tools/tiff2ps.c:2279: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

tools/tiff2ps.c:2265:4: <Offset trace>
2263. 		 */
2264. 		if (alpha) {
2265. 			int adjust, i, j = 0;
         ^
2266. 			int ncomps = samplesperpixel - extrasamples;
2267. 			for (i = 0; (i + ncomps) < byte_count; i+=samplesperpixel) {

tools/tiff2ps.c:2265:4: Assignment
2263. 		 */
2264. 		if (alpha) {
2265. 			int adjust, i, j = 0;
         ^
2266. 			int ncomps = samplesperpixel - extrasamples;
2267. 			for (i = 0; (i + ncomps) < byte_count; i+=samplesperpixel) {

tools/tiff2ps.c:2278:16: Assignment
2276. 						break;
2277. 					case 3:
2278. 						buf_data[j++] = buf_data[i] + adjust;
                     ^
2279. 						buf_data[j++] = buf_data[i+1] + adjust;
2280. 						buf_data[j++] = buf_data[i+2] + adjust;

tools/tiff2ps.c:2180:3: <Length trace>
2178. 
2179. 	if (use_rawdata) {
2180. 		chunk_size = (tsize_t) bc[0];
        ^
2181. 		for (chunk_no = 1; chunk_no < num_chunks; chunk_no++)
2182. 			if ((tsize_t) bc[chunk_no] > chunk_size)

tools/tiff2ps.c:2180:3: Assignment
2178. 
2179. 	if (use_rawdata) {
2180. 		chunk_size = (tsize_t) bc[0];
        ^
2181. 		for (chunk_no = 1; chunk_no < num_chunks; chunk_no++)
2182. 			if ((tsize_t) bc[chunk_no] > chunk_size)

tools/tiff2ps.c:2190:30: Call
2188. 			chunk_size = TIFFStripSize(tif);
2189. 	}
2190. 	buf_data = (unsigned char *)_TIFFmalloc(chunk_size);
                                   ^
2191. 	if (!buf_data) {
2192. 		TIFFError(filename, "Can't alloc %lu bytes for %s.",

libtiff/tif_unix.c:312:17: Assignment
  310. {
  311.         if (s == 0)
  312.                 return ((void *) NULL);
                       ^
  313. 
  314. 	return (malloc((size_t) s));

tools/tiff2ps.c:2190:2: Assignment
2188. 			chunk_size = TIFFStripSize(tif);
2189. 	}
2190. 	buf_data = (unsigned char *)_TIFFmalloc(chunk_size);
       ^
2191. 	if (!buf_data) {
2192. 		TIFFError(filename, "Can't alloc %lu bytes for %s.",

tools/tiff2ps.c:2279:7: Array access: Offset: [1, +oo] Size: [0, +oo]
2277. 					case 3:
2278. 						buf_data[j++] = buf_data[i] + adjust;
2279. 						buf_data[j++] = buf_data[i+1] + adjust;
            ^
2280. 						buf_data[j++] = buf_data[i+2] + adjust;
2281. 						break;

