libtiff/tif_getimage.c:809: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `_TIFFReadTileAndAllocBuffer`.

libtiff/tif_getimage.c:809:33: Call
807.                         if( buf == NULL )
808.                         {
809.                             if (_TIFFReadTileAndAllocBuffer(
                                     ^
810.                                     tif, (void**) &buf, bufsize, col,
811.                                     row+img->row_offset,0,0)==(tmsize_t)(-1)

libtiff/tif_read.c:1021:1: Parameter `tif->tif_dir.td_imagewidth`
  1019.  * * calls regular TIFFReadEncodedTile() if *buf != NULL
  1020.  */
  1021. tmsize_t
        ^
  1022. _TIFFReadTileAndAllocBuffer(TIFF* tif,
  1023.                             void **buf, tmsize_t bufsizetoalloc,

libtiff/tif_getimage.c:809:33: Call
807.                         if( buf == NULL )
808.                         {
809.                             if (_TIFFReadTileAndAllocBuffer(
                                     ^
810.                                     tif, (void**) &buf, bufsize, col,
811.                                     row+img->row_offset,0,0)==(tmsize_t)(-1)

libtiff/tif_read.c:1021:1: Parameter `tif->tif_dir.td_imagewidth`
  1019.  * * calls regular TIFFReadEncodedTile() if *buf != NULL
  1020.  */
  1021. tmsize_t
        ^
  1022. _TIFFReadTileAndAllocBuffer(TIFF* tif,
  1023.                             void **buf, tmsize_t bufsizetoalloc,

libtiff/tif_getimage.c:809:33: Call
807.                         if( buf == NULL )
808.                         {
809.                             if (_TIFFReadTileAndAllocBuffer(
                                     ^
810.                                     tif, (void**) &buf, bufsize, col,
811.                                     row+img->row_offset,0,0)==(tmsize_t)(-1)

libtiff/tif_read.c:1021:1: Parameter `tif->tif_dir.td_imagewidth`
  1019.  * * calls regular TIFFReadEncodedTile() if *buf != NULL
  1020.  */
  1021. tmsize_t
        ^
  1022. _TIFFReadTileAndAllocBuffer(TIFF* tif,
  1023.                             void **buf, tmsize_t bufsizetoalloc,

libtiff/tif_read.c:1026:36: Call
  1024.                             uint32 x, uint32 y, uint32 z, uint16 s)
  1025. {
  1026.     if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
                                           ^
  1027.             return ((tmsize_t)(-1));
  1028.     return (_TIFFReadEncodedTileAndAllocBuffer(tif,

libtiff/tif_tile.c:72:1: <LHS trace>
70.  * against the image bounds.
71.  */
72. int
    ^
73. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
74. {

libtiff/tif_tile.c:72:1: Parameter `x`
    70.  * against the image bounds.
    71.  */
    72. int
        ^
    73. TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
    74. {

libtiff/tif_tile.c:78:3: Binary operation: ([0, +oo] - 1):unsigned32 by call to `_TIFFReadTileAndAllocBuffer` 
    76. 
    77. 	if (x >= td->td_imagewidth) {
    78. 		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
          ^
    79. 			     "%lu: Col out of range, max %lu",
    80. 			     (unsigned long) x,

int
TIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)
{
	TIFFDirectory *td = &tif->tif_dir;
	if (x >= td->td_imagewidth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Col out of range, max %lu",
			     (unsigned long) x,
			     (unsigned long) (td->td_imagewidth - 1));
		return (0);
	}
	if (y >= td->td_imagelength) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Row out of range, max %lu",
			     (unsigned long) y,
			     (unsigned long) (td->td_imagelength - 1));
		return (0);
	}
	if (z >= td->td_imagedepth) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Depth out of range, max %lu",
			     (unsigned long) z,
			     (unsigned long) (td->td_imagedepth - 1));
		return (0);
	}
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE &&
	    s >= td->td_samplesperpixel) {
		TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
			     "%lu: Sample out of range, max %lu",
			     (unsigned long) s,
			     (unsigned long) (td->td_samplesperpixel - 1));
		return (0);
	}
	return (1);
}
['static int\ngtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h)\n{\n\tTIFF* tif = img->tif;\n\ttileSeparateRoutine put = img->put.separate;\n\tuint32 col, row, y, rowstoread;\n\ttmsize_t pos;\n\tuint32 tw, th;\n\tunsigned char* buf = NULL;\n\tunsigned char* p0 = NULL;\n\tunsigned char* p1 = NULL;\n\tunsigned char* p2 = NULL;\n\tunsigned char* pa = NULL;\n\ttmsize_t tilesize;\n\ttmsize_t bufsize;\n\tint32 fromskew, toskew;\n\tint alpha = img->alpha;\n\tuint32 nrow;\n\tint ret = 1, flip;\n        uint16 colorchannels;\n\tuint32 this_tw, tocol;\n\tint32 this_toskew, leftmost_toskew;\n\tint32 leftmost_fromskew;\n\tuint32 leftmost_tw;\n\ttilesize = TIFFTileSize(tif);\n\tbufsize = TIFFSafeMultiply(tmsize_t,alpha?4:3,tilesize);\n\tif (bufsize == 0) {\n\t\tTIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Integer overflow in %s", "gtTileSeparate");\n\t\treturn (0);\n\t}\n\tTIFFGetField(tif, TIFFTAG_TILEWIDTH, &tw);\n\tTIFFGetField(tif, TIFFTAG_TILