contrib/addtiffo/tif_overview.c:565: error: Integer Overflow L2
  ([0, max(0, `hTIFF->tif_dir.td_tilewidth`)] - 1):unsigned32 by call to `TIFFReadEncodedTile`.

contrib/addtiffo/tif_overview.c:540:1: Parameter `hTIFF->tif_dir.td_tilewidth`
538. /************************************************************************/
539. 
540. void TIFF_ProcessFullResBlock( TIFF *hTIFF, int nPlanarConfig,
     ^
541.                                int bSubsampled,
542.                                int nHorSubsampling, int nVerSubsampling,

contrib/addtiffo/tif_overview.c:569:38: Call
567.                                                      0, (tsample_t)iSample ),
568.                                      pabySrcTile,
569.                                      TIFFTileSize(hTIFF));
                                          ^
570.             }
571.             else

libtiff/tif_tile.c:249:1: Parameter `tif->tif_dir.td_tilewidth`
  247. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  248. }
  249. tmsize_t
       ^
  250. TIFFTileSize(TIFF* tif)
  251. {

libtiff/tif_tile.c:255:4: Call
  253. 	uint64 m;
  254. 	tmsize_t n;
  255. 	m=TIFFTileSize64(tif);
          ^
  256. 	n=(tmsize_t)m;
  257. 	if ((uint64)n!=m)

libtiff/tif_tile.c:244:1: Parameter `tif->tif_dir.td_tilewidth`
    242.  * Compute the # bytes in a row-aligned tile.
    243.  */
    244. uint64
         ^
    245. TIFFTileSize64(TIFF* tif)
    246. {

libtiff/tif_tile.c:247:10: Call
    245. TIFFTileSize64(TIFF* tif)
    246. {
    247. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    248. }
    249. tmsize_t

libtiff/tif_tile.c:177:1: Parameter `tif->tif_dir.td_tilewidth`
      175.  * Compute the # bytes in a variable length, row-aligned tile.
      176.  */
      177. uint64
           ^
      178. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      179. {

contrib/addtiffo/tif_overview.c:565:17: Call
563.             if( TIFFIsTiled(hTIFF) )
564.             {
565.                 TIFFReadEncodedTile( hTIFF,
                     ^
566.                                      TIFFComputeTile(hTIFF, nSXOff, nSYOff,
567.                                                      0, (tsample_t)iSample ),

libtiff/tif_read.c:649:1: Parameter `tif->tif_dir.td_tilewidth`
  647.  * amount into the user-supplied buffer.
  648.  */
  649. tmsize_t
       ^
  650. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  651. {

libtiff/tif_read.c:668:6: Call
  666. 	else if (size > tilesize)
  667. 		size = tilesize;
  668. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
            ^
  669. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
  670. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:792:1: Parameter `tif->tif_dir.td_tilewidth`
    790.  * expanded, as necessary, to hold the tile's data.
    791.  */
    792. int
         ^
    793. TIFFFillTile(TIFF* tif, uint32 tile)
    794. {

libtiff/tif_read.c:901:10: Call
    899. 		}
    900. 	}
    901. 	return (TIFFStartTile(tif, tile));
                  ^
    902. }
    903. 

libtiff/tif_read.c:987:1: <LHS trace>
985.  * tile has just been read in.
986.  */
987. static int
     ^
988. TIFFStartTile(TIFF* tif, uint32 tile)
989. {

libtiff/tif_read.c:987:1: Parameter `tif->tif_dir.td_imagewidth`
      985.  * tile has just been read in.
      986.  */
      987. static int
           ^
      988. TIFFStartTile(TIFF* tif, uint32 tile)
      989. {

libtiff/tif_read.c:1002:14: Binary operation: ([0, max(0, hTIFF->tif_dir.td_tilewidth)] - 1):unsigned32 by call to `TIFFReadEncodedTile` 
      1000. 	tif->tif_curtile = tile;
      1001. 	tif->tif_row =
      1002. 	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
                         ^
      1003. 		td->td_tilelength;
      1004. 	tif->tif_col =

