), "No space for B&W mapping table");\n\t\treturn (0);\n    }\n    p = (uint32*)(img->BWmap + 256);\n    for (i = 0; i < 256; i++) {\n\tTIFFRGBValue c;\n\timg->BWmap[i] = p;\n\tswitch (bitspersample) {\n#define\tGREY(x)\tc = Map[x]; *p++ = PACK(c,c,c);\n\tcase 1:\n\t    GREY(i>>7);\n\t    GREY((i>>6)&1);\n\t    GREY((i>>5)&1);\n\t    GREY((i>>4)&1);\n\t    GREY((i>>3)&1);\n\t    GREY((i>>2)&1);\n\t    GREY((i>>1)&1);\n\t    GREY(i&1);\n\t    break;\n\tcase 2:\n\t    GREY(i>>6);\n\t    GREY((i>>4)&3);\n\t    GREY((i>>2)&3);\n\t    GREY(i&3);\n\t    break;\n\tcase 4:\n\t    GREY(i>>4);\n\t    GREY(i&0xf);\n\t    break;\n\tcase 8:\n        case 16:\n\t    GREY(i);\n\t    break;\n\t}\n#undef\tGREY\n    }\n    return (1);\n}']