libtiff/tif_ojpeg.c:1998: error: Buffer Overrun S2
  Offset: [`sp->in_buffer_next_strile`, +oo] Size: [0, +oo] by call to `TIFFGetStrileByteCount`.

libtiff/tif_ojpeg.c:1943:1: Parameter `sp->in_buffer_next_strile`
1941. }
1942. 
1943. static int
      ^
1944. OJPEGReadBufferFill(OJPEGState* sp)
1945. {

libtiff/tif_ojpeg.c:1998:68: Call
1996. 					if (sp->in_buffer_file_pos!=0)
1997. 					{
1998.                                                 uint64 bytecount = TIFFGetStrileByteCount(sp->tif, sp->in_buffer_next_strile);
                                                                         ^
1999. 						if (sp->in_buffer_file_pos>=sp->file_size)
2000. 							sp->in_buffer_file_pos=0;

libtiff/tif_dirread.c:6248:1: Parameter `strile`
  6246. 
  6247. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6249. {
  6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6250:12: Call
  6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6249. {
  6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6251. }
  6252. 

libtiff/tif_dirread.c:6254:1: Parameter `strile`
    6252. 
    6253. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6254. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6255. {
    6256.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6257:12: Call
    6255. {
    6256.     TIFFDirectory *td = &tif->tif_dir;
    6257.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6258.                                &(td->td_stripbytecount_entry),
    6259.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6191:1: <Offset trace>
6189. }
6190. 
6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
      ^
6192.                                                    TIFFDirEntry* dirent,
6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6191:1: Parameter `strile`
      6189. }
      6190. 
      6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6192.                                                    TIFFDirEntry* dirent,
      6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6191:1: <Length trace>
6189. }
6190. 
6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
      ^
6192.                                                    TIFFDirEntry* dirent,
6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6191:1: Parameter `**parray`
      6189. }
      6190. 
      6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6192.                                                    TIFFDirEntry* dirent,
      6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6229:12: Array access: Offset: [sp->in_buffer_next_strile, +oo] Size: [0, +oo] by call to `TIFFGetStrileByteCount` 
      6227.         return 0;
      6228.     }
      6229.     return (*parray)[strile];
                       ^
      6230. }
      6231. 

