libtiff/tif_ojpeg.c:2028: error: Buffer Overrun S2
  Offset: [`sp->in_buffer_next_strile`, +oo] Size: [0, +oo] by call to `TIFFGetStrileOffsetWithErr`.

libtiff/tif_ojpeg.c:1975:1: Parameter `sp->in_buffer_next_strile`
1973. }
1974. 
1975. static int
      ^
1976. OJPEGReadBufferFill(OJPEGState* sp)
1977. {

libtiff/tif_ojpeg.c:2028:29: Call
2026. 				{
2027. 					int err = 0;
2028. 					sp->in_buffer_file_pos=TIFFGetStrileOffsetWithErr(sp->tif, sp->in_buffer_next_strile, &err);
                                  ^
2029. 					if( err )
2030. 						return 0;

libtiff/tif_dirread.c:6252:1: Parameter `strile`
  6250. 
  6251. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
  6252. uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)
        ^
  6253. {
  6254.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6255:12: Call
  6253. {
  6254.     TIFFDirectory *td = &tif->tif_dir;
  6255.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                   ^
  6256.                                &(td->td_stripoffset_entry),
  6257.                                &(td->td_stripoffset_p), pbErr);

libtiff/tif_dirread.c:6202:1: <Offset trace>
6200. }
6201. 
6202. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
      ^
6203.                                                    TIFFDirEntry* dirent,
6204.                                                    uint64** parray,

libtiff/tif_dirread.c:6202:1: Parameter `strile`
    6200. }
    6201. 
    6202. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
          ^
    6203.                                                    TIFFDirEntry* dirent,
    6204.                                                    uint64** parray,

libtiff/tif_dirread.c:6202:1: <Length trace>
6200. }
6201. 
6202. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
      ^
6203.                                                    TIFFDirEntry* dirent,
6204.                                                    uint64** parray,

libtiff/tif_dirread.c:6202:1: Parameter `**parray`
    6200. }
    6201. 
    6202. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
          ^
    6203.                                                    TIFFDirEntry* dirent,
    6204.                                                    uint64** parray,

libtiff/tif_dirread.c:6242:12: Array access: Offset: [sp->in_buffer_next_strile, +oo] Size: [0, +oo] by call to `TIFFGetStrileOffsetWithErr` 
    6240.         return 0;
    6241.     }
    6242.     return (*parray)[strile];
                     ^
    6243. }
    6244. 

