tools/tiffcrop.c:994: error: Integer Overflow L2
  ([0, `in->tif_dir.td_tilewidth`] - 1):unsigned32 by call to `TIFFReadTile`.

tools/tiffcrop.c:951:1: Parameter `in->tif_dir.td_tilewidth`
949.   }
950. 
951. static int  readSeparateTilesIntoBuffer (TIFF* in, uint8 *obuf, 
     ^
952. 					 uint32 imagelength, uint32 imagewidth, 
953.                                          uint32 tw, uint32 tl,

tools/tiffcrop.c:962:34: Call
960.   uint32  nrow, ncol;   /* Number of rows and cols in current tile */
961.   uint32  row_offset, col_offset; /* Output buffer offsets */
962.   tsize_t tbytes = 0, tilesize = TIFFTileSize(in);
                                      ^
963.   tsample_t s;
964.   uint8*  bufp = (uint8*)obuf;

libtiff/tif_tile.c:272:1: Parameter `tif->tif_dir.td_tilewidth`
  270. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  271. }
  272. tmsize_t
       ^
  273. TIFFTileSize(TIFF* tif)
  274. {

libtiff/tif_tile.c:278:4: Call
  276. 	uint64 m;
  277. 	tmsize_t n;
  278. 	m=TIFFTileSize64(tif);
          ^
  279. 	n=(tmsize_t)m;
  280. 	if ((uint64)n!=m)

libtiff/tif_tile.c:267:1: Parameter `tif->tif_dir.td_tilewidth`
    265.  * Compute the # bytes in a row-aligned tile.
    266.  */
    267. uint64
         ^
    268. TIFFTileSize64(TIFF* tif)
    269. {

libtiff/tif_tile.c:270:10: Call
    268. TIFFTileSize64(TIFF* tif)
    269. {
    270. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    271. }
    272. tmsize_t

libtiff/tif_tile.c:200:1: Parameter `tif->tif_dir.td_tilewidth`
      198.  * Compute the # bytes in a variable length, row-aligned tile.
      199.  */
      200. uint64
           ^
      201. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      202. {

tools/tiffcrop.c:994:11: Call
992.       for (s = 0; s < spp; s++)
993.         {  /* Read each plane of a tile set into srcbuffs[s] */
994. 	tbytes = TIFFReadTile(in, srcbuffs[s], col, row, 0, s);
               ^
995.         if (tbytes < 0  && !ignore)
996.           {

libtiff/tif_read.c:636:1: Parameter `tif->tif_dir.td_tilewidth`
  634.  * tile is selected by the (x,y,z,s) coordinates.
  635.  */
  636. tmsize_t
       ^
  637. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  638. {

libtiff/tif_read.c:641:10: Call
  639. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  640. 		return ((tmsize_t)(-1));
  641. 	return (TIFFReadEncodedTile(tif,
                ^
  642. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  643. }

libtiff/tif_read.c:649:1: Parameter `tif->tif_dir.td_tilewidth`
    647.  * amount into the user-supplied buffer.
    648.  */
    649. tmsize_t
         ^
    650. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
    651. {

libtiff/tif_read.c:668:6: Call
    666. 	else if (size > tilesize)
    667. 		size = tilesize;
    668. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
              ^
    669. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
    670. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:792:1: Parameter `tif->tif_dir.td_tilewidth`
      790.  * expanded, as necessary, to hold the tile's data.
      791.  */
      792. int
           ^
      793. TIFFFillTile(TIFF* tif, uint32 tile)
      794. {

libtiff/tif_read.c:901:10: Call
      899. 		}
      900. 	}
      901. 	return (TIFFStartTile(tif, tile));
                    ^
      902. }
      903. 

libtiff/tif_read.c:990:1: <LHS trace>
988.  * tile has just been read in.
989.  */
990. static int
     ^
991. TIFFStartTile(TIFF* tif, uint32 tile)
992. {

libtiff/tif_read.c:990:1: Parameter `tif->tif_dir.td_tilewidth`
        988.  * tile has just been read in.
        989.  */
        990. static int
             ^
        991. TIFFStartTile(TIFF* tif, uint32 tile)
        992. {

libtiff/tif_read.c:1006:19: Binary operation: ([0, in->tif_dir.td_tilewidth] - 1):unsigned32 by call to `TIFFReadTile` 
        1004. 	}
        1005. 	tif->tif_curtile = tile;
        1006.         howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
                                ^
        1007.         if (howmany32 == 0) {
        1008.                  TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");

