tools/tiffcp.c:799: error: Integer Overflow L2
  ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `TIFFWriteScanline`.

tools/tiffcp.c:786:1: Parameter `out->tif_dir.td_imagelength`
784.  * Contig -> contig by scanline for rows/strip change.
785.  */
786. DECLAREcpFunc(cpContig2ContigByRow)
     ^
787. {
788. 	tdata_t buf = _TIFFmalloc(TIFFScanlineSize(in));

tools/tiffcp.c:799:7: Call
797. 			goto bad;
798. 		}
799. 		if (TIFFWriteScanline(out, buf, row, 0) < 0) {
           ^
800. 			TIFFError(TIFFFileName(out),
801. 				  "Error, can't write scanline %lu",

libtiff/tif_write.c:48:1: Parameter `tif->tif_dir.td_imagelength`
  46. static int TIFFAppendToStrip(TIFF* tif, uint32 strip, uint8* data, tmsize_t cc);
  47. 
  48. int
      ^
  49. TIFFWriteScanline(TIFF* tif, void* buf, uint32 row, uint16 sample)
  50. {

libtiff/tif_write.c:56:7: Call
  54. 	uint32 strip;
  55. 
  56. 	if (!WRITECHECKSTRIPS(tif, module))
            ^
  57. 		return (-1);
  58. 	/*

libtiff/tif_write.c:488:1: Parameter `tif->tif_dir.td_imagelength`
    486.  * that important information is not changed.
    487.  */
    488. int
         ^
    489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    490. {

libtiff/tif_write.c:533:46: Call
    531. 		}
    532. 	}
    533. 	if (tif->tif_dir.td_stripoffset == NULL && !TIFFSetupStrips(tif)) {
                                                      ^
    534. 		tif->tif_dir.td_nstrips = 0;
    535. 		TIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",

libtiff/tif_write.c:448:1: Parameter `tif->tif_dir.td_imagelength`
      446.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
      447. 
      448. int
           ^
      449. TIFFSetupStrips(TIFF* tif)
      450. {

libtiff/tif_write.c:456:29: Call
      454. 		td->td_stripsperimage =
      455. 		    isUnspecified(tif, FIELD_TILEDIMENSIONS) ?
      456. 			td->td_samplesperpixel : TIFFNumberOfTiles(tif);
                                       ^
      457. 	else
      458. 		td->td_stripsperimage =

libtiff/tif_tile.c:140:1: <LHS trace>
138.  * Compute how many tiles are in an image.
139.  */
140. uint32
     ^
141. TIFFNumberOfTiles(TIFF* tif)
142. {

libtiff/tif_tile.c:140:1: Parameter `tif->tif_dir.td_imagelength`
        138.  * Compute how many tiles are in an image.
        139.  */
        140. uint32
             ^
        141. TIFFNumberOfTiles(TIFF* tif)
        142. {

libtiff/tif_tile.c:140:1: <RHS trace>
138.  * Compute how many tiles are in an image.
139.  */
140. uint32
     ^
141. TIFFNumberOfTiles(TIFF* tif)
142. {

libtiff/tif_tile.c:140:1: Parameter `tif->tif_dir.td_imagelength`
        138.  * Compute how many tiles are in an image.
        139.  */
        140. uint32
             ^
        141. TIFFNumberOfTiles(TIFF* tif)
        142. {

libtiff/tif_tile.c:157:6: Binary operation: ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `TIFFWriteScanline` 
        155. 	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
        156. 	    multiply_32(tif, multiply_32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
        157. 	    TIFFhowmany_32(td->td_imagelength, dy),
                  ^
        158. 	    "TIFFNumberOfTiles"),
        159. 	    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");

