tools/tiff2ps.c:2256: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReverseBits`.

tools/tiff2ps.c:2203:3: Assignment
2201. 
2202. 	if (use_rawdata) {
2203. 		chunk_size = (tsize_t) bc[0];
        ^
2204. 		for (chunk_no = 1; chunk_no < num_chunks; chunk_no++)
2205. 			if ((tsize_t) bc[chunk_no] > chunk_size)

tools/tiff2ps.c:2213:30: Call
2211. 			chunk_size = TIFFStripSize(tif);
2212. 	}
2213. 	buf_data = (unsigned char *)limitMalloc(chunk_size);
                                   ^
2214. 	if (!buf_data) {
2215. 		TIFFError(filename, "Can't alloc %lu bytes for %s.",

tools/tiff2ps.c:252:3: Assignment
  250. 		        (uint64)s, (uint64)maxMalloc);
  251. 		fprintf(stderr, "                  use -M option to change limit.\n");
  252. 		return NULL;
         ^
  253. 	}
  254. 	return _TIFFmalloc(s);

tools/tiff2ps.c:2213:2: Assignment
2211. 			chunk_size = TIFFStripSize(tif);
2212. 	}
2213. 	buf_data = (unsigned char *)limitMalloc(chunk_size);
       ^
2214. 	if (!buf_data) {
2215. 		TIFFError(filename, "Can't alloc %lu bytes for %s.",

tools/tiff2ps.c:2256:8: Call
2254. 						  buf_data, chunk_size);
2255. 			if (fillorder == FILLORDER_LSB2MSB)
2256. 			    TIFFReverseBits(buf_data, byte_count);
             ^
2257. 		} else {
2258. 			if (tiled_image)

libtiff/tif_swab.c:283:1: <Length trace>
281. }
282. 
283. void
     ^
284. TIFFReverseBits(uint8* cp, tmsize_t n)  
285. {

libtiff/tif_swab.c:283:1: Parameter `*cp`
  281. }
  282. 
  283. void
       ^
  284. TIFFReverseBits(uint8* cp, tmsize_t n)  
  285. {

libtiff/tif_swab.c:294:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReverseBits` 
  292. 		cp[5] = TIFFBitRevTable[cp[5]];
  293. 		cp[6] = TIFFBitRevTable[cp[6]];
  294. 		cp[7] = TIFFBitRevTable[cp[7]];
         ^
  295. 		cp += 8;
  296. 	}

