tools/tiffcp.c:1342: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadTile`.

tools/tiffcp.c:1316:1: Parameter `in->tif_rawdata`
1314. }
1315. 
1316. DECLAREreadFunc(readContigTilesIntoBuffer)
      ^
1317. {
1318. 	int status = 1;

tools/tiffcp.c:1342:8: Call
1340. 
1341. 		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
1342. 			if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
             ^
1343. 			    && !ignore) {
1344. 				TIFFError(TIFFFileName(in),

libtiff/tif_read.c:659:1: Parameter `*tif->tif_rawdata`
  657.  * tile is selected by the (x,y,z,s) coordinates.
  658.  */
  659. tmsize_t
       ^
  660. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  661. {

libtiff/tif_read.c:664:10: Call
  662. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  663. 		return ((tmsize_t)(-1));
  664. 	return (TIFFReadEncodedTile(tif,
                ^
  665. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  666. }

libtiff/tif_read.c:672:1: Parameter `*tif->tif_rawdata`
    670.  * amount into the user-supplied buffer.
    671.  */
    672. tmsize_t
         ^
    673. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
    674. {

libtiff/tif_read.c:709:6: Call
    707. 	else if (size > tilesize)
    708. 		size = tilesize;
    709. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
              ^
    710. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
    711. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:833:1: Parameter `*tif->tif_rawdata`
      831.  * expanded, as necessary, to hold the tile's data.
      832.  */
      833. int
           ^
      834. TIFFFillTile(TIFF* tif, uint32 tile)
      835. {

libtiff/tif_read.c:938:5: Call
      936. 			if (!isFillOrder(tif, td->td_fillorder) &&
      937. 			    (tif->tif_flags & TIFF_NOBITREV) == 0)
      938. 				TIFFReverseBits(tif->tif_rawdata,
               ^
      939.                                                 tif->tif_rawdataloaded);
      940. 		}

libtiff/tif_swab.c:285:1: <Length trace>
283. }
284. 
285. void
     ^
286. TIFFReverseBits(uint8* cp, tmsize_t n)  
287. {

libtiff/tif_swab.c:285:1: Parameter `*cp`
        283. }
        284. 
        285. void
             ^
        286. TIFFReverseBits(uint8* cp, tmsize_t n)  
        287. {

libtiff/tif_swab.c:296:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFReadTile` 
        294. 		cp[5] = TIFFBitRevTable[cp[5]];
        295. 		cp[6] = TIFFBitRevTable[cp[6]];
        296. 		cp[7] = TIFFBitRevTable[cp[7]];
               ^
        297. 		cp += 8;
        298. 	}

