tools/tiffcrop.c:9133: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `reverseSamples24bits`.

tools/tiffcrop.c:9054:1: Parameter `bps`
9052. 
9053. /* Mirror an image horizontally or vertically */
9054. static int
      ^
9055. mirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length, unsigned char *ibuff)
9056.   {

tools/tiffcrop.c:9065:3: Assignment
9063. 
9064.   src = ibuff;
9065.   rowsize = ((width * bps * spp) + 7) / 8;
        ^
9066.   switch (mirror)
9067.     {

tools/tiffcrop.c:9107:52: Call
9105. 	      else
9106.                 { /* non 8 bit per sample  data */
9107.                 if (!(line_buff = (unsigned char *)limitMalloc(rowsize + 1)))
                                                         ^
9108.                   {
9109.                   TIFFError("mirrorImage", "Unable to allocate mirror line buffer");

tools/tiffcrop.c:634:76: Assignment
  632.     fprintf(stderr, "MemoryLimitError: allocation of " TIFF_UINT64_FORMAT " bytes is forbidden. Limit is " TIFF_UINT64_FORMAT ".\n",
  633.             (uint64)s, (uint64)maxMalloc);
  634.     fprintf(stderr, "                  use -k option to change limit.\n"); return NULL;
                                                                                  ^
  635.   }
  636.   return _TIFFmalloc(s);

tools/tiffcrop.c:9107:23: Assignment
9105. 	      else
9106.                 { /* non 8 bit per sample  data */
9107.                 if (!(line_buff = (unsigned char *)limitMalloc(rowsize + 1)))
                            ^
9108.                   {
9109.                   TIFFError("mirrorImage", "Unable to allocate mirror line buffer");

tools/tiffcrop.c:9133:33: Call
9131.                              _TIFFmemcpy (src, line_buff, rowsize);
9132.                              break;
9133.                     case 2: if (reverseSamples24bits(spp, bps, width, src, line_buff))
                                      ^
9134.                               {
9135. 		              _TIFFfree(line_buff);

tools/tiffcrop.c:8816:1: <Length trace>
8814.   } /* end reverseSamples16bits */
8815. 
8816. static int
      ^
8817. reverseSamples24bits (uint16 spp, uint16 bps, uint32 width, 
8818.                       uint8 *ibuff, uint8 *obuff)

tools/tiffcrop.c:8816:1: Parameter `*obuff`
  8814.   } /* end reverseSamples16bits */
  8815. 
  8816. static int
        ^
  8817. reverseSamples24bits (uint16 spp, uint16 bps, uint32 width, 
  8818.                       uint8 *ibuff, uint8 *obuff)

tools/tiffcrop.c:8839:3: Assignment
  8837.   ready_bits = 0;
  8838.   mask_bits =  (uint32)-1 >> (32 - bps);
  8839.   dst = obuff;
          ^
  8840.   for (col = width; col > 0; col--)
  8841.     {

tools/tiffcrop.c:8873:10: Assignment
  8871.         {
  8872.         bytebuff1 = (buff2 >> 24);
  8873.         *dst++ = bytebuff1;
                 ^
  8874.         bytebuff2 = (buff2 >> 16);
  8875.         *dst++ = bytebuff2;

tools/tiffcrop.c:8875:9: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `reverseSamples24bits` 
  8873.         *dst++ = bytebuff1;
  8874.         bytebuff2 = (buff2 >> 16);
  8875.         *dst++ = bytebuff2;
                ^
  8876.         ready_bits -= 16;
  8877. 

