libtiff/tif_getimage.c:656: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFReadTile`.

libtiff/tif_getimage.c:656:10: Call
654. 	while (tocol < w)
655.         {
656. 	    if (TIFFReadTile(tif, buf, col,  
              ^
657. 			     row+img->row_offset, 0, 0)==(tmsize_t)(-1) && img->stoponerr)
658.             {

libtiff/tif_read.c:636:1: Parameter `tif->tif_dir.td_imagewidth`
  634.  * tile is selected by the (x,y,z,s) coordinates.
  635.  */
  636. tmsize_t
       ^
  637. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  638. {

libtiff/tif_getimage.c:656:10: Call
654. 	while (tocol < w)
655.         {
656. 	    if (TIFFReadTile(tif, buf, col,  
              ^
657. 			     row+img->row_offset, 0, 0)==(tmsize_t)(-1) && img->stoponerr)
658.             {

libtiff/tif_read.c:636:1: Parameter `tif->tif_dir.td_imagewidth`
  634.  * tile is selected by the (x,y,z,s) coordinates.
  635.  */
  636. tmsize_t
       ^
  637. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  638. {

libtiff/tif_read.c:639:33: Call
  637. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  638. {
  639. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
                                       ^
  640. 		return ((tmsize_t)(-1));
  641. 	return (TIFFReadEncodedTile(tif,

libtiff/tif_tile.c:74:1: <LHS trace>
72.  * against the image bounds.
73.  */
74. int
    ^
75. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
76. {

libtiff/tif_tile.c:74:1: Parameter `x`
    72.  * against the image bounds.
    73.  */
    74. int
        ^
    75. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
    76. {

libtiff/tif_tile.c:80:3: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFReadTile` 
    78. 
    79. 	if (x >= td->td_imagewidth) {
    80. 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
          ^
    81. 			     "%lu: Col out of range, max %lu",
    82. 			     (unsigned long) x,

int
TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
{
	TIFFDirectory *td = &tif->tif_dir;
	if (x >= td->td_imagewidth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Col out of range, max %lu",
			     (unsigned long) x,
			     (unsigned long) (td->td_imagewidth - 1));
		return (0);
	}
	if (y >= td->td_imagelength) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Row out of range, max %lu",
			     (unsigned long) y,
			     (unsigned long) (td->td_imagelength - 1));
		return (0);
	}
	if (z >= td->td_imagedepth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Depth out of range, max %lu",
			     (unsigned long) z,
			     (unsigned long) (td->td_imagedepth - 1));
		return (0);
	}
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE &&
	    s >= td->td_samplesperpixel) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Sample out of range, max %lu",
			     (unsigned long) s,
			     (unsigned long) (td->td_samplesperpixel - 1));
		return (0);
	}
	return (1);
}
['static int\ngtTileContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)\n{\n    TIFF* tif = img->tif;\n    tileContigRoutine put = img->put.contig;\n    uint32 col, row, y, rowstoread;\n    tmsize_t pos;\n    uint32 tw, th;\n    unsigned char* buf;\n    int32 fromskew, toskew;\n    uint32 nrow;\n    int ret = 1, flip;\n    uint32 this_tw, tocol;\n    int32 this_toskew, leftmost_toskew;\n    int32 leftmost_fromskew;\n    uint32 leftmost_tw;\n    buf = (unsigned char*) _TIFFmalloc(TIFFTileSize(tif));\n    if (buf == 0) {\n\t\tTIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "No space for tile buffer");\n\t\treturn (0);\n    }\n    _TIFFmemset(buf, 0, TIFFTileSize(tif));\n    TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);\n    TIFFGetField(tif, TIFFTAG_TILELENGTH, &th);\n    flip = setorientation(img);\n    if (flip & FLIP_VERTICALLY) {\n\t    y = h - 1;\n\t    toskew = -(int32)(tw + w);\n    }\n    else {\n\t    y = 0;\n\t    toskew = -(int32)(tw - w);\n    }\n    leftmost_fromskew = img->col_offset % tw;\n    leftmost_tw = tw - leftmost_fromskew;\n    leftmost_toskew = toskew + leftmost_fromskew;\n    for (row = 0; row < h; row += nrow)\n    {\n        rowstoread = th - (row + img->row_offset) % th;\n    \tnrow = (row + rowstoread > h ? h - row : rowstoread);\n\tfromskew = leftmost_fromskew;\n\tthis_tw = leftmost_tw;\n\tthis_toskew = leftmost_toskew;\n\ttocol = 0;\n\tcol = img->col_offset;\n\twhile (tocol < w)\n        {\n\t    if (TIFFReadTile(tif, buf, col,\n\t\t\t     row+img->row_offset, 0, 0)==(tmsize_t)(-1) && img->stoponerr)\n            {\n                ret = 0;\n                break;\n            }\n            pos = ((row+img->row_offset) % th) * TIFFTileRowSize(tif) + \\\n\t\t   (fromskew * img->samplesperpixel);\n\t    if (tocol + this_tw > w)\n\t    {\n\t\tfromskew = tw - (w - tocol);\n\t\tthis_tw = tw - fromskew;\n\t\tthis_toskew = toskew + fromskew;\n\t    }\n\t    (*put)(img, raster+y*w+tocol, tocol, y, this_tw, nrow, fromskew, this_toskew, buf + pos);\n\t    tocol += this_tw;\n\t    col += this_tw;\n\t    fromskew = 0;\n\t    this_tw = tw;\n\t    this_toskew = toskew;\n\t}\n        y += (flip & FLIP_VERTICALLY ? -(int32) nrow : (int32) nrow);\n    }\n    _TIFFfree(buf);\n    if (flip & FLIP_HORIZONTALLY) {\n\t    uint32 line;\n\t    for (line = 0; line < h; line++) {\n\t\t    uint32 *left = raster + (line * w);\n\t\t    uint32 *right = left + w - 1;\n\t\t    while ( left < right ) {\n\t\t\t    uint32 temp = *left;\n\t\t\t    *left = *right;\n\t\t\t    *right = temp;\n\t\t\t    left++, right--;\n\t\t    }\n\t    }\n    }\n    return (ret);\n}', 'tmsize_t\nTIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tif (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))\n\t\treturn ((tmsize_t)(-1));\n\treturn (TIFFReadEncodedTile(tif,\n\t    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));\n}', 'int\nTIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (x >= td->td_imagewidth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Col out of range, max %lu",\n\t\t\t     (unsigned long) x,\n\t\t\t     (unsigned long) (td->td_imagewidth - 1));\n\t\treturn (0);\n\t}\n\tif (y >= td->td_imagelength) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Row out of range, max %lu",\n\t\t\t     (unsigned long) y,\n\t\t\t     (unsigned long) (td->td_imagelength - 1));\n\t\treturn (0);\n\t}\n\tif (z >= td->td_imagedepth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Depth out of range, max %lu",\n\t\t\t     (unsigned long) z,\n\t\t\t     (unsigned long) (td->td_imagedepth - 1));\n\t\treturn (0);\n\t}\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE &&\n\t    s >= td->td_samplesperpixel) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Sample out of range, max %lu",\n\t\t\t     (unsigned long) s,\n\t\t\t     (unsigned long) (td->td_samplesperpixel - 1));\n\t\treturn (0);\n\t}\n\treturn (1);\n}']