void
TIFFReverseBits(uint8* cp, tmsize_t n)
{
	for (; n > 8; n -= 8) {
		cp[0] = TIFFBitRevTable[cp[0]];
		cp[1] = TIFFBitRevTable[cp[1]];
		cp[2] = TIFFBitRevTable[cp[2]];
		cp[3] = TIFFBitRevTable[cp[3]];
		cp[4] = TIFFBitRevTable[cp[4]];
		cp[5] = TIFFBitRevTable[cp[5]];
		cp[6] = TIFFBitRevTable[cp[6]];
		cp[7] = TIFFBitRevTable[cp[7]];
		cp += 8;
	}
	while (n-- > 0) {
		*cp = TIFFBitRevTable[*cp];
		cp++;
	}
}
['DECLAREreadFunc(readContigTilesIntoBuffer)\n{\n\tint status = 1;\n\ttsize_t tilesize = TIFFTileSize(in);\n\ttdata_t tilebuf;\n\tuint32 imagew = TIFFScanlineSize(in);\n\tuint32 tilew  = TIFFTileRowSize(in);\n\tint iskew = imagew - tilew;\n\tuint8* bufp = (uint8*) buf;\n\tuint32 tw, tl;\n\tuint32 row;\n\t(void) spp;\n\ttilebuf = _TIFFmalloc(tilesize);\n\tif (tilebuf == 0)\n\t\treturn 0;\n\t_TIFFmemset(tilebuf, 0, tilesize);\n\t(void) TIFFGetField(in, TIFFTAG_TILEWIDTH, &tw);\n\t(void) TIFFGetField(in, TIFFTAG_TILELENGTH, &tl);\n\tfor (row = 0; row < imagelength; row += tl) {\n\t\tuint32 nrow = (row+tl > imagelength) ? imagelength-row : tl;\n\t\tuint32 colb = 0;\n\t\tuint32 col;\n\t\tfor (col = 0; col < imagewidth && colb < imagew; col += tw) {\n\t\t\tif (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0\n\t\t\t    && !ignore) {\n\t\t\t\tTIFFError(TIFFFileName(in),\n\t\t\t\t    "Error, can\'t read tile at %lu %lu",\n\t\t\t\t    (unsigned long) col,\n\t\t\t\t    (unsigned long) row);\n\t\t\t\tstatus = 0;\n\t\t\t\tgoto done;\n\t\t\t}\n\t\t\tif (colb + tilew > imagew) {\n\t\t\t\tuint32 width = imagew - colb;\n\t\t\t\tuint32 oskew = tilew - width;\n\t\t\t\tcpStripToTile(bufp + colb,\n\t\t\t\t    tilebuf, nrow, width,\n\t\t\t\t    oskew + iskew, oskew );\n\t\t\t} else\n\t\t\t\tcpStripToTile(bufp + colb,\n\t\t\t\t    tilebuf, nrow, tilew,\n\t\t\t\t    iskew, 0);\n\t\t\tcolb += tilew;\n\t\t}\n\t\tbufp += imagew * nrow;\n\t}\ndone:\n\t_TIFFfree(tilebuf);\n\treturn status;\n}', 'tmsize_t\nTIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tif (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))\n\t\treturn ((tmsize_t)(-1));\n\treturn (TIFFReadEncodedTile(tif,\n\t    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));\n}', 'tmsize_t\nTIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)\n{\n\tstatic const char module[] = "TIFFReadEncodedTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n\ttmsize_t tilesize = tif->tif_tilesize;\n\tif (!TIFFCheckRead(tif, 1))\n\t\treturn ((tmsize_t)(-1));\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "%lu: Tile out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n    if( td->td_compression == COMPRESSION_NONE &&\n        size!=(tmsize_t)(-1) && size >= tilesize &&\n        !isMapped(tif) &&\n        ((tif->tif_flags&TIFF_NOREADRAW)==0) )\n    {\n        if (TIFFReadRawTile1(tif, tile, buf, tilesize, module) != tilesize)\n            return ((tmsize_t)(-1));\n        if (!isFillOrder(tif, td->td_fillorder) &&\n            (tif->tif_flags & TIFF_NOBITREV) == 0)\n            TIFFReverseBits(buf,tilesize);\n        (*tif->tif_postdecode)(tif,buf,tilesize);\n        return (tilesize);\n    }\n\tif (size == (tmsize_t)(-1))\n\t\tsize = tilesize;\n\telse if (size > tilesize)\n\t\tsize = tilesize;\n\tif (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,\n\t    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {\n\t\t(*tif->tif_postdecode)(tif, (uint8*) buf, size);\n\t\treturn (size);\n\t} else\n\t\treturn ((tmsize_t)(-1));\n}', 'int\nTIFFFillTile(TIFF* tif, uint32 tile)\n{\n\tstatic const char module[] = "TIFFFillTile";\n\tTIFFDirectory *td = &tif->tif_dir;\n        if (!_TIFFFillStriles( tif ) || !tif->tif_dir.td_stripbytecount)\n            return 0;\n\tif ((tif->tif_flags&TIFF_NOREADRAW)==0)\n\t{\n\t\tuint64 bytecount = td->td_stripbytecount[tile];\n\t\tif ((int64)bytecount <= 0) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%I64u: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned __int64) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#else\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t"%llu: Invalid tile byte count, tile %lu",\n\t\t\t\t     (unsigned long long) bytecount,\n\t\t\t\t     (unsigned long) tile);\n#endif\n\t\t\treturn (0);\n\t\t}\n\t\tif (isMapped(tif) &&\n\t\t    (isFillOrder(tif, td->td_fillorder)\n\t\t     || (tif->tif_flags & TIFF_NOBITREV))) {\n\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata) {\n\t\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\t\ttif->tif_rawdata = NULL;\n\t\t\t\ttif->tif_rawdatasize = 0;\n\t\t\t}\n\t\t\ttif->tif_flags &= ~TIFF_MYBUFFER;\n\t\t\tif (bytecount > (uint64)tif->tif_size ||\n\t\t\t    td->td_stripoffset[tile] > (uint64)tif->tif_size - bytecount) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t\ttif->tif_rawdatasize = (tmsize_t)bytecount;\n\t\t\ttif->tif_rawdata =\n\t\t\t\ttif->tif_base + (tmsize_t)td->td_stripoffset[tile];\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = (tmsize_t) bytecount;\n\t\t\ttif->tif_flags |= TIFF_BUFFERMMAP;\n\t\t} else {\n\t\t\ttmsize_t bytecountm;\n\t\t\tbytecountm=(tmsize_t)bytecount;\n\t\t\tif ((uint64)bytecountm!=bytecount)\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");\n\t\t\t\treturn(0);\n\t\t\t}\n\t\t\tif (bytecountm > tif->tif_rawdatasize) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif ((tif->tif_flags & TIFF_MYBUFFER) == 0) {\n\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t\t\t    "Data buffer too small to hold tile %lu",\n\t\t\t\t\t    (unsigned long) tile);\n\t\t\t\t\treturn (0);\n\t\t\t\t}\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (tif->tif_flags&TIFF_BUFFERMMAP) {\n\t\t\t\ttif->tif_curtile = NOTILE;\n\t\t\t\tif (!TIFFReadBufferSetup(tif, 0, bytecountm))\n\t\t\t\t\treturn (0);\n\t\t\t}\n\t\t\tif (TIFFReadRawTile1(tif, tile, tif->tif_rawdata,\n\t\t\t    bytecountm, module) != bytecountm)\n\t\t\t\treturn (0);\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = bytecountm;\n\t\t\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t\t\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\t\t\tTIFFReverseBits(tif->tif_rawdata,\n                                                tif->tif_rawdataloaded);\n\t\t}\n\t}\n\treturn (TIFFStartTile(tif, tile));\n}', 'void\nTIFFReverseBits(uint8* cp, tmsize_t n)\n{\n\tfor (; n > 8; n -= 8) {\n\t\tcp[0] = TIFFBitRevTable[cp[0]];\n\t\tcp[1] = TIFFBitRevTable[cp[1]];\n\t\tcp[2] = TIFFBitRevTable[cp[2]];\n\t\tcp[3] = TIFFBitRevTable[cp[3]];\n\t\tcp[4] = TIFFBitRevTable[cp[4]];\n\t\tcp[5] = TIFFBitRevTable[cp[5]];\n\t\tcp[6] = TIFFBitRevTable[cp[6]];\n\t\tcp[7] = TIFFBitRevTable[cp[7]];\n\t\tcp += 8;\n\t}\n\twhile (n-- > 0) {\n\t\t*cp = TIFFBitRevTable[*cp];\n\t\tcp++;\n\t}\n}']