tools/tiffsplit.c:89: error: Integer Overflow L2
  ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `tiffcp`.

tools/tiffsplit.c:89:9: Call
87. 			if (out == NULL)
88. 				return (-2);
89. 			if (!tiffcp(in, out))
            ^
90. 				return (-1);
91. 			TIFFClose(out);

tools/tiffsplit.c:157:1: Parameter `in->tif_dir.td_imagewidth`
  155. }
  156. 
  157. static int
       ^
  158. tiffcp(TIFF* in, TIFF* out)
  159. {

tools/tiffsplit.c:225:11: Call
  223. 	CopyField(TIFFTAG_FAXDCS, stringv);
  224. 	if (TIFFIsTiled(in))
  225. 		return (cpTiles(in, out));
                 ^
  226. 	else
  227. 		return (cpStrips(in, out));

tools/tiffsplit.c:260:1: Parameter `in->tif_dir.td_imagewidth`
    258. }
    259. 
    260. static int
         ^
    261. cpTiles(TIFF* in, TIFF* out)
    262. {

tools/tiffsplit.c:89:9: Call
87. 			if (out == NULL)
88. 				return (-2);
89. 			if (!tiffcp(in, out))
            ^
90. 				return (-1);
91. 			TIFFClose(out);

tools/tiffsplit.c:157:1: Parameter `in->tif_dir.td_imagewidth`
  155. }
  156. 
  157. static int
       ^
  158. tiffcp(TIFF* in, TIFF* out)
  159. {

tools/tiffsplit.c:225:11: Call
  223. 	CopyField(TIFFTAG_FAXDCS, stringv);
  224. 	if (TIFFIsTiled(in))
  225. 		return (cpTiles(in, out));
                 ^
  226. 	else
  227. 		return (cpStrips(in, out));

tools/tiffsplit.c:260:1: Parameter `in->tif_dir.td_imagewidth`
    258. }
    259. 
    260. static int
         ^
    261. cpTiles(TIFF* in, TIFF* out)
    262. {

tools/tiffsplit.c:267:19: Call
    265. 
    266. 	if (buf) {
    267. 		ttile_t t, nt = TIFFNumberOfTiles(in);
                           ^
    268. 		uint64 *bytecounts;
    269. 

libtiff/tif_tile.c:114:1: <LHS trace>
112.  * Compute how many tiles are in an image.
113.  */
114. uint32
     ^
115. TIFFNumberOfTiles(TIFF* tif)
116. {

libtiff/tif_tile.c:114:1: Parameter `tif->tif_dir.td_imagewidth`
      112.  * Compute how many tiles are in an image.
      113.  */
      114. uint32
           ^
      115. TIFFNumberOfTiles(TIFF* tif)
      116. {

libtiff/tif_tile.c:114:1: <RHS trace>
112.  * Compute how many tiles are in an image.
113.  */
114. uint32
     ^
115. TIFFNumberOfTiles(TIFF* tif)
116. {

libtiff/tif_tile.c:114:1: Parameter `tif->tif_dir.td_imagewidth`
      112.  * Compute how many tiles are in an image.
      113.  */
      114. uint32
           ^
      115. TIFFNumberOfTiles(TIFF* tif)
      116. {

libtiff/tif_tile.c:130:48: Binary operation: ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `tiffcp` 
      128. 		dz = td->td_imagedepth;
      129. 	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
      130. 	    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
                                                          ^
      131. 	    TIFFhowmany_32(td->td_imagelength, dy),
      132. 	    "TIFFNumberOfTiles"),