uint32
TIFFNumberOfTiles(TIFF* tif)
{
	TIFFDirectory *td = &tif->tif_dir;
	uint32 dx = td->td_tilewidth;
	uint32 dy = td->td_tilelength;
	uint32 dz = td->td_tiledepth;
	uint32 ntiles;
	if (dx == (uint32) -1)
		dx = td->td_imagewidth;
	if (dy == (uint32) -1)
		dy = td->td_imagelength;
	if (dz == (uint32) -1)
		dz = td->td_imagedepth;
	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
	    multiply_32(tif, multiply_32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
	    TIFFhowmany_32(td->td_imagelength, dy),
	    "TIFFNumberOfTiles"),
	    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
		ntiles = multiply_32(tif, ntiles, td->td_samplesperpixel,
		    "TIFFNumberOfTiles");
	return (ntiles);
}
['DECLAREcpFunc(cpContig2ContigByRow)\n{\n\ttdata_t buf = _TIFFmalloc(TIFFScanlineSize(in));\n\tuint32 row;\n\t(void) imagewidth; (void) spp;\n\tfor (row = 0; row < imagelength; row++) {\n\t\tif (TIFFReadScanline(in, buf, row, 0) < 0 && !ignore) {\n\t\t\tTIFFError(TIFFFileName(in),\n\t\t\t\t  "Error, can\'t read scanline %lu",\n\t\t\t\t  (unsigned long) row);\n\t\t\tgoto bad;\n\t\t}\n\t\tif (TIFFWriteScanline(out, buf, row, 0) < 0) {\n\t\t\tTIFFError(TIFFFileName(out),\n\t\t\t\t  "Error, can\'t write scanline %lu",\n\t\t\t\t  (unsigned long) row);\n\t\t\tgoto bad;\n\t\t}\n\t}\n\t_TIFFfree(buf);\n\treturn 1;\nbad:\n\t_TIFFfree(buf);\n\treturn 0;\n}', 'int\nTIFFWriteScanline(TIFF* tif, void* buf, uint32 row, uint16 sample)\n{\n\tstatic const char module[] = "TIFFWriteScanline";\n\tregister TIFFDirectory *td;\n\tint status, imagegrew = 0;\n\tuint32 strip;\n\tif (!WRITECHECKSTRIPS(tif, module))\n\t\treturn (-1);\n\tif (!BUFFERCHECK(tif))\n\t\treturn (-1);\n        tif->tif_flags |= TIFF_BUF4WRITE;\n\ttd = &tif->tif_dir;\n\tif (row >= td->td_imagelength) {\n\t\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "Can not change \\"ImageLength\\" when using separate planes");\n\t\t\treturn (-1);\n\t\t}\n\t\ttd->td_imagelength = row+1;\n\t\timagegrew = 1;\n\t}\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE) {\n\t\tif (sample >= td->td_samplesperpixel) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "%lu: Sample out of range, max %lu",\n\t\t\t    (unsigned long) sample, (unsigned long) td->td_samplesperpixel);\n\t\t\treturn (-1);\n\t\t}\n\t\tstrip = sample*td->td_stripsperimage + row/td->td_rowsperstrip;\n\t} else\n\t\tstrip = row / td->td_rowsperstrip;\n\tif (strip >= td->td_nstrips && !TIFFGrowStrips(tif, 1, module))\n\t\treturn (-1);\n\tif (strip != tif->tif_curstrip) {\n\t\tif (!TIFFFlushData(tif))\n\t\t\treturn (-1);\n\t\ttif->tif_curstrip = strip;\n\t\tif (strip >= td->td_stripsperimage && imagegrew)\n\t\t\ttd->td_stripsperimage =\n\t\t\t    TIFFhowmany_32(td->td_imagelength,td->td_rowsperstrip);\n\t\ttif->tif_row =\n\t\t    (strip % td->td_stripsperimage) * td->td_rowsperstrip;\n\t\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\t\tif (!(*tif->tif_setupencode)(tif))\n\t\t\t\treturn (-1);\n\t\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t\t}\n\t\ttif->tif_rawcc = 0;\n\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\tif( td->td_stripbytecount[strip] > 0 )\n\t\t{\n\t\t\ttd->td_stripbytecount[strip] = 0;\n\t\t\ttif->tif_curoff = 0;\n\t\t}\n\t\tif (!(*tif->tif_preencode)(tif, sample))\n\t\t\treturn (-1);\n\t\ttif->tif_flags |= TIFF_POSTENCODE;\n\t}\n\tif (row != tif->tif_row) {\n\t\tif (row < tif->tif_row) {\n\t\t\ttif->tif_row = (strip % td->td_stripsperimage) *\n\t\t\t    td->td_rowsperstrip;\n\t\t\ttif->tif_rawcp = tif->tif_rawdata;\n\t\t}\n\t\tif (!