static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                                                   TIFFDirEntry* dirent,
                                                   uint64** parray,
                                                   int *pbErr)
{
    TIFFDirectory *td = &tif->tif_dir;
    if( pbErr )
        *pbErr = 0;
    if( (tif->tif_flags&TIFF_DEFERSTRILELOAD) && !(tif->tif_flags&TIFF_CHOPPEDUPARRAYS) )
    {
        if( !(tif->tif_flags&TIFF_LAZYSTRILELOAD) ||
            dirent->tdir_count <= 4 )
        {
            if( !_TIFFFillStriles(tif) )
            {
                if( pbErr )
                    *pbErr = 1;
            }
        }
        else
        {
             if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
             {
                if( pbErr )
                    *pbErr = 1;
                 return 0;
             }
        }
    }
    if( *parray == NULL || strile >= td->td_nstrips )
    {
        if( pbErr )
            *pbErr = 1;
        return 0;
    }
    return (*parray)[strile];
}
['static int\nOJPEGReadBufferFill(OJPEGState* sp)\n{\n\tuint16 m;\n\ttmsize_t n;\n\tdo\n\t{\n\t\tif (sp->in_buffer_file_togo!=0)\n\t\t{\n\t\t\tif (sp->in_buffer_file_pos_log==0)\n\t\t\t{\n\t\t\t\tTIFFSeekFile(sp->tif,sp->in_buffer_file_pos,SEEK_SET);\n\t\t\t\tsp->in_buffer_file_pos_log=1;\n\t\t\t}\n\t\t\tm=OJPEG_BUFFER;\n\t\t\tif ((uint64)m>sp->in_buffer_file_togo)\n\t\t\t\tm=(uint16)sp->in_buffer_file_togo;\n\t\t\tn=TIFFReadFile(sp->tif,sp->in_buffer,(tmsize_t)m);\n\t\t\tif (n==0)\n\t\t\t\treturn(0);\n\t\t\tassert(n>0);\n\t\t\tassert(n<=OJPEG_BUFFER);\n\t\t\tassert(n<65536);\n\t\t\tassert((uint64)n<=sp->in_buffer_file_togo);\n\t\t\tm=(uint16)n;\n\t\t\tsp->in_buffer_togo=m;\n\t\t\tsp->in_buffer_cur=sp->in_buffer;\n\t\t\tsp->in_buffer_file_togo-=m;\n\t\t\tsp->in_buffer_file_pos+=m;\n\t\t\tbreak;\n\t\t}\n\t\tsp->in_buffer_file_pos_log=0;\n\t\tswitch(sp->in_buffer_source)\n\t\t{\n\t\t\tcase osibsNotSetYet:\n\t\t\t\tif (sp->jpeg_interchange_format!=0)\n\t\t\t\t{\n\t\t\t\t\tsp->in_buffer_file_pos=sp->jpeg_interchange_format;\n\t\t\t\t\tsp->in_buffer_file_togo=sp->jpeg_interchange_format_length;\n\t\t\t\t}\n\t\t\t\tsp->in_buffer_source=osibsJpegInterchangeFormat;\n\t\t\t\tbreak;\n\t\t\tcase osibsJpegInterchangeFormat:\n\t\t\t\tsp->in_buffer_source=osibsStrile;\n                                break;\n\t\t\tcase osibsStrile:\n\t\t\t\tif (sp->in_buffer_next_strile==sp->in_buffer_strile_count)\n\t\t\t\t\tsp->in_buffer_source=osibsEof;\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tint err = 0;\n\t\t\t\t\tsp->in_buffer_file_pos=TIFFGetStrileOffsetWithErr(sp->tif, sp->in_buffer_next_strile, &err);\n\t\t\t\t\tif( err )\n\t\t\t\t\t\treturn 0;\n\t\t\t\t\tif (sp->in_buffer_file_pos!=0)\n\t\t\t\t\t{\n\t\t\t\t\t\tuint64 bytecount = TIFFGetStrileByteCountWithErr(sp->tif, sp->in_buffer_next_strile, &err);\n\t\t\t\t\t\tif( err )\n\t\t\t\t\t\t\treturn 0;\n\t\t\t\t\t\tif (sp->in_buffer_file_pos>=sp->file_size)\n\t\t\t\t\t\t\tsp->in_buffer_file_pos=0;\n\t\t\t\t\t\telse if (bytecount==0)\n\t\t\t\t\t\t\tsp->in_buffer_file_togo=sp->file_size-sp->in_buffer_file_pos;\n\t\t\t\t\t\telse\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tsp->in_buffer_file_togo=bytecount;\n\t\t\t\t\t\t\tif (sp->in_buffer_file_togo==0)\n\t\t\t\t\t\t\t\tsp->in_buffer_file_pos=0;\n\t\t\t\t\t\t\telse if (sp->in_buffer_file_pos+sp->in_buffer_file_togo>sp->file_size)\n\t\t\t\t\t\t\t\tsp->in_buffer_file_togo=sp->file_size-sp->in_buffer_file_pos;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tsp->in_buffer_next_strile++;\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\treturn(0);\n\t\t}\n\t} while (1);\n\treturn(1);\n}', 'uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)\n{\n    TIFFDirectory *td = &tif->tif_dir;\n    return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,\n                               &(td->td_stripoffset_entry),\n                               &(td->td_stripoffset_p), pbErr);\n}', 'static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,\n                                                   TIFFDirEntry* dirent,\n                                                   uint64** parray,\n                                                   int *pbErr)\n{\n    TIFFDirectory *td = &tif->tif_dir;\n    if( pbErr )\n        *pbErr = 0;\n    if( (tif->tif_flags&TIFF_DEFERSTRILELOAD) && !(tif->tif_flags&TIFF_CHOPPEDUPARRAYS) )\n    {\n        if( !(tif->tif_flags&TIFF_LAZYSTRILELOAD) ||\n            dirent->tdir_count <= 4 )\n        {\n            if( !_TIFFFillStriles(tif) )\n            {\n                if( pbErr )\n                    *pbErr = 1;\n            }\n        }\n        else\n        {\n             if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )\n             {\n                if( pbErr )\n                    *pbErr = 1;\n                 return 0;\n             }\n        }\n    }\n    if( *parray == NULL || strile >= td->td_nstrips )\n    {\n        if( pbErr )\n            *pbErr = 1;\n        return 0;\n    }\n    return (*parray)[strile];\n}']