uint32
TIFFNumberOfTiles(TIFF* tif)
{
	TIFFDirectory *td = &tif->tif_dir;
	uint32 dx = td->td_tilewidth;
	uint32 dy = td->td_tilelength;
	uint32 dz = td->td_tiledepth;
	uint32 ntiles;
	if (dx == (uint32) -1)
		dx = td->td_imagewidth;
	if (dy == (uint32) -1)
		dy = td->td_imagelength;
	if (dz == (uint32) -1)
		dz = td->td_imagedepth;
	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
	    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
	    TIFFhowmany_32(td->td_imagelength, dy),
	    "TIFFNumberOfTiles"),
	    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
		ntiles = _TIFFMultiply32(tif, ntiles, td->td_samplesperpixel,
		    "TIFFNumberOfTiles");
	return (ntiles);
}
['int\nmain(int argc, char* argv[])\n{\n\tTIFF *in, *out;\n\tif (argc < 2) {\n                fprintf(stderr, "%s\\n\\n", TIFFGetVersion());\n\t\tfprintf(stderr, "usage: tiffsplit input.tif [prefix]\\n");\n\t\treturn (-3);\n\t}\n\tif (argc > 2) {\n\t\tstrncpy(fname, argv[2], sizeof(fname));\n\t\tfname[sizeof(fname) - 1] = \'\\0\';\n\t}\n\tin = TIFFOpen(argv[1], "r");\n\tif (in != NULL) {\n\t\tdo {\n\t\t\tsize_t path_len;\n\t\t\tchar *path;\n\t\t\tnewfilename();\n\t\t\tpath_len = strlen(fname) + sizeof(TIFF_SUFFIX);\n\t\t\tpath = (char *) _TIFFmalloc(path_len);\n\t\t\tstrncpy(path, fname, path_len);\n\t\t\tpath[path_len - 1] = \'\\0\';\n\t\t\tstrncat(path, TIFF_SUFFIX, path_len - strlen(path) - 1);\n\t\t\tout = TIFFOpen(path, TIFFIsBigEndian(in)?"wb":"wl");\n\t\t\t_TIFFfree(path);\n\t\t\tif (out == NULL)\n\t\t\t\treturn (-2);\n\t\t\tif (!tiffcp(in, out))\n\t\t\t\treturn (-1);\n\t\t\tTIFFClose(out);\n\t\t} while (TIFFReadDirectory(in));\n\t\t(void) TIFFClose(in);\n\t}\n\treturn (0);\n}', 'static int\ntiffcp(TIFF* in, TIFF* out)\n{\n\tuint16 bitspersample, samplesperpixel, compression, shortv, *shortav;\n\tuint32 w, l;\n\tfloat floatv;\n\tchar *stringv;\n\tuint32 longv;\n\tCopyField(TIFFTAG_SUBFILETYPE, longv);\n\tCopyField(TIFFTAG_TILEWIDTH, w);\n\tCopyField(TIFFTAG_TILELENGTH, l);\n\tCopyField(TIFFTAG_IMAGEWIDTH, w);\n\tCopyField(TIFFTAG_IMAGELENGTH, l);\n\tCopyField(TIFFTAG_BITSPERSAMPLE, bitspersample);\n\tCopyField(TIFFTAG_SAMPLESPERPIXEL, samplesperpixel);\n\tCopyField(TIFFTAG_COMPRESSION, compression);\n\tif (compression == COMPRESSION_JPEG) {\n\t\tuint16 count = 0;\n\t\tvoid *table = NULL;\n\t\tif (TIFFGetField(in, TIFFTAG_JPEGTABLES, &count, &table)\n\t\t    && count > 0 && table) {\n\t\t    TIFFSetField(out, TIFFTAG_JPEGTABLES, count, table);\n\t\t}\n\t}\n        CopyField(TIFFTAG_PHOTOMETRIC, shortv);\n\tCopyField(TIFFTAG_PREDICTOR, shortv);\n\tCopyField(TIFFTAG_THRESHHOLDING, shortv);\n\tCopyField(TIFFTAG_FILLORDER, shortv);\n\tCopyField(TIFFTAG_ORIENTATION, shortv);\n\tCopyField(TIFFTAG_MINSAMPLEVALUE, shortv);\n\tCopyField(TIFFTAG_MAXSAMPLEVALUE, shortv);\n\tCopyField(TIFFTAG_XRESOLUTION, floatv);\n\tCopyField(TIFFTAG_YRESOLUTION, floatv);\n\tCopyField(TIFFTAG_GROUP3OPTIONS, longv);\n\tCopyField(TIFFTAG_GROUP4OPTIONS, longv);\n\tCopyField(TIFFTAG_RESOLUTIONUNIT, shortv);\n\tCopyField(TIFFTAG_PLANARCONFIG, shortv);\n\tCopyField(TIFFTAG_ROWSPERSTRIP, longv);\n\tCopyField(TIFFTAG_XPOSITION, floatv);\n\tCopyField(TIFFTAG_YPOSITION, floatv);\n\tCopyField(TIFFTAG_IMAGEDEPTH, longv);\n\tCopyField(TIFFTAG_TILEDEPTH, longv);\n\tCopyField(TIFFTAG_SAMPLEFORMAT, shortv);\n\tCopyField2(TIFFTAG_EXTRASAMPLES, shortv, shortav);\n\t{ uint16 *red, *green, *blue;\n\t  CopyField3(TIFFTAG_COLORMAP, red, green, blue);\n\t}\n\t{ uint16 shortv2;\n\t  CopyField2(TIFFTAG_PAGENUMBER, shortv, shortv2);\n\t}\n\tCopyField(TIFFTAG_ARTIST, stringv);\n\tCopyField(TIFFTAG_IMAGEDESCRIPTION, stringv);\n\tCopyField(TIFFTAG_MAKE, stringv);\n\tCopyField(TIFFTAG_MODEL, stringv);\n\tCopyField(TIFFTAG_SOFTWARE, stringv);\n\tCopyField(TIFFTAG_DATETIME, stringv);\n\tCopyField(TIFFTAG_HOSTCOMPUTER, stringv);\n\tCopyField(TIFFTAG_PAGENAME, stringv);\n\tCopyField(TIFFTAG_DOCUMENTNAME, stringv);\n\tCopyField(TIFFTAG_BADFAXLINES, longv);\n\tCopyField(TIFFTAG_CLEANFAXDATA, longv);\n\tCopyField(TIFFTAG_CONSECUTIVEBADFAXLINES, longv);\n\tCopyField(TIFFTAG_FAXRECVPARAMS, longv);\n\tCopyField(TIFFTAG_FAXRECVTIME, longv);\n\tCopyField(TIFFTAG_FAXSUBADDRESS, stringv);\n\tCopyField(TIFFTAG_FAXDCS, stringv);\n\tif (TIFFIsTiled(in))\n\t\treturn (cpTiles(in, out));\n\telse\n\t\treturn (cpStrips(in, out));\n}', 'static int\ncpTiles(TIFF* in, TIFF* out)\n{\n\ttmsize_t bufsize = TIFFTileSize(in);\n\tunsigned char *buf = (unsigned char *)_TIFFmalloc(bufsize);\n\tif (buf) {\n\t\tttile_t t, nt = TIFFNumberOfTiles(in);\n\t\tuint64 *bytecounts;\n\t\tTIFFGetField(in, TIFFTAG_TILEBYTECOUNTS, &bytecounts);\n\t\tfor (t = 0; t < nt; t++) {\n\t\t\tif (bytecounts[t] > (uint64) bufsize) {\n\t\t\t\tbuf = (unsigned char *)_TIFFrealloc(buf, (tmsize_t)bytecounts[t]);\n\t\t\t\tif (!buf)\n\t\t\t\t\treturn (0);\n\t\t\t\tbufsize = (tmsize_t)bytecounts[t];\n\t\t\t}\n\t\t\tif (TIFFReadRawTile(in, t, buf, (tmsize_t)bytecounts[t]) < 0 ||\n\t\t\t    TIFFWriteRawTile(out, t, buf, (tmsize_t)bytecounts[t]) < 0) {\n\t\t\t\t_TIFFfree(buf);\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\t_TIFFfree(buf);\n\t\treturn (1);\n\t}\n\treturn (0);\n}', 'uint32\nTIFFNumberOfTiles(TIFF* tif)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tuint32 dx = td->td_tilewidth;\n\tuint32 dy = td->td_tilelength;\n\tuint32 dz = td->td_tiledepth;\n\tuint32 ntiles;\n\tif (dx == (uint32) -1)\n\t\tdx = td->td_imagewidth;\n\tif (dy == (uint32) -1)\n\t\tdy = td->td_imagelength;\n\tif (dz == (uint32) -1)\n\t\tdz = td->td_imagedepth;\n\tntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :\n\t    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),\n\t    TIFFhowmany_32(td->td_imagelength, dy),\n\t    "TIFFNumberOfTiles"),\n\t    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\tntiles = _TIFFMultiply32(tif, ntiles, td->td_samplesperpixel,\n\t\t    "TIFFNumberOfTiles");\n\treturn (ntiles);\n}']