contrib/addtiffo/tif_overview.c:594: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadEncodedTile`.

contrib/addtiffo/tif_overview.c:569:1: Parameter `hTIFF->tif_rawdata`
567. /************************************************************************/
568. 
569. void TIFF_ProcessFullResBlock( TIFF *hTIFF, int nPlanarConfig,
     ^
570.                                int bSubsampled,
571.                                int nHorSubsampling, int nVerSubsampling,

contrib/addtiffo/tif_overview.c:594:17: Call
592.             if( TIFFIsTiled(hTIFF) )
593.             {
594.                 TIFFReadEncodedTile( hTIFF,
                     ^
595.                                      TIFFComputeTile(hTIFF, nSXOff, nSYOff,
596.                                                      0, (tsample_t)iSample ),

libtiff/tif_read.c:985:1: Parameter `*tif->tif_rawdata`
  983.  * amount into the user-supplied buffer.
  984.  */
  985. tmsize_t
       ^
  986. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  987. {

libtiff/tif_read.c:1022:6: Call
  1020. 	else if (size > tilesize)
  1021. 		size = tilesize;
  1022. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
             ^
  1023. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
  1024. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:1217:1: Parameter `*tif->tif_rawdata`
    1215.  * expanded, as necessary, to hold the tile's data.
    1216.  */
    1217. int
          ^
    1218. TIFFFillTile(TIFF* tif, uint32 tile)
    1219. {

libtiff/tif_read.c:1378:5: Call
    1376.                             !isFillOrder(tif, td->td_fillorder) &&
    1377. 			    (tif->tif_flags & TIFF_NOBITREV) == 0)
    1378. 				TIFFReverseBits(tif->tif_rawdata,
              ^
    1379.                                                 tif->tif_rawdataloaded);
    1380. 		}

libtiff/tif_swab.c:283:1: <Length trace>
281. }
282. 
283. void
     ^
284. TIFFReverseBits(uint8* cp, tmsize_t n)  
285. {

libtiff/tif_swab.c:283:1: Parameter `*cp`
      281. }
      282. 
      283. void
           ^
      284. TIFFReverseBits(uint8* cp, tmsize_t n)  
      285. {

libtiff/tif_swab.c:294:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadEncodedTile` 
      292. 		cp[5] = TIFFBitRevTable[cp[5]];
      293. 		cp[6] = TIFFBitRevTable[cp[6]];
      294. 		cp[7] = TIFFBitRevTable[cp[7]];
             ^
      295. 		cp += 8;
      296. 	}

