libtiff/tif_getimage.c:737: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFReadTile`.

libtiff/tif_getimage.c:737:8: Call
735. 		for (col = 0; col < w; col += tw)
736. 		{
737. 			if (TIFFReadTile(tif, p0, col+img->col_offset,  
            ^
738. 			    row+img->row_offset,0,0)==(tmsize_t)(-1) && img->stoponerr)
739. 			{

libtiff/tif_read.c:604:1: Parameter `tif->tif_dir.td_imagewidth`
  602.  * tile is selected by the (x,y,z,s) coordinates.
  603.  */
  604. tmsize_t
       ^
  605. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  606. {

libtiff/tif_getimage.c:737:8: Call
735. 		for (col = 0; col < w; col += tw)
736. 		{
737. 			if (TIFFReadTile(tif, p0, col+img->col_offset,  
            ^
738. 			    row+img->row_offset,0,0)==(tmsize_t)(-1) && img->stoponerr)
739. 			{

libtiff/tif_read.c:604:1: Parameter `tif->tif_dir.td_imagewidth`
  602.  * tile is selected by the (x,y,z,s) coordinates.
  603.  */
  604. tmsize_t
       ^
  605. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  606. {

libtiff/tif_read.c:607:33: Call
  605. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  606. {
  607. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
                                       ^
  608. 		return ((tmsize_t)(-1));
  609. 	return (TIFFReadEncodedTile(tif,

libtiff/tif_tile.c:100:1: <LHS trace>
 98.  * against the image bounds.
 99.  */
100. int
     ^
101. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
102. {

libtiff/tif_tile.c:100:1: Parameter `x`
     98.  * against the image bounds.
     99.  */
    100. int
         ^
    101. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
    102. {

libtiff/tif_tile.c:106:3: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFReadTile` 
    104. 
    105. 	if (x >= td->td_imagewidth) {
    106. 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
           ^
    107. 			     "%lu: Col out of range, max %lu",
    108. 			     (unsigned long) x,