static int
TIFFStartTile(TIFF* tif, uint32 tile)
{
	TIFFDirectory *td = &tif->tif_dir;
    if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)
        return 0;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupdecode)(tif))
			return (0);
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_curtile = tile;
	tif->tif_row =
	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
		td->td_tilelength;
	tif->tif_col =
	    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
		td->td_tilewidth;
        tif->tif_flags &= ~TIFF_BUF4WRITE;
	if (tif->tif_flags&TIFF_NOREADRAW)
	{
		tif->tif_rawcp = NULL;
		tif->tif_rawcc = 0;
	}
	else
	{
		tif->tif_rawcp = tif->tif_rawdata;
		tif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];
	}
	return ((*tif->tif_predecode)(tif,
			(uint16)(tile/td->td_stripsperimage)));
}
['void TIFF_ProcessFullResBlock( TIFF *hTIFF, int nPlanarConfig,\n                               int bSubsampled,\n                               int nHorSubsampling, int nVerSubsampling,\n                               int nOverviews, int * panOvList,\n                               int nBitsPerPixel,\n                               int nSamples, TIFFOvrCache ** papoRawBIs,\n                               uint32 nSXOff, uint32 nSYOff,\n                               unsigned char *pabySrcTile,\n                               uint32 nBlockXSize, uint32 nBlockYSize,\n                               int nSampleFormat, const char * pszResampling )\n{\n    int\t\tiOverview, iSample;\n    for( iSample = 0; iSample < nSamples; iSample++ )\n    {\n        if( nPlanarConfig == PLANARCONFIG_SEPARATE || iSample == 0 )\n        {\n            if( TIFFIsTiled(hTIFF) )\n            {\n                TIFFReadEncodedTile( hTIFF,\n                                     TIFFComputeTile(hTIFF, nSXOff, nSYOff,\n                                                     0, (tsample_t)iSample ),\n                                     pabySrcTile,\n                                     TIFFTileSize(hTIFF));\n            }\n            else\n            {\n                TIFFReadEncodedStrip( hTIFF,\n                                      TIFFComputeStrip(hTIFF, nSYOff,\n                                                       (tsample_t) iSample),\n                                      pabySrcTile,\n                                      TIFFStripSize(hTIFF) );\n            }\n        }\n        for( iOverview = 0; iOverview < nOverviews; iOverview++ )\n        {\n            TIFFOvrCache *poRBI = papoRawBIs[iOverview];\n            unsigned char *pabyOTile;\n            uint32  nTXOff, nTYOff, nOXOff, nOYOff, nOMult;\n            uint32  nOBlockXSize = poRBI->nBlockXSize;\n            uint32  nOBlockYSize = poRBI->nBlockYSize;\n            int     nSkewBits, nSampleByteOffset;\n            nOMult = panOvList[iOverview];\n            nOXOff = (nSXOff/nOMult) / nOBlockXSize;\n            nOYOff = (nSYOff/nOMult) / nOBlockYSize;\n            if( bSubsampled )\n            {\n                pabyOTile = TIFFGetOvrBlock_Subsampled( poRBI, nOXOff, nOYOff );\n                nTXOff = (nSXOff - nOXOff*nOMult*nOBlockXSize) / nOMult;\n                nTYOff = (nSYOff - nOYOff*nOMult*nOBlockYSize) / nOMult;\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n                TIFF_DownSample_Subsampled( pabySrcTile, iSample,\n                                            nBlockXSize, nBlockYSize,\n                                            pabyOTile,\n                                            poRBI->nBlockXSize, poRBI->nBlockYSize,\n                                            nTXOff, nTYOff,\n                                            nOMult, pszResampling,\n                                            nHorSubsampling, nVerSubsampling );\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n            }\n            else\n            {\n                pabyOTile = TIFFGetOvrBlock( poRBI, nOXOff, nOYOff, iSample );\n                nTXOff = (nSXOff - nOXOff*nOMult*nOBlockXSize) / nOMult;\n                nTYOff = (nSYOff - nOYOff*nOMult*nOBlockYSize) / nOMult;\n                assert( (nBitsPerPixel % 8) == 0 );\n                if( nPlanarConfig == PLANARCONFIG_SEPARATE )\n                {\n                    nSkewBits = 0;\n                    nSampleByteOffset = 0;\n                }\n                else\n                {\n                    nSkewBits = nBitsPerPixel * (nSamples-1);\n                    nSampleByteOffset = (nBitsPerPixel/8) * iSample;\n                }\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n                TIFF_DownSample( pabySrcTile + nSampleByteOffset,\n                               nBlockXSize, nBlockYSize,\n                               nSkewBits, nBitsPerPixel, pabyOTile,\n                               poRBI->nBlockXSize, poRBI->nBlockYSize,\n                               nTXOff, nTYOff,\n                               nOMult, nSampleFormat, pszResampling );\n#ifdef DBMALLOC\n                malloc_chain_check( 1 );\n#endif\n            }\n        }\n    }\n}', 'tmsize_t\nTIFFTileSize(TIFF* tif)\n{\n\tstatic const char module[] = "TIFFTileSize";\n\tuint64 m;\n\ttmsize_t n;\n\tm=TIFFTileSize64(tif);\n\tn=(tmsize_t)m;\n\tif ((uint64)n!=m)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\tn=0;\n\t}\n\treturn(n);\n}', 'uint64\nTIFFTileSize64(TIFF* tif)\n{\n\treturn (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));\n}', 'uint64\nTIFFVTileSize64(TIFF* tif, uint32 nrows)\n{\n\tstatic const char module[] = "TIFFVTileSize64";\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (td->td_tilelength == 0 || td->td_tilewidth == 0 ||\n\t    td->td_tiledepth == 0)\n\t\treturn (0);\n\tif ((td->td_planarconfig==PLANARCONFIG_CONTIG)&&\n\t    (td->td_photometric==PHOTOMETRIC_YCBCR)&&\n\t    (td->td_samplesperpixel==3)&&\n\t    (!isUpSampled(tif)))\n\t{\n\t\tuint16 ycbcrsubsampling[2];\n\t\tuint16 samplingblock_samples;\n\t\tuint32 samplingblocks_hor;\n\t\tuint32 samplingblocks_ver;\n\t\tuint64 samplingrow_samples;\n\t\tuint64 samplingrow_size;\n\t\tTIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,\n\t\t    ycbcrsubsampling+1);\n\t\tif ((ycbcrsubsampling[0] != 1 && ycbcrsubsampling[0] != 2 && ycbcrsubsampling[0] != 4)\n\t\t    ||(ycbcrsubsampling[1] != 1 && ycbcrsubsampling[1] != 2 && ycbcrsubsampling[1] != 4))\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t\t     "Invalid YCbCr subsampling (%dx%d)",\n\t\t\t\t     ycbcrsubsampling[0],\n\t\t\t\t     ycbcrsubsampling[1] );\n\t\t\treturn 0;\n\t\t}\n\t\tsamplingblock_samples=ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;\n\t\tsamplingblocks_hor=TIFFhowmany_32(td->td_tilewidth,ycbcrsubsampling[0]);\n\t\tsamplingblocks_ver=TIFFhowmany_32(nrows,ycbcrsubsampling[1]);\n\t\tsamplingrow_samples=_TIFFMultiply64(tif,samplingblocks_hor,samplingblock_samples,module);\n\t\tsamplingrow_size=TIFFhowmany8_64(_TIFFMultiply64(tif,samplingrow_samples,td->td_bitspersample,module));\n\t\treturn(_TIFFMultiply64(tif,samplingrow_size,samplingblocks_ver,module));\n\t}\n\telse\n\t\treturn(_TIFFMultiply64(tif,nrows,TIFFTileRowSize64(tif),module));\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n    if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n        return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif (bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\treturn (0);\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata,\n                                                tif->tif_rawdataloaded);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'static int\nTIFFStartTile(TIFF* tif, uint32 tile)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n    if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n        return 0;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupdecode)(tif))\n\t\t\treturn (0);\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_curtile = tile;\n\ttif->tif_row =\n\t    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *\n\t\ttd->td_tilelength;\n\ttif->tif_col =\n\t    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *\n\t\ttd->td_tilewidth;\n        tif->tif_flags &= ~TIFF_BUF4WRITE;\n\tif (tif->tif_flags&TIFF_NOREADRAW)\n\t{\n\t\ttif->tif_rawcp = NULL;\n\t\ttif->tif_rawcc = 0;\n\t}\n\telse\n\t{\n\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\ttif->tif_rawcc = (tmsize_t)td->td_stripbytecount[tile];\n\t}\n\treturn ((*tif->tif_predecode)(tif,\n\t\t\t(uint16)(tile/td->td_stripsperimage)));\n}']