void
TIFFReverseBits(uint8* cp, tmsize_t n)
{
	for (; n > 8; n -= 8) {
		cp[0] = TIFFBitRevTable[cp[0]];
		cp[1] = TIFFBitRevTable[cp[1]];
		cp[2] = TIFFBitRevTable[cp[2]];
		cp[3] = TIFFBitRevTable[cp[3]];
		cp[4] = TIFFBitRevTable[cp[4]];
		cp[5] = TIFFBitRevTable[cp[5]];
		cp[6] = TIFFBitRevTable[cp[6]];
		cp[7] = TIFFBitRevTable[cp[7]];
		cp += 8;
	}
	while (n-- > 0) {
		*cp = TIFFBitRevTable[*cp];
		cp++;
	}
}
['int\nPS_Lvl2page(FILE* fd, TIFF* tif, uint32 w, uint32 h)\n{\n\tuint16 fillorder;\n\tint use_rawdata, tiled_image, breaklen = MAXLINE;\n\tuint32 chunk_no, num_chunks;\n        uint64 *bc;\n\tunsigned char *buf_data, *cp;\n\ttsize_t chunk_size, byte_count;\n#if defined( EXP_ASCII85ENCODER )\n\ttsize_t\t\t\tascii85_l;\n\tuint8\t\t*\tascii85_p = 0;\n#endif\n\tPS_Lvl2colorspace(fd, tif);\n\tuse_rawdata = PS_Lvl2ImageDict(fd, tif, w, h);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%BeginData:\\n", fd);\n#endif\n\tfputs("exec\\n", fd);\n\ttiled_image = TIFFIsTiled(tif);\n\tif (tiled_image) {\n\t\tnum_chunks = TIFFNumberOfTiles(tif);\n\t\tTIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc);\n\t} else {\n\t\tnum_chunks = TIFFNumberOfStrips(tif);\n\t\tTIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);\n\t}\n\tif (use_rawdata) {\n\t\tchunk_size = (tsize_t) bc[0];\n\t\tfor (chunk_no = 1; chunk_no < num_chunks; chunk_no++)\n\t\t\tif ((tsize_t) bc[chunk_no] > chunk_size)\n\t\t\t\tchunk_size = (tsize_t) bc[chunk_no];\n\t} else {\n\t\tif (tiled_image)\n\t\t\tchunk_size = TIFFTileSize(tif);\n\t\telse\n\t\t\tchunk_size = TIFFStripSize(tif);\n\t}\n\tbuf_data = (unsigned char *)limitMalloc(chunk_size);\n\tif (!buf_data) {\n\t\tTIFFError(filename, "Can\'t alloc %lu bytes for %s.",\n\t\t\t(unsigned long) chunk_size, tiled_image ? "tiles" : "strips");\n\t\treturn(FALSE);\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85 ) {\n\t    ascii85_p = limitMalloc( (chunk_size+(chunk_size/2)) + 8 );\n\t    if ( !ascii85_p ) {\n\t\t_TIFFfree( buf_data );\n\t\tTIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );\n\t\treturn ( FALSE );\n\t    }\n\t}\n#endif\n\tTIFFGetFieldDefaulted(tif, TIFFTAG_FILLORDER, &fillorder);\n\tfor (chunk_no = 0; chunk_no < num_chunks; chunk_no++) {\n\t\tif (ascii85)\n\t\t\tAscii85Init();\n\t\telse\n\t\t\tbreaklen = MAXLINE;\n\t\tif (use_rawdata) {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadRawTile(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadRawStrip(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\tif (fillorder == FILLORDER_LSB2MSB)\n\t\t\t    TIFFReverseBits(buf_data, byte_count);\n\t\t} else {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadEncodedTile(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadEncodedStrip(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t}\n\t\tif (byte_count < 0) {\n\t\t\tTIFFError(filename, "Can\'t read %s %d.",\n\t\t\t\ttiled_image ? "tile" : "strip", chunk_no);\n\t\t\tif (ascii85)\n\t\t\t\tAscii85Put(\'\\0\', fd);\n\t\t}\n\t\tif (bitspersample == 16 && !TIFFIsBigEndian(tif)) {\n\t\t\tPS_FlipBytes(buf_data, byte_count);\n\t\t}\n\t\tif (alpha) {\n\t\t\tint adjust, i, j = 0;\n\t\t\tint ncomps = samplesperpixel - extrasamples;\n\t\t\tfor (i = 0; (i + ncomps) < byte_count; i+=samplesperpixel) {\n\t\t\t\tadjust = 255 - buf_data[i + ncomps];\n\t\t\t\tswitch (ncomps) {\n\t\t\t\t\tcase 1:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 2:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 3:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+2] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbyte_count -= j;\n\t\t}\n\t\tif (ascii85) {\n#if defined( EXP_ASCII85ENCODER )\n\t\t\tascii85_l = Ascii85EncodeBlock(ascii85_p, 1, buf_data, byte_count );\n\t\t\tif ( ascii85_l > 0 )\n\t\t\t\tfwrite( ascii85_p, ascii85_l, 1, fd );\n#else\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--)\n\t\t\t\tAscii85Put(*cp++, fd);\n#endif\n\t\t}\n\t\telse\n\t\t{\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--) {\n\t\t\t\tputc(hex[((*cp)>>4)&0xf], fd);\n\t\t\t\tputc(hex[(*cp)&0xf], fd);\n\t\t\t\tcp++;\n\t\t\t\tif (--breaklen <= 0) {\n\t\t\t\t\tputc(\'\\n\', fd);\n\t\t\t\t\tbreaklen = MAXLINE;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif ( !ascii85 ) {\n\t\t\tif ( level2 || level3 )\n\t\t\t\tputc( \'>\', fd );\n\t\t\tputc(\'\\n\', fd);\n\t\t}\n#if !defined( EXP_ASCII85ENCODER )\n\t\telse\n\t\t\tAscii85Flush(fd);\n#endif\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85_p )\n\t    _TIFFfree( ascii85_p );\n#endif\n\t_TIFFfree(buf_data);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%EndData\\n", fd);\n#endif\n\treturn(TRUE);\n}', 'static void* limitMalloc(tmsize_t s)\n{\n\tif (maxMalloc && (s > maxMalloc)) {\n\t\tfprintf(stderr, "MemoryLimitError: allocation of " TIFF_UINT64_FORMAT " bytes is forbidden. Limit is " TIFF_UINT64_FORMAT ".\\n",\n\t\t        (uint64)s, (uint64)maxMalloc);\n\t\tfprintf(stderr, "                  use -M option to change limit.\\n");\n\t\treturn NULL;\n\t}\n\treturn _TIFFmalloc(s);\n}', 'void\nTIFFReverseBits(uint8* cp, tmsize_t n)\n{\n\tfor (; n > 8; n -= 8) {\n\t\tcp[0] = TIFFBitRevTable[cp[0]];\n\t\tcp[1] = TIFFBitRevTable[cp[1]];\n\t\tcp[2] = TIFFBitRevTable[cp[2]];\n\t\tcp[3] = TIFFBitRevTable[cp[3]];\n\t\tcp[4] = TIFFBitRevTable[cp[4]];\n\t\tcp[5] = TIFFBitRevTable[cp[5]];\n\t\tcp[6] = TIFFBitRevTable[cp[6]];\n\t\tcp[7] = TIFFBitRevTable[cp[7]];\n\t\tcp += 8;\n\t}\n\twhile (n-- > 0) {\n\t\t*cp = TIFFBitRevTable[*cp];\n\t\tcp++;\n\t}\n}']