static int
reverseSamples24bits (uint16 spp, uint16 bps, uint32 width,
                      uint8 *ibuff, uint8 *obuff)
  {
  int      ready_bits = 0;
  uint32   col;
  uint32   src_byte = 0, high_bit = 0;
  uint32   bit_offset = 0;
  uint32   match_bits = 0, mask_bits = 0;
  uint32   buff1 = 0, buff2 = 0;
  uint8    bytebuff1 = 0, bytebuff2 = 0;
  unsigned char *src;
  unsigned char *dst;
  tsample_t sample;
  if ((ibuff == NULL) || (obuff == NULL))
    {
    TIFFError("reverseSamples24bits","Invalid image or work buffer");
    return (1);
    }
  ready_bits = 0;
  mask_bits =  (uint32)-1 >> (32 - bps);
  dst = obuff;
  for (col = width; col > 0; col--)
    {
    bit_offset = (col - 1) * bps * spp;
    for (sample = 0; sample < spp; sample++)
      {
      if (sample == 0)
        {
        src_byte = bit_offset / 8;
        high_bit  = bit_offset % 8;
        }
      else
        {
        src_byte = (bit_offset + (sample * bps)) / 8;
        high_bit  = (bit_offset + (sample * bps)) % 8;
        }
      src = ibuff + src_byte;
      match_bits = mask_bits << (32 - high_bit - bps);
      if (little_endian)
	buff1 = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];
      else
	buff1 = (src[3] << 24) | (src[2] << 16) | (src[1] << 8) | src[0];
      buff1 = (buff1 & match_bits) << (high_bit);
      if (ready_bits < 16)
        {
        bytebuff1 = bytebuff2 = 0;
        buff2 = (buff2 | (buff1 >> ready_bits));
        }
      else
        {
        bytebuff1 = (buff2 >> 24);
        *dst++ = bytebuff1;
        bytebuff2 = (buff2 >> 16);
        *dst++ = bytebuff2;
        ready_bits -= 16;
        buff2 = ((buff2 << 16) | (buff1 >> ready_bits));
        }
      ready_bits += bps;
      }
    }
  while (ready_bits > 0)
    {
    bytebuff1 = (buff2 >> 24);
    *dst++ = bytebuff1;
    buff2 = (buff2 << 8);
    bytebuff2 = bytebuff1;
    ready_bits -= 8;
    }
  return (0);
  }
['static int\nmirrorImage(uint16 spp, uint16 bps, uint16 mirror, uint32 width, uint32 length, unsigned char *ibuff)\n  {\n  int      shift_width;\n  uint32   bytes_per_pixel, bytes_per_sample;\n  uint32   row, rowsize, row_offset;\n  unsigned char *line_buff = NULL;\n  unsigned char *src;\n  unsigned char *dst;\n  src = ibuff;\n  rowsize = ((width * bps * spp) + 7) / 8;\n  switch (mirror)\n    {\n    case MIRROR_BOTH:\n    case MIRROR_VERT:\n             line_buff = (unsigned char *)limitMalloc(rowsize);\n             if (line_buff == NULL)\n               {\n\t       TIFFError ("mirrorImage", "Unable to allocate mirror line buffer of %1u bytes", rowsize);\n               return (-1);\n               }\n             dst = ibuff + (rowsize * (length - 1));\n             for (row = 0; row < length / 2; row++)\n               {\n\t      _TIFFmemcpy(line_buff, src, rowsize);\n\t      _TIFFmemcpy(src, dst,  rowsize);\n\t      _TIFFmemcpy(dst, line_buff, rowsize);\n               src += (rowsize);\n               dst -= (rowsize);\n               }\n             if (line_buff)\n               _TIFFfree(line_buff);\n             if (mirror == MIRROR_VERT)\n               break;\n    case MIRROR_HORIZ :\n              if ((bps % 8) == 0)\n                {\n                for (row = 0; row < length; row++)\n                  {\n\t\t  row_offset = row * rowsize;\n                  src = ibuff + row_offset;\n                  dst = ibuff + row_offset + rowsize;\n                  if (reverseSamplesBytes(spp, bps, width, src, dst))\n                    {\n\t\t    return (-1);\n                    }\n\t\t  }\n\t\t}\n\t      else\n                {\n                if (!