int
PS_Lvl2page(FILE* fd, TIFF* tif, uint32 w, uint32 h)
{
	uint16 fillorder;
	int use_rawdata, tiled_image, breaklen = MAXLINE;
	uint32 chunk_no, num_chunks;
        uint64 *bc;
	unsigned char *buf_data, *cp;
	tsize_t chunk_size, byte_count;
#if defined( EXP_ASCII85ENCODER )
	tsize_t			ascii85_l;
	uint8		*	ascii85_p = 0;
#endif
	PS_Lvl2colorspace(fd, tif);
	use_rawdata = PS_Lvl2ImageDict(fd, tif, w, h);
#ifdef ENABLE_BROKEN_BEGINENDDATA
	fputs("%%BeginData:\n", fd);
#endif
	fputs("exec\n", fd);
	tiled_image = TIFFIsTiled(tif);
	if (tiled_image) {
		num_chunks = TIFFNumberOfTiles(tif);
		TIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc);
	} else {
		num_chunks = TIFFNumberOfStrips(tif);
		TIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);
	}
	if (use_rawdata) {
		chunk_size = (tsize_t) bc[0];
		for (chunk_no = 1; chunk_no < num_chunks; chunk_no++)
			if ((tsize_t) bc[chunk_no] > chunk_size)
				chunk_size = (tsize_t) bc[chunk_no];
	} else {
		if (tiled_image)
			chunk_size = TIFFTileSize(tif);
		else
			chunk_size = TIFFStripSize(tif);
	}
	buf_data = (unsigned char *)_TIFFmalloc(chunk_size);
	if (!buf_data) {
		TIFFError(filename, "Can't alloc %lu bytes for %s.",
			(unsigned long) chunk_size, tiled_image ? "tiles" : "strips");
		return(FALSE);
	}
#if defined( EXP_ASCII85ENCODER )
	if ( ascii85 ) {
	    ascii85_p = _TIFFmalloc( (chunk_size+(chunk_size/2)) + 8 );
	    if ( !ascii85_p ) {
		_TIFFfree( buf_data );
		TIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );
		return ( FALSE );
	    }
	}
#endif
	TIFFGetFieldDefaulted(tif, TIFFTAG_FILLORDER, &fillorder);
	for (chunk_no = 0; chunk_no < num_chunks; chunk_no++) {
		if (ascii85)
			Ascii85Init();
		else
			breaklen = MAXLINE;
		if (use_rawdata) {
			if (tiled_image)
				byte_count = TIFFReadRawTile(tif, chunk_no,
						  buf_data, chunk_size);
			else
				byte_count = TIFFReadRawStrip(tif, chunk_no,
						  buf_data, chunk_size);
			if (fillorder == FILLORDER_LSB2MSB)
			    TIFFReverseBits(buf_data, byte_count);
		} else {
			if (tiled_image)
				byte_count = TIFFReadEncodedTile(tif,
						chunk_no, buf_data,
						chunk_size);
			else
				byte_count = TIFFReadEncodedStrip(tif,
						chunk_no, buf_data,
						chunk_size);
		}
		if (byte_count < 0) {
			TIFFError(filename, "Can't read %s %d.",
				tiled_image ? "tile" : "strip", chunk_no);
			if (ascii85)
				Ascii85Put('\0', fd);
		}
		if (bitspersample == 16 && !TIFFIsBigEndian(tif)) {
			PS_FlipBytes(buf_data, byte_count);
		}
		if (alpha) {
			int adjust, i, j = 0;
			int ncomps = samplesperpixel - extrasamples;
			for (i = 0; (i + ncomps) < byte_count; i+=samplesperpixel) {
				adjust = 255 - buf_data[i + ncomps];
				switch (ncomps) {
					case 1:
						buf_data[j++] = buf_data[i] + adjust;
						break;
					case 2:
						buf_data[j++] = buf_data[i] + adjust;
						buf_data[j++] = buf_data[i+1] + adjust;
						break;
					case 3:
						buf_data[j++] = buf_data[i] + adjust;
						buf_data[j++] = buf_data[i+1] + adjust;
						buf_data[j++] = buf_data[i+2] + adjust;
						break;
				}
			}
			byte_count -= j;
		}
		if (ascii85) {
#if defined( EXP_ASCII85ENCODER )
			ascii85_l = Ascii85EncodeBlock(ascii85_p, 1, buf_data, byte_count );
			if ( ascii85_l > 0 )
				fwrite( ascii85_p, ascii85_l, 1, fd );
#else
			for (cp = buf_data; byte_count > 0; byte_count--)
				Ascii85Put(*cp++, fd);
#endif
		}
		else
		{
			for (cp = buf_data; byte_count > 0; byte_count--) {
				putc(hex[((*cp)>>4)&0xf], fd);
				putc(hex[(*cp)&0xf], fd);
				cp++;
				if (--breaklen <= 0) {
					putc('\n', fd);
					breaklen = MAXLINE;
				}
			}
		}
		if ( !ascii85 ) {
			if ( level2 || level3 )
				putc( '>', fd );
			putc('\n', fd);
		}
#if !defined( EXP_ASCII85ENCODER )
		else
			Ascii85Flush(fd);
#endif
	}
#if defined( EXP_ASCII85ENCODER )
	if ( ascii85_p )
	    _TIFFfree( ascii85_p );
#endif
	_TIFFfree(buf_data);
#ifdef ENABLE_BROKEN_BEGINENDDATA
	fputs("%%EndData\n", fd);
#endif
	return(TRUE);
}