(*tif->tif_seek)(tif, row - tif->tif_row))\n\t\t\treturn (-1);\n\t\ttif->tif_row = row;\n\t}\n\ttif->tif_postdecode( tif, (uint8*) buf, tif->tif_scanlinesize );\n\tstatus = (*tif->tif_encoderow)(tif, (uint8*) buf,\n\t    tif->tif_scanlinesize, sample);\n\ttif->tif_row = row + 1;\n\treturn (status);\n}', 'int\nTIFFWriteCheck(TIFF* tif, int tiles, const char* module)\n{\n\tif (tif->tif_mode == O_RDONLY) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "File not open for writing");\n\t\treturn (0);\n\t}\n\tif (tiles ^ isTiled(tif)) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, tiles ?\n\t\t    "Can not write tiles to a stripped image" :\n\t\t    "Can not write scanlines to a tiled image");\n\t\treturn (0);\n\t}\n\tif (!TIFFFieldSet(tif, FIELD_IMAGEDIMENSIONS)) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t    "Must set \\"ImageWidth\\" before writing data");\n\t\treturn (0);\n\t}\n\tif (tif->tif_dir.td_samplesperpixel == 1) {\n\t\tif (!TIFFFieldSet(tif, FIELD_PLANARCONFIG))\n                    tif->tif_dir.td_planarconfig = PLANARCONFIG_CONTIG;\n\t} else {\n\t\tif (!TIFFFieldSet(tif, FIELD_PLANARCONFIG)) {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "Must set \\"PlanarConfiguration\\" before writing data");\n\t\t\treturn (0);\n\t\t}\n\t}\n\tif (tif->tif_dir.td_stripoffset == NULL && !TIFFSetupStrips(tif)) {\n\t\ttif->tif_dir.td_nstrips = 0;\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",\n\t\t    isTiled(tif) ? "tile" : "strip");\n\t\treturn (0);\n\t}\n\tif (isTiled(tif))\n\t{\n\t\ttif->tif_tilesize = TIFFTileSize(tif);\n\t\tif (tif->tif_tilesize == 0)\n\t\t\treturn (0);\n\t}\n\telse\n\t\ttif->tif_tilesize = (tmsize_t)(-1);\n\ttif->tif_scanlinesize = TIFFScanlineSize(tif);\n\tif (tif->tif_scanlinesize == 0)\n\t\treturn (0);\n\ttif->tif_flags |= TIFF_BEENWRITING;\n\treturn (1);\n}', 'int\nTIFFSetupStrips(TIFF* tif)\n{\n\tTIFFDirectory* td = &tif->tif_dir;\n\tif (isTiled(tif))\n\t\ttd->td_stripsperimage =\n\t\t    isUnspecified(tif, FIELD_TILEDIMENSIONS) ?\n\t\t\ttd->td_samplesperpixel : TIFFNumberOfTiles(tif);\n\telse\n\t\ttd->td_stripsperimage =\n\t\t    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?\n\t\t\ttd->td_samplesperpixel : TIFFNumberOfStrips(tif);\n\ttd->td_nstrips = td->td_stripsperimage;\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\ttd->td_stripsperimage /= td->td_samplesperpixel;\n\ttd->td_stripoffset = (uint64 *)\n\t    _TIFFmalloc(td->td_nstrips * sizeof (uint64));\n\ttd->td_stripbytecount = (uint64 *)\n\t    _TIFFmalloc(td->td_nstrips * sizeof (uint64));\n\tif (td->td_stripoffset == NULL || td->td_stripbytecount == NULL)\n\t\treturn (0);\n\t_TIFFmemset(td->td_stripoffset, 0, td->td_nstrips*sizeof (uint64));\n\t_TIFFmemset(td->td_stripbytecount, 0, td->td_nstrips*sizeof (uint64));\n\tTIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);\n\tTIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);\n\treturn (1);\n}', 'uint32\nTIFFNumberOfTiles(TIFF* tif)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tuint32 dx = td->td_tilewidth;\n\tuint32 dy = td->td_tilelength;\n\tuint32 dz = td->td_tiledepth;\n\tuint32 ntiles;\n\tif (dx == (uint32) -1)\n\t\tdx = td->td_imagewidth;\n\tif (dy == (uint32) -1)\n\t\tdy = td->td_imagelength;\n\tif (dz == (uint32) -1)\n\t\tdz = td->td_imagedepth;\n\tntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :\n\t    multiply_32(tif, multiply_32(tif, TIFFhowmany_32(td->td_imagewidth, dx),\n\t    TIFFhowmany_32(td->td_imagelength, dy),\n\t    "TIFFNumberOfTiles"),\n\t    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\tntiles = multiply_32(tif, ntiles, td->td_samplesperpixel,\n\t\t    "TIFFNumberOfTiles");\n\treturn (ntiles);\n}']