static int
TIFFStartTile(TIFF* tif, uint32 tile)
{
        static const char module[] = "TIFFStartTile";
	TIFFDirectory *td = &tif->tif_dir;
        uint32 howmany32;
        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
                return 0;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupdecode)(tif))
			return (0);
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_curtile = tile;
        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
        if (howmany32 == 0) {
                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
                return 0;
        }
	tif->tif_row = (tile % howmany32) * td->td_tilelength;
        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
        if (howmany32 == 0) {
                TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
                return 0;
        }
	tif->tif_col = (tile % howmany32) * td->td_tilewidth;
        tif->tif_flags &= ~TIFF_BUF4WRITE;
	if (tif->tif_flags&TIFF_NOREADRAW)
	{
		tif->tif_rawcp = NULL;
		tif->tif_rawcc = 0;
	}
	else
	{
		tif->tif_rawcp = tif->tif_rawdata;
		tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
	}
	return ((*tif->tif_predecode)(tif,
			(uint16)(tile/td->td_stripsperimage)));
}
['static int  readSeparateTilesIntoBuffer (TIFF* in, uint8 *obuf,\n\t\t\t\t\t uint32 imagelength, uint32 imagewidth,\n                                         uint32 tw, uint32 tl,\n                                         uint16 spp, uint16 bps)\n  {\n  int     i, status = 1, sample;\n  int     shift_width, bytes_per_pixel;\n  uint16  bytes_per_sample;\n  uint32  row, col;\n  uint32  nrow, ncol;\n  uint32  row_offset, col_offset;\n  tsize_t tbytes = 0, tilesize = TIFFTileSize(in);\n  tsample_t s;\n  uint8*  bufp = (uint8*)obuf;\n  unsigned char *srcbuffs[MAX_SAMPLES];\n  unsigned char *tbuff = NULL;\n  bytes_per_sample = (bps + 7) / 8;\n  for (sample = 0; (sample < spp) && (sample < MAX_SAMPLES); sample++)\n    {\n    srcbuffs[sample] = NULL;\n    tbuff = (unsigned char *)_TIFFmalloc(tilesize + 8);\n    if (!tbuff)\n      {\n      TIFFError ("readSeparateTilesIntoBuffer",\n                 "Unable to allocate tile read buffer for sample %d", sample);\n      for (i = 0; i < sample; i++)\n        _TIFFfree (srcbuffs[i]);\n      return 0;\n      }\n    srcbuffs[sample] = tbuff;\n    }\n  for (row = 0; row < imagelength; row += tl)\n    {\n    nrow = (row + tl > imagelength) ? imagelength - row : tl;\n    for (col = 0; col < imagewidth; col += tw)\n      {\n      for (s = 0; s < spp; s++)\n        {\n\ttbytes = TIFFReadTile(in, srcbuffs[s], col, row, 0, s);\n        if (tbytes < 0  && !ignore)\n          {\n\t  TIFFError(TIFFFileName(in),\n                 "Error, can\'t read tile for row %lu col %lu, "\n\t\t "sample %lu",\n\t\t (unsigned long) col, (unsigned long) row,\n\t\t (unsigned long) s);\n\t\t status = 0;\n          for (sample = 0; (sample < spp) && (sample < MAX_SAMPLES); sample++)\n            {\n            tbuff = srcbuffs[sample];\n            if (tbuff != NULL)\n              _TIFFfree(tbuff);\n            }\n          return status;\n\t  }\n\t}\n      if (col + tw > imagewidth)\n        ncol = imagewidth - col;\n      else\n        ncol = tw;\n      row_offset = row * (((imagewidth * spp * bps) + 7) / 8);\n      col_offset = ((col * spp * bps) + 7) / 8;\n      bufp = obuf + row_offset + col_offset;\n      if ((bps % 8) == 0)\n        {\n        if (combineSeparateTileSamplesBytes(srcbuffs, bufp, ncol, nrow, imagewidth,\n\t\t\t\t\t    tw, spp, bps, NULL, 0, 0))\n\t  {\n          status = 0;\n          break;\n      \t  }\n\t}\n      else\n        {\n        bytes_per_pixel  = ((bps * spp) + 7) / 8;\n        if (bytes_per_pixel < (bytes_per_sample + 1))\n          shift_width = bytes_per_pixel;\n        else\n          shift_width = bytes_per_sample + 1;\n        switch (shift_width)\n          {\n          case 1: if (combineSeparateTileSamples8bits (srcbuffs, bufp, ncol, nrow,\n                                                       imagewidth, tw, spp, bps,\n\t\t\t\t\t\t       NULL, 0, 0))\n\t            {\n                    status = 0;\n                    break;\n      \t            }\n\t          break;\n          case 2: if (combineSeparateTileSamples16bits (srcbuffs, bufp, ncol, nrow,\n                                                       imagewidth, tw, spp, bps,\n\t\t\t\t\t\t       NULL, 0, 0))\n\t            {\n                    status = 0;\n                    break;\n\t\t    }\n\t          break;\n          case 3: if (combineSeparateTileSamples24bits (srcbuffs, bufp, ncol, nrow,\n                                                       imagewidth, tw, spp, bps,\n\t\t\t\t\t\t       NULL, 0, 0))\n\t            {\n                    status = 0;\n                    break;\n       \t            }\n                  break;\n          case 4:\n          case 5:\n          case 6:\n          case 7:\n          case 8: if (combineSeparateTileSamples32bits (srcbuffs, bufp, ncol, nrow,\n                                                       imagewidth, tw, spp, bps,\n\t\t\t\t\t\t       NULL, 0, 0))\n\t            {\n                    status = 0;\n                    break;\n\t\t    }\n\t          break;\n          default: TIFFError ("readSeparateTilesIntoBuffer", "Unsupported bit depth: %d", bps);\n                  status = 0;\n                  break;\n          }\n        }\n      }\n    }\n  for (sample = 0; (sample < spp) && (sample < MAX_SAMPLES); sample++)\n    {\n    tbuff = srcbuffs[sample];\n    if (tbuff != NULL)\n      _TIFFfree(tbuff);\n    }\n  return status;\n  }', 'tmsize_t\nTIFFTileSize(TIFF* tif)\n{\n\tstatic const char module[] = "TIFFTileSize";\n\tuint64 m;\n\ttmsize_t n;\n\tm=TIFFTileSize64(tif);\n\tn=(tmsize_t)m;\n\tif ((uint64)n!=m)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\tn=0;\n\t}\n\treturn(n);\n}', 'uint64\nTIFFTileSize64(TIFF* tif)\n{\n\treturn (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));\n}', 'uint64\nTIFFVTileSize64(TIFF* tif, uint32 nrows)\n{\n\tstatic const char module[] = "TIFFVTileSize64";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (td->td_tilelength == 0 || td->td_tilewidth == 0 ||\n\t    td->td_tiledepth == 0)\n\t\treturn (0);\n\tif ((td->td_planarconfig==PLANARCONFIG_CONTIG)&&\n\t    (td->td_photometric==PHOTOMETRIC_YCBCR)&&\n\t    (td->td_samplesperpixel==3)&&\n\t    (!isUpSampled(tif)))\n\t{\n\t\tuint16 ycbcrsubsampling[2];\n\t\tuint16 samplingblock_samples;\n\t\tuint32 samplingblocks_hor;\n\t\tuint32 samplingblocks_ver;\n\t\tuint64 samplingrow_samples;\n\t\tuint64 samplingrow_size;\n\t\tTIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,\n\t\t    ycbcrsubsampling+1);\n\t\tif ((ycbcrsubsampling[0] != 1 && ycbcrsubsampling[0] != 2 && ycbcrsubsampling[0] != 4)\n\t\t    ||(ycbcrsubsampling[1] != 1 && ycbcrsubsampling[1] != 2 && ycbcrsubsampling[1] != 4))\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t\t     "Invalid YCbCr subsampling (%dx%d)",\n\t\t\t\t     ycbcrsubsampling[0],\n\t\t\t\t     ycbcrsubsampling[1] );\n\t\t\treturn 0;\n\t\t}\n\t\tsamplingblock_samples=ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;\n\t\tsamplingblocks_hor=TIFFhowmany_32(td->td_tilewidth,ycbcrsubsampling[0]);\n\t\tsamplingblocks_ver=TIFFhowmany_32(nrows,ycbcrsubsampling[1]);\n\t\tsamplingrow_samples=_TIFFMultiply64(tif,samplingblocks_hor,samplingblock_samples,module);\n\t\tsamplingrow_size=TIFFhowmany8_64(_TIFFMultiply64(tif,samplingrow_samples,td->td_bitspersample,module));\n\t\treturn(_TIFFMultiply64(tif,samplingrow_size,samplingblocks_ver,module));\n\t}\n\telse\n\t\treturn(_TIFFMultiply64(tif,nrows,TIFFTileRowSize64(tif),module));\n}', 'tmsize_t\nTIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tif (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))\n\t\treturn ((tmsize_t)(-1));\n\treturn (TIFFReadEncodedTile(tif,\n\t    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n    if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n        return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif ((int64)bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\treturn (0);\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata,\n                                                tif->tif_rawdataloaded);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'static int\nTIFFStartTile(TIFF* tif, uint32 tile)\n{\n        static const char module[] = "TIFFStartTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n        uint32 howmany32;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n                return 0;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupdecode)(tif))\n\t\t\treturn (0);\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_curtile = tile;\n        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);\n        if (howmany32 == 0) {\n                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");\n                return 0;\n        }\n\ttif->tif_row = (tile % howmany32) * td->td_tilelength;\n        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);\n        if (howmany32 == 0) {\n                TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");\n                return 0;\n        }\n\ttif->tif_col = (tile % howmany32) * td->td_tilewidth;\n        tif->tif_flags &= ~TIFF_BUF4WRITE;\n\tif (tif->tif_flags&TIFF_NOREADRAW)\n\t{\n\t\ttif->tif_rawcp = NULL;\n\t\ttif->tif_rawcc = 0;\n\t}\n\telse\n\t{\n\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\ttif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];\n\t}\n\treturn ((*tif->tif_predecode)(tif,\n\t\t\t(uint16)(tile/td->td_stripsperimage)));\n}']