libtiff/tif_read.c:1371: error: Integer Overflow L2
  ([0, `tif->tif_dir.td_tilelength`] - 1):unsigned32 by call to `TIFFStartTile`.

libtiff/tif_read.c:1207:1: Parameter `tif->tif_dir.td_tilelength`
1205.  * expanded, as necessary, to hold the tile's data.
1206.  */
1207. int
      ^
1208. TIFFFillTile(TIFF* tif, uint32 tile)
1209. {

libtiff/tif_read.c:1371:10: Call
1369. 		}
1370. 	}
1371. 	return (TIFFStartTile(tif, tile));
               ^
1372. }
1373. 

libtiff/tif_read.c:1465:1: <LHS trace>
1463.  * tile has just been read in.
1464.  */
1465. static int
      ^
1466. TIFFStartTile(TIFF* tif, uint32 tile)
1467. {

libtiff/tif_read.c:1465:1: Parameter `tif->tif_dir.td_tilelength`
  1463.  * tile has just been read in.
  1464.  */
  1465. static int
        ^
  1466. TIFFStartTile(TIFF* tif, uint32 tile)
  1467. {

libtiff/tif_read.c:1487:19: Binary operation: ([0, tif->tif_dir.td_tilelength] - 1):unsigned32 by call to `TIFFStartTile` 
  1485.         }
  1486. 	tif->tif_row = (tile % howmany32) * td->td_tilelength;
  1487.         howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
                          ^
  1488.         if (howmany32 == 0) {
  1489.                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");

static int
TIFFStartTile(TIFF* tif, uint32 tile)
{
        static const char module[] = "TIFFStartTile";
	TIFFDirectory *td = &tif->tif_dir;
        uint32 howmany32;
        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
                return 0;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupdecode)(tif))
			return (0);
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_curtile = tile;
        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
        if (howmany32 == 0) {
                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
                return 0;
        }
	tif->tif_row = (tile % howmany32) * td->td_tilelength;
        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
        if (howmany32 == 0) {
                TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
                return 0;
        }
	tif->tif_col = (tile % howmany32) * td->td_tilewidth;
        tif->tif_flags &= ~TIFF_BUF4WRITE;
	if (tif->tif_flags&TIFF_NOREADRAW)
	{
		tif->tif_rawcp = NULL;
		tif->tif_rawcc = 0;
	}
	else
	{
		tif->tif_rawcp = tif->tif_rawdata;
		if( tif->tif_rawdataloaded > 0 )
			tif->tif_rawcc = tif->tif_rawdataloaded;
		else
			tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
	}
	return ((*tif->tif_predecode)(tif,
			(uint16)(tile/td->td_stripsperimage)));
}
['int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n            return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif ((int64)bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n                if( bytecount > 1024 * 1024 )\n                {\n\t\t\ttmsize_t stripsize = TIFFTileSize(tif);\n\t\t\tif( stripsize != 0 &&\n\t\t\t    (bytecount - 4096) / 10 > (uint64)stripsize  )\n\t\t\t{\n\t\t\t\tuint64 newbytecount = (uint64)stripsize * 10 + 4096;\n\t\t\t\tif( (int64)newbytecount >= 0 )\n\t\t\t\t{\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\t\t\tTIFFWarningExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large tile byte count %I64u, tile %lu. Limiting to %I64u",\n\t\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t\t     (unsigned long) tile,\n\t\t\t\t\t     (unsigned __int64) newbytecount);\n#else\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t  "Too large tile byte count %llu, tile %lu. Limiting to %llu",\n\t\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t\t     (unsigned long) tile,\n\t\t\t\t\t     (unsigned long long) newbytecount);\n#endif\n\t\t\t\t\tbytecount = newbytecount;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif)) {\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t\ttif->tif_flags &= ~TIFF_BUFFERMMAP;\n\t\t\t}\n\t\t\tif( isMapped(tif) )\n\t\t\t{\n\t\t\t\tif (bytecountm > tif->tif_rawdatasize &&\n\t\t\t\t    !TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tif (TIFFReadRawStripOrTile2(tif, tile, 0,\n\t\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\t{\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t}\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata,\n                                                tif->tif_rawdataloaded);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'static int\nTIFFStartTile(TIFF* tif, uint32 tile)\n{\n        static const char module[] = "TIFFStartTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n        uint32 howmany32;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n                return 0;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupdecode)(tif))\n\t\t\treturn (0);\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_curtile = tile;\n        howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);\n        if (howmany32 == 0) {\n                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");\n                return 0;\n        }\n\ttif->tif_row = (tile % howmany32) * td->td_tilelength;\n        howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);\n        if (howmany32 == 0) {\n                TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");\n                return 0;\n        }\n\ttif->tif_col = (tile % howmany32) * td->td_tilewidth;\n        tif->tif_flags &= ~TIFF_BUF4WRITE;\n\tif (tif->tif_flags&TIFF_NOREADRAW)\n\t{\n\t\ttif->tif_rawcp = NULL;\n\t\ttif->tif_rawcc = 0;\n\t}\n\telse\n\t{\n\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\tif( tif->tif_rawdataloaded > 0 )\n\t\t\ttif->tif_rawcc = tif->tif_rawdataloaded;\n\t\telse\n\t\t\ttif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];\n\t}\n\treturn ((*tif->tif_predecode)(tif,\n\t\t\t(uint16)(tile/td->td_stripsperimage)));\n}']