['int\nPS_Lvl2page(FILE* fd, TIFF* tif, uint32 w, uint32 h)\n{\n\tuint16 fillorder;\n\tint use_rawdata, tiled_image, breaklen = MAXLINE;\n\tuint32 chunk_no, num_chunks;\n        uint64 *bc;\n\tunsigned char *buf_data, *cp;\n\ttsize_t chunk_size, byte_count;\n#if defined( EXP_ASCII85ENCODER )\n\ttsize_t\t\t\tascii85_l;\n\tuint8\t\t*\tascii85_p = 0;\n#endif\n\tPS_Lvl2colorspace(fd, tif);\n\tuse_rawdata = PS_Lvl2ImageDict(fd, tif, w, h);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%BeginData:\\n", fd);\n#endif\n\tfputs("exec\\n", fd);\n\ttiled_image = TIFFIsTiled(tif);\n\tif (tiled_image) {\n\t\tnum_chunks = TIFFNumberOfTiles(tif);\n\t\tTIFFGetField(tif, TIFFTAG_TILEBYTECOUNTS, &bc);\n\t} else {\n\t\tnum_chunks = TIFFNumberOfStrips(tif);\n\t\tTIFFGetField(tif, TIFFTAG_STRIPBYTECOUNTS, &bc);\n\t}\n\tif (use_rawdata) {\n\t\tchunk_size = (tsize_t) bc[0];\n\t\tfor (chunk_no = 1; chunk_no < num_chunks; chunk_no++)\n\t\t\tif ((tsize_t) bc[chunk_no] > chunk_size)\n\t\t\t\tchunk_size = (tsize_t) bc[chunk_no];\n\t} else {\n\t\tif (tiled_image)\n\t\t\tchunk_size = TIFFTileSize(tif);\n\t\telse\n\t\t\tchunk_size = TIFFStripSize(tif);\n\t}\n\tbuf_data = (unsigned char *)_TIFFmalloc(chunk_size);\n\tif (!buf_data) {\n\t\tTIFFError(filename, "Can\'t alloc %lu bytes for %s.",\n\t\t\t(unsigned long) chunk_size, tiled_image ? "tiles" : "strips");\n\t\treturn(FALSE);\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85 ) {\n\t    ascii85_p = _TIFFmalloc( (chunk_size+(chunk_size/2)) + 8 );\n\t    if ( !ascii85_p ) {\n\t\t_TIFFfree( buf_data );\n\t\tTIFFError( filename, "Cannot allocate ASCII85 encoding buffer." );\n\t\treturn ( FALSE );\n\t    }\n\t}\n#endif\n\tTIFFGetFieldDefaulted(tif, TIFFTAG_FILLORDER, &fillorder);\n\tfor (chunk_no = 0; chunk_no < num_chunks; chunk_no++) {\n\t\tif (ascii85)\n\t\t\tAscii85Init();\n\t\telse\n\t\t\tbreaklen = MAXLINE;\n\t\tif (use_rawdata) {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadRawTile(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadRawStrip(tif, chunk_no,\n\t\t\t\t\t\t  buf_data, chunk_size);\n\t\t\tif (fillorder == FILLORDER_LSB2MSB)\n\t\t\t    TIFFReverseBits(buf_data, byte_count);\n\t\t} else {\n\t\t\tif (tiled_image)\n\t\t\t\tbyte_count = TIFFReadEncodedTile(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t\telse\n\t\t\t\tbyte_count = TIFFReadEncodedStrip(tif,\n\t\t\t\t\t\tchunk_no, buf_data,\n\t\t\t\t\t\tchunk_size);\n\t\t}\n\t\tif (byte_count < 0) {\n\t\t\tTIFFError(filename, "Can\'t read %s %d.",\n\t\t\t\ttiled_image ? "tile" : "strip", chunk_no);\n\t\t\tif (ascii85)\n\t\t\t\tAscii85Put(\'\\0\', fd);\n\t\t}\n\t\tif (bitspersample == 16 && !TIFFIsBigEndian(tif)) {\n\t\t\tPS_FlipBytes(buf_data, byte_count);\n\t\t}\n\t\tif (alpha) {\n\t\t\tint adjust, i, j = 0;\n\t\t\tint ncomps = samplesperpixel - extrasamples;\n\t\t\tfor (i = 0; (i + ncomps) < byte_count; i+=samplesperpixel) {\n\t\t\t\tadjust = 255 - buf_data[i + ncomps];\n\t\t\t\tswitch (ncomps) {\n\t\t\t\t\tcase 1:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 2:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase 3:\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+1] + adjust;\n\t\t\t\t\t\tbuf_data[j++] = buf_data[i+2] + adjust;\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbyte_count -= j;\n\t\t}\n\t\tif (ascii85) {\n#if defined( EXP_ASCII85ENCODER )\n\t\t\tascii85_l = Ascii85EncodeBlock(ascii85_p, 1, buf_data, byte_count );\n\t\t\tif ( ascii85_l > 0 )\n\t\t\t\tfwrite( ascii85_p, ascii85_l, 1, fd );\n#else\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--)\n\t\t\t\tAscii85Put(*cp++, fd);\n#endif\n\t\t}\n\t\telse\n\t\t{\n\t\t\tfor (cp = buf_data; byte_count > 0; byte_count--) {\n\t\t\t\tputc(hex[((*cp)>>4)&0xf], fd);\n\t\t\t\tputc(hex[(*cp)&0xf], fd);\n\t\t\t\tcp++;\n\t\t\t\tif (--breaklen <= 0) {\n\t\t\t\t\tputc(\'\\n\', fd);\n\t\t\t\t\tbreaklen = MAXLINE;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif ( !ascii85 ) {\n\t\t\tif ( level2 || level3 )\n\t\t\t\tputc( \'>\', fd );\n\t\t\tputc(\'\\n\', fd);\n\t\t}\n#if !defined( EXP_ASCII85ENCODER )\n\t\telse\n\t\t\tAscii85Flush(fd);\n#endif\n\t}\n#if defined( EXP_ASCII85ENCODER )\n\tif ( ascii85_p )\n\t    _TIFFfree( ascii85_p );\n#endif\n\t_TIFFfree(buf_data);\n#ifdef ENABLE_BROKEN_BEGINENDDATA\n\tfputs("%%EndData\\n", fd);\n#endif\n\treturn(TRUE);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}']