int
TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
{
	TIFFDirectory *td = &tif->tif_dir;
	if (x >= td->td_imagewidth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Col out of range, max %lu",
			     (unsigned long) x,
			     (unsigned long) (td->td_imagewidth - 1));
		return (0);
	}
	if (y >= td->td_imagelength) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Row out of range, max %lu",
			     (unsigned long) y,
			     (unsigned long) (td->td_imagelength - 1));
		return (0);
	}
	if (z >= td->td_imagedepth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Depth out of range, max %lu",
			     (unsigned long) z,
			     (unsigned long) (td->td_imagedepth - 1));
		return (0);
	}
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE &&
	    s >= td->td_samplesperpixel) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Sample out of range, max %lu",
			     (unsigned long) s,
			     (unsigned long) (td->td_samplesperpixel - 1));
		return (0);
	}
	return (1);
}
['static int\ngtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)\n{\n\tTIFF* tif = img->tif;\n\ttileSeparateRoutine put = img->put.separate;\n\tuint32 col, row, y, rowstoread;\n\ttmsize_t pos;\n\tuint32 tw, th;\n\tunsigned char* buf;\n\tunsigned char* p0;\n\tunsigned char* p1;\n\tunsigned char* p2;\n\tunsigned char* pa;\n\ttmsize_t tilesize;\n\tint32 fromskew, toskew;\n\tint alpha = img->alpha;\n\tuint32 nrow;\n\tint ret = 1, flip;\n        int colorchannels;\n\ttilesize = TIFFTileSize(tif);\n\tbuf = (unsigned char*) _TIFFmalloc((alpha?4:3)*tilesize);\n\tif (buf == 0) {\n\t\tTIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer");\n\t\treturn (0);\n\t}\n\t_TIFFmemset(buf, 0, (alpha?4:3)*tilesize);\n\tp0 = buf;\n\tp1 = p0 + tilesize;\n\tp2 = p1 + tilesize;\n\tpa = (alpha?(p2+tilesize):NULL);\n\tTIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);\n\tTIFFGetField(tif, TIFFTAG_TILELENGTH, &th);\n\tflip = setorientation(img);\n\tif (flip & FLIP_VERTICALLY) {\n\t\ty = h - 1;\n\t\ttoskew = -(int32)(tw + w);\n\t}\n\telse {\n\t\ty = 0;\n\t\ttoskew = -(int32)(tw - w);\n\t}\n        switch( img->photometric )\n        {\n          case PHOTOMETRIC_MINISWHITE:\n          case PHOTOMETRIC_MINISBLACK:\n          case PHOTOMETRIC_PALETTE:\n            colorchannels = 1;\n            p2 = p1 = p0;\n            break;\n          default:\n            colorchannels = 3;\n            break;\n        }\n\tfor (row = 0; row < h; row += nrow)\n\t{\n\t\trowstoread = th - (row + img->row_offset) % th;\n\t\tnrow = (row + rowstoread > h ? h - row : rowstoread);\n\t\tfor (col = 0; col < w; col += tw)\n\t\t{\n\t\t\tif (TIFFReadTile(tif, p0, col+img->col_offset,\n\t\t\t    row+img->row_offset,0,0)==(tmsize_t)(-1) && img->stoponerr)\n\t\t\t{\n\t\t\t\tret = 0;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (colorchannels > 1\n                            && TIFFReadTile(tif, p1, col+img->col_offset,\n                                            row+img->row_offset,0,1) == (tmsize_t)(-1)\n                            && img->stoponerr)\n\t\t\t{\n\t\t\t\tret = 0;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (colorchannels > 1\n                            && TIFFReadTile(tif, p2, col+img->col_offset,\n                                            row+img->row_offset,0,2) == (tmsize_t)(-1)\n                            && img->stoponerr)\n\t\t\t{\n\t\t\t\tret = 0;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (alpha\n                            && TIFFReadTile(tif,pa,col+img->col_offset,\n                                            row+img->row_offset,0,colorchannels) == (tmsize_t)(-1)\n                            && img->stoponerr)\n                        {\n                            ret = 0;\n                            break;\n\t\t\t}\n\t\t\tpos = ((row+img->row_offset) % th) * TIFFTileRowSize(tif);\n\t\t\tif (col + tw > w)\n\t\t\t{\n\t\t\t\tuint32 npix = w - col;\n\t\t\t\tfromskew = tw - npix;\n\t\t\t\t(*put)(img, raster+y*w+col, col, y,\n\t\t\t\t    npix, nrow, fromskew, toskew + fromskew,\n\t\t\t\t    p0 + pos, p1 + pos, p2 + pos, (alpha?(pa+pos):NULL));\n\t\t\t} else {\n\t\t\t\t(*put)(img, raster+y*w+col, col, y,\n\t\t\t\t    tw, nrow, 0, toskew, p0 + pos, p1 + pos, p2 + pos, (alpha?(pa+pos):NULL));\n\t\t\t}\n\t\t}\n\t\ty += (flip & FLIP_VERTICALLY ?-(int32) nrow : (int32) nrow);\n\t}\n\tif (flip & FLIP_HORIZONTALLY) {\n\t\tuint32 line;\n\t\tfor (line = 0; line < h; line++) {\n\t\t\tuint32 *left = raster + (line * w);\n\t\t\tuint32 *right = left + w - 1;\n\t\t\twhile ( left < right ) {\n\t\t\t\tuint32 temp = *left;\n\t\t\t\t*left = *right;\n\t\t\t\t*right = temp;\n\t\t\t\tleft++, right--;\n\t\t\t}\n\t\t}\n\t}\n\t_TIFFfree(buf);\n\treturn (ret);\n}', 'tmsize_t\nTIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tif (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))\n\t\treturn ((tmsize_t)(-1));\n\treturn (TIFFReadEncodedTile(tif,\n\t    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));\n}', 'int\nTIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (x >= td->td_imagewidth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Col out of range, max %lu",\n\t\t\t     (unsigned long) x,\n\t\t\t     (unsigned long) (td->td_imagewidth - 1));\n\t\treturn (0);\n\t}\n\tif (y >= td->td_imagelength) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Row out of range, max %lu",\n\t\t\t     (unsigned long) y,\n\t\t\t     (unsigned long) (td->td_imagelength - 1));\n\t\treturn (0);\n\t}\n\tif (z >= td->td_imagedepth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Depth out of range, max %lu",\n\t\t\t     (unsigned long) z,\n\t\t\t     (unsigned long) (td->td_imagedepth - 1));\n\t\treturn (0);\n\t}\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE &&\n\t    s >= td->td_samplesperpixel) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Sample out of range, max %lu",\n\t\t\t     (unsigned long) s,\n\t\t\t     (unsigned long) (td->td_samplesperpixel - 1));\n\t\treturn (0);\n\t}\n\treturn (1);\n}']