void
TIFFReverseBits(uint8* cp, tmsize_t n)
{
	for (; n > 8; n -= 8) {
		cp[0] = TIFFBitRevTable[cp[0]];
		cp[1] = TIFFBitRevTable[cp[1]];
		cp[2] = TIFFBitRevTable[cp[2]];
		cp[3] = TIFFBitRevTable[cp[3]];
		cp[4] = TIFFBitRevTable[cp[4]];
		cp[5] = TIFFBitRevTable[cp[5]];
		cp[6] = TIFFBitRevTable[cp[6]];
		cp[7] = TIFFBitRevTable[cp[7]];
		cp += 8;
	}
	while (n-- > 0) {
		*cp = TIFFBitRevTable[*cp];
		cp++;
	}
}
['void TIFF_ProcessFullResBlock( TIFF *hTIFF, int nPlanarConfig,\n                               int bSubsampled,\n                               int nHorSubsampling, int nVerSubsampling,\n                               int nOverviews, int * panOvList,\n                               int nBitsPerPixel,\n                               int nSamples, TIFFOvrCache ** papoRawBIs,\n                               uint32 nSXOff, uint32 nSYOff,\n                               unsigned char *pabySrcTile,\n                               uint32 nBlockXSize, uint32 nBlockYSize,\n                               int nSampleFormat, const char * pszResampling )\n{\n    int\t\tiOverview, iSample;\n    for( iSample = 0; iSample < nSamples; iSample++ )\n    {\n        if( nPlanarConfig == PLANARCONFIG_SEPARATE || iSample == 0 )\n        {\n            if( TIFFIsTiled(hTIFF) )\n            {\n                TIFFReadEncodedTile( hTIFF,\n                                     TIFFComputeTile(hTIFF, nSXOff, nSYOff,\n                                                     0, (tsample_t)iSample ),\n                                     pabySrcTile,\n                                     TIFFTileSize(hTIFF));\n            }\n            else\n            {\n                TIFFReadEncodedStrip( hTIFF,\n                                      TIFFComputeStrip(hTIFF, nSYOff,\n                                                       (tsample_t) iSample),\n                                      pabySrcTile,\n                                      TIFFStripSize(hTIFF) );\n            }\n        }\n        for( iOverview = 0; iOverview < nOverviews; iOverview++ )\n        {\n            TIFFOvrCache *poRBI = papoRawBIs[iOverview];\n            unsigned char *pabyOTile;\n            uint32  nTXOff, nTYOff, nOXOff, nOYOff, nOMult;\n            uint32  nOBlockXSize = poRBI->nBlockXSize;\n            uint32  nOBlockYSize = poRBI->nBlockYSize;\n            int     nSkewBits, nSampleByteOffset;\n            nOMult = panOvList[iOverview];\n            nOXOff = (nSXOff/nOMult) / nOBlockXSize;\n            nOYOff = (nSYOff/nOMult) / nOBlockYSize;\n            if( bSubsampled )\n            {\n                pabyOTile = TIFFGetOvrBlock_Subsampled( poRBI, nOXOff, nOYOff );\n                nTXOff = (nSXOff - nOXOff*nOMult*nOBlockXSize) / nOMult;\n                nTYOff = (nSYOff - nOYOff*nOMult*nOBlockYSize) / nOMult;\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n                TIFF_DownSample_Subsampled( pabySrcTile, iSample,\n                                            nBlockXSize, nBlockYSize,\n                                            pabyOTile,\n                                            poRBI->nBlockXSize, poRBI->nBlockYSize,\n                                            nTXOff, nTYOff,\n                                            nOMult, pszResampling,\n                                            nHorSubsampling, nVerSubsampling );\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n            }\n            else\n            {\n                pabyOTile = TIFFGetOvrBlock( poRBI, nOXOff, nOYOff, iSample );\n                nTXOff = (nSXOff - nOXOff*nOMult*nOBlockXSize) / nOMult;\n                nTYOff = (nSYOff - nOYOff*nOMult*nOBlockYSize) / nOMult;\n                assert( (nBitsPerPixel % 8) == 0 );\n                if( nPlanarConfig == PLANARCONFIG_SEPARATE )\n                {\n                    nSkewBits = 0;\n                    nSampleByteOffset = 0;\n                }\n                else\n                {\n                    nSkewBits = nBitsPerPixel * (nSamples-1);\n                    nSampleByteOffset = (nBitsPerPixel/8) * iSample;\n                }\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n                TIFF_DownSample( pabySrcTile + nSampleByteOffset,\n                               nBlockXSize, nBlockYSize,\n                               nSkewBits, nBitsPerPixel, pabyOTile,\n                               poRBI->nBlockXSize, poRBI->nBlockYSize,\n                               nTXOff, nTYOff,\n                               nOMult, nSampleFormat, pszResampling );\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n            }\n        }\n    }\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n    if( td->td_compression == COMPRESSION_NONE &&\n        size!=(tmsize_t)(-1) && size >= tilesize &&\n        !isMapped(tif) &&\n        ((tif->tif_flags&TIFF_NOREADRAW)==0) )\n    {\n        if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize)\n            return ((tmsize_t)(-1));\n        if (!isFillOrder(tif, td->td_fillorder) &&\n            (tif->tif_flags & TIFF_NOBITREV) == 0)\n            TIFFReverseBits(buf,tilesize);\n        (*tif->tif_postdecode)(tif,buf,tilesize);\n        return (tilesize);\n    }\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n            return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif ((int64)bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n                if( bytecount > 1024 * 1024 )\n                {\n\t\t\ttmsize_t stripsize = TIFFTileSize(tif);\n\t\t\tif( stripsize != 0 &&\n\t\t\t    (bytecount - 4096) / 10 > (uint64)stripsize  )\n\t\t\t{\n\t\t\t\tuint64 newbytecount = (uint64)stripsize * 10 + 4096;\n\t\t\t\tif( (int64)newbytecount >= 0 )\n\t\t\t\t{\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\t\t\tTIFFWarningExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large tile byte count %I64u, tile %lu. Limiting to %I64u",\n\t\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t\t     (unsigned long) tile,\n\t\t\t\t\t     (unsigned __int64) newbytecount);\n#else\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large tile byte count %llu, tile %lu. Limiting to %llu",\n\t\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t\t     (unsigned long) tile,\n\t\t\t\t\t     (unsigned long long) newbytecount);\n#endif\n\t\t\t\t\tbytecount = newbytecount;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif)) {\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t\ttif->tif_flags &= ~TIFF_BUFFERMMAP;\n\t\t\t}\n\t\t\tif( isMapped(tif) )\n\t\t\t{\n\t\t\t\tif (bytecountm > tif->tif_rawdatasize &&\n\t\t\t\t    !TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tif (TIFFReadRawStripOrTile2(tif, tile, 0,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (tif->tif_rawdata != NULL &&\n                            !isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata,\n                                                tif->tif_rawdataloaded);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'void\nTIFFReverseBits(uint8* cp, tmsize_t n)\n{\n\tfor (; n > 8; n -= 8) {\n\t\tcp[0] = TIFFBitRevTable[cp[0]];\n\t\tcp[1] = TIFFBitRevTable[cp[1]];\n\t\tcp[2] = TIFFBitRevTable[cp[2]];\n\t\tcp[3] = TIFFBitRevTable[cp[3]];\n\t\tcp[4] = TIFFBitRevTable[cp[4]];\n\t\tcp[5] = TIFFBitRevTable[cp[5]];\n\t\tcp[6] = TIFFBitRevTable[cp[6]];\n\t\tcp[7] = TIFFBitRevTable[cp[7]];\n\t\tcp += 8;\n\t}\n\twhile (n-- > 0) {\n\t\t*cp = TIFFBitRevTable[*cp];\n\t\tcp++;\n\t}\n}']