libtiff/tif_write.c:381: error: Integer Overflow L2
  ([0, `tif->tif_dir.td_tilewidth`] - 1):unsigned32.

libtiff/tif_write.c:339:1: <LHS trace>
337.  *     the image on each write (as TIFFWriteScanline does).
338.  */
339. tmsize_t
     ^
340. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
341. {

libtiff/tif_write.c:339:1: Parameter `tif->tif_dir.td_tilewidth`
337.  *     the image on each write (as TIFFWriteScanline does).
338.  */
339. tmsize_t
     ^
340. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
341. {

libtiff/tif_write.c:381:25: Binary operation: ([0, tif->tif_dir.td_tilewidth] - 1):unsigned32
379. 	tif->tif_row = (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength))
380. 		* td->td_tilelength;
381. 	tif->tif_col = (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth))
                             ^
382. 		* td->td_tilewidth;
383. 

tmsize_t
TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
{
	static const char module[] = "TIFFWriteEncodedTile";
	TIFFDirectory *td;
	uint16 sample;
	if (!WRITECHECKTILES(tif, module))
		return ((tmsize_t)(-1));
	td = &tif->tif_dir;
	if (tile >= td->td_nstrips) {
		TIFFErrorExt(tif->tif_clientdata, module, "Tile %lu out of range, max %lu",
		    (unsigned long) tile, (unsigned long) td->td_nstrips);
		return ((tmsize_t)(-1));
	}
	if (!BUFFERCHECK(tif))
		return ((tmsize_t)(-1));
        tif->tif_flags |= TIFF_BUF4WRITE;
	tif->tif_curtile = tile;
	tif->tif_rawcc = 0;
	tif->tif_rawcp = tif->tif_rawdata;
	if( td->td_stripbytecount[tile] > 0 )
        {
            tif->tif_curoff = 0;
        }
	tif->tif_row = (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength))
		* td->td_tilelength;
	tif->tif_col = (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth))
		* td->td_tilewidth;
	if ((tif->tif_flags & TIFF_CODERSETUP) == 0) {
		if (!(*tif->tif_setupencode)(tif))
			return ((tmsize_t)(-1));
		tif->tif_flags |= TIFF_CODERSETUP;
	}
	tif->tif_flags &= ~TIFF_POSTENCODE;
	sample = (uint16)(tile/td->td_stripsperimage);
	if (!(*tif->tif_preencode)(tif, sample))
		return ((tmsize_t)(-1));
	if ( cc < 1 || cc > tif->tif_tilesize)
		cc = tif->tif_tilesize;
	tif->tif_postdecode( tif, (uint8*) data, cc );
	if (!(*tif->tif_encodetile)(tif, (uint8*) data, cc, sample))
		return (0);
	if (!(*tif->tif_postencode)(tif))
		return ((tmsize_t)(-1));
	if (!isFillOrder(tif, td->td_fillorder) &&
	    (tif->tif_flags & TIFF_NOBITREV) == 0)
		TIFFReverseBits((uint8*)tif->tif_rawdata, tif->tif_rawcc);
	if (tif->tif_rawcc > 0 && !TIFFAppendToStrip(tif, tile,
	    tif->tif_rawdata, tif->tif_rawcc))
		return ((tmsize_t)(-1));
	tif->tif_rawcc = 0;
	tif->tif_rawcp = tif->tif_rawdata;
	return (cc);
}
['tmsize_t\nTIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)\n{\n\tstatic const char module[] = "TIFFWriteEncodedTile";\n\tTIFFDirectory *td;\n\tuint16 sample;\n\tif (!WRITECHECKTILES(tif, module))\n\t\treturn ((tmsize_t)(-1));\n\ttd = &tif->tif_dir;\n\tif (tile >= td->td_nstrips) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module, "Tile %lu out of range, max %lu",\n\t\t    (unsigned long) tile, (unsigned long) td->td_nstrips);\n\t\treturn ((tmsize_t)(-1));\n\t}\n\tif (!BUFFERCHECK(tif))\n\t\treturn ((tmsize_t)(-1));\n        tif->tif_flags |= TIFF_BUF4WRITE;\n\ttif->tif_curtile = tile;\n\ttif->tif_rawcc = 0;\n\ttif->tif_rawcp = tif->tif_rawdata;\n\tif( td->td_stripbytecount[tile] > 0 )\n        {\n            tif->tif_curoff = 0;\n        }\n\ttif->tif_row = (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength))\n\t\t* td->td_tilelength;\n\ttif->tif_col = (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth))\n\t\t* td->td_tilewidth;\n\tif ((tif->tif_flags & TIFF_CODERSETUP) == 0) {\n\t\tif (!(*tif->tif_setupencode)(tif))\n\t\t\treturn ((tmsize_t)(-1));\n\t\ttif->tif_flags |= TIFF_CODERSETUP;\n\t}\n\ttif->tif_flags &= ~TIFF_POSTENCODE;\n\tsample = (uint16)(tile/td->td_stripsperimage);\n\tif (!(*tif->tif_preencode)(tif, sample))\n\t\treturn ((tmsize_t)(-1));\n\tif ( cc < 1 || cc > tif->tif_tilesize)\n\t\tcc = tif->tif_tilesize;\n\ttif->tif_postdecode( tif, (uint8*) data, cc );\n\tif (!(*tif->tif_encodetile)(tif, (uint8*) data, cc, sample))\n\t\treturn (0);\n\tif (!(*tif->tif_postencode)(tif))\n\t\treturn ((tmsize_t)(-1));\n\tif (!isFillOrder(tif, td->td_fillorder) &&\n\t    (tif->tif_flags & TIFF_NOBITREV) == 0)\n\t\tTIFFReverseBits((uint8*)tif->tif_rawdata, tif->tif_rawcc);\n\tif (tif->tif_rawcc > 0 && !TIFFAppendToStrip(tif, tile,\n\t    tif->tif_rawdata, tif->tif_rawcc))\n\t\treturn ((tmsize_t)(-1));\n\ttif->tif_rawcc = 0;\n\ttif->tif_rawcp = tif->tif_rawdata;\n\treturn (cc);\n}']