(line_buff = (unsigned char *)limitMalloc(rowsize + 1)))\n                  {\n                  TIFFError("mirrorImage", "Unable to allocate mirror line buffer");\n                  return (-1);\n                  }\n                bytes_per_sample = (bps + 7) / 8;\n                bytes_per_pixel  = ((bps * spp) + 7) / 8;\n                if (bytes_per_pixel < (bytes_per_sample + 1))\n                  shift_width = bytes_per_pixel;\n                else\n                  shift_width = bytes_per_sample + 1;\n                for (row = 0; row < length; row++)\n                  {\n\t\t  row_offset = row * rowsize;\n                  src = ibuff + row_offset;\n                  _TIFFmemset (line_buff, \'\\0\', rowsize);\n                  switch (shift_width)\n                    {\n                    case 1: if (reverseSamples16bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    case 2: if (reverseSamples24bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    case 3:\n                    case 4:\n                    case 5: if (reverseSamples32bits(spp, bps, width, src, line_buff))\n                              {\n\t\t              _TIFFfree(line_buff);\n                              return (-1);\n                              }\n                             _TIFFmemcpy (src, line_buff, rowsize);\n                             break;\n                    default: TIFFError("mirrorImage","Unsupported bit depth %d", bps);\n\t\t             _TIFFfree(line_buff);\n                             return (-1);\n                    }\n\t\t  }\n                if (line_buff)\n                  _TIFFfree(line_buff);\n\t\t}\n             break;\n    default: TIFFError ("mirrorImage", "Invalid mirror axis %d", mirror);\n             return (-1);\n             break;\n    }\n  return (0);\n  }', 'static void* limitMalloc(tmsize_t s)\n{\n  if (maxMalloc && (s > maxMalloc)) {\n    fprintf(stderr, "MemoryLimitError: allocation of " TIFF_UINT64_FORMAT " bytes is forbidden. Limit is " TIFF_UINT64_FORMAT ".\\n",\n            (uint64)s, (uint64)maxMalloc);\n    fprintf(stderr, "                  use -k option to change limit.\\n"); return NULL;\n  }\n  return _TIFFmalloc(s);\n}', 'static int\nreverseSamples24bits (uint16 spp, uint16 bps, uint32 width,\n                      uint8 *ibuff, uint8 *obuff)\n  {\n  int      ready_bits = 0;\n  uint32   col;\n  uint32   src_byte = 0, high_bit = 0;\n  uint32   bit_offset = 0;\n  uint32   match_bits = 0, mask_bits = 0;\n  uint32   buff1 = 0, buff2 = 0;\n  uint8    bytebuff1 = 0, bytebuff2 = 0;\n  unsigned char *src;\n  unsigned char *dst;\n  tsample_t sample;\n  if ((ibuff == NULL) || (obuff == NULL))\n    {\n    TIFFError("reverseSamples24bits","Invalid image or work buffer");\n    return (1);\n    }\n  ready_bits = 0;\n  mask_bits =  (uint32)-1 >> (32 - bps);\n  dst = obuff;\n  for (col = width; col > 0; col--)\n    {\n    bit_offset = (col - 1) * bps * spp;\n    for (sample = 0; sample < spp; sample++)\n      {\n      if (sample == 0)\n        {\n        src_byte = bit_offset / 8;\n        high_bit  = bit_offset % 8;\n        }\n      else\n        {\n        src_byte = (bit_offset + (sample * bps)) / 8;\n        high_bit  = (bit_offset + (sample * bps)) % 8;\n        }\n      src = ibuff + src_byte;\n      match_bits = mask_bits << (32 - high_bit - bps);\n      if (little_endian)\n\tbuff1 = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3];\n      else\n\tbuff1 = (src[3] << 24) | (src[2] << 16) | (src[1] << 8) | src[0];\n      buff1 = (buff1 & match_bits) << (high_bit);\n      if (ready_bits < 16)\n        {\n        bytebuff1 = bytebuff2 = 0;\n        buff2 = (buff2 | (buff1 >> ready_bits));\n        }\n      else\n        {\n        bytebuff1 = (buff2 >> 24);\n        *dst++ = bytebuff1;\n        bytebuff2 = (buff2 >> 16);\n        *dst++ = bytebuff2;\n        ready_bits -= 16;\n        buff2 = ((buff2 << 16) | (buff1 >> ready_bits));\n        }\n      ready_bits += bps;\n      }\n    }\n  while (ready_bits > 0)\n    {\n    bytebuff1 = (buff2 >> 24);\n    *dst++ = bytebuff1;\n    buff2 = (buff2 << 8);\n    bytebuff2 = bytebuff1;\n    ready_bits -= 8;\n    }\n  return (0);\n  }']