static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                                                   TIFFDirEntry* dirent,
                                                   uint64** parray,
                                                   int *pbErr)
{
    TIFFDirectory *td = &tif->tif_dir;
    if( pbErr )
        *pbErr = 0;
    if( tif->tif_flags&TIFF_DEFERSTRILELOAD )
    {
        if( !(tif->tif_flags&TIFF_LAZYSTRILELOAD) ||
            dirent->tdir_count <= 4 )
        {
            if( !_TIFFFillStriles(tif) )
            {
                if( pbErr )
                    *pbErr = 1;
                return 0;
            }
        }
        else
        {
             if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
             {
                if( pbErr )
                    *pbErr = 1;
                 return 0;
             }
        }
    }
    if( *parray == NULL || strile >= td->td_nstrips )
    {
        if( pbErr )
            *pbErr = 1;
        return 0;
    }
    return (*parray)[strile];
}
['static int\nOJPEGReadBufferFill(OJPEGState* sp)\n{\n\tuint16 m;\n\ttmsize_t n;\n\tdo\n\t{\n\t\tif (sp->in_buffer_file_togo!=0)\n\t\t{\n\t\t\tif (sp->in_buffer_file_pos_log==0)\n\t\t\t{\n\t\t\t\tTIFFSeekFile(sp->tif,sp->in_buffer_file_pos,SEEK_SET);\n\t\t\t\tsp->in_buffer_file_pos_log=1;\n\t\t\t}\n\t\t\tm=OJPEG_BUFFER;\n\t\t\tif ((uint64)m>sp->in_buffer_file_togo)\n\t\t\t\tm=(uint16)sp->in_buffer_file_togo;\n\t\t\tn=TIFFReadFile(sp->tif,sp->in_buffer,(tmsize_t)m);\n\t\t\tif (n==0)\n\t\t\t\treturn(0);\n\t\t\tassert(n>0);\n\t\t\tassert(n<=OJPEG_BUFFER);\n\t\t\tassert(n<65536);\n\t\t\tassert((uint64)n<=sp->in_buffer_file_togo);\n\t\t\tm=(uint16)n;\n\t\t\tsp->in_buffer_togo=m;\n\t\t\tsp->in_buffer_cur=sp->in_buffer;\n\t\t\tsp->in_buffer_file_togo-=m;\n\t\t\tsp->in_buffer_file_pos+=m;\n\t\t\tbreak;\n\t\t}\n\t\tsp->in_buffer_file_pos_log=0;\n\t\tswitch(sp->in_buffer_source)\n\t\t{\n\t\t\tcase osibsNotSetYet:\n\t\t\t\tif (sp->jpeg_interchange_format!=0)\n\t\t\t\t{\n\t\t\t\t\tsp->in_buffer_file_pos=sp->jpeg_interchange_format;\n\t\t\t\t\tsp->in_buffer_file_togo=sp->jpeg_interchange_format_length;\n\t\t\t\t}\n\t\t\t\tsp->in_buffer_source=osibsJpegInterchangeFormat;\n\t\t\t\tbreak;\n\t\t\tcase osibsJpegInterchangeFormat:\n\t\t\t\tsp->in_buffer_source=osibsStrile;\n                                break;\n\t\t\tcase osibsStrile:\n\t\t\t\tif (sp->in_buffer_next_strile==sp->in_buffer_strile_count)\n\t\t\t\t\tsp->in_buffer_source=osibsEof;\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tsp->in_buffer_file_pos=TIFFGetStrileOffset(sp->tif, sp->in_buffer_next_strile);\n\t\t\t\t\tif (sp->in_buffer_file_pos!=0)\n\t\t\t\t\t{\n                                                uint64 bytecount = TIFFGetStrileByteCount(sp->tif, sp->in_buffer_next_strile);\n\t\t\t\t\t\tif (sp->in_buffer_file_pos>=sp->file_size)\n\t\t\t\t\t\t\tsp->in_buffer_file_pos=0;\n\t\t\t\t\t\telse if (bytecount==0)\n\t\t\t\t\t\t\tsp->in_buffer_file_togo=sp->file_size-sp->in_buffer_file_pos;\n\t\t\t\t\t\telse\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tsp->in_buffer_file_togo=bytecount;\n\t\t\t\t\t\t\tif (sp->in_buffer_file_togo==0)\n\t\t\t\t\t\t\t\tsp->in_buffer_file_pos=0;\n\t\t\t\t\t\t\telse if (sp->in_buffer_file_pos+sp->in_buffer_file_togo>sp->file_size)\n\t\t\t\t\t\t\t\tsp->in_buffer_file_togo=sp->file_size-sp->in_buffer_file_pos;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tsp->in_buffer_next_strile++;\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treturn(0);\n\t\t}\n\t} while (1);\n\treturn(1);\n}', 'uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)\n{\n    return TIFFGetStrileByteCountWithErr(tif, strile, NULL);\n}', 'uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)\n{\n    TIFFDirectory *td = &tif->tif_dir;\n    return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,\n                               &(td->td_stripbytecount_entry),\n                               &(td->td_stripbytecount_p), pbErr);\n}', 'static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,\n                                                   TIFFDirEntry* dirent,\n                                                   uint64** parray,\n                                                   int *pbErr)\n{\n    TIFFDirectory *td = &tif->tif_dir;\n    if( pbErr )\n        *pbErr = 0;\n    if( tif->tif_flags&TIFF_DEFERSTRILELOAD )\n    {\n        if( !(tif->tif_flags&TIFF_LAZYSTRILELOAD) ||\n            dirent->tdir_count <= 4 )\n        {\n            if( !_TIFFFillStriles(tif) )\n            {\n                if( pbErr )\n                    *pbErr = 1;\n                return 0;\n            }\n        }\n        else\n        {\n             if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )\n             {\n                if( pbErr )\n                    *pbErr = 1;\n                 return 0;\n             }\n        }\n    }\n    if( *parray == NULL || strile >= td->td_nstrips )\n    {\n        if( pbErr )\n            *pbErr = 1;\n        return 0;\n    }\n    return (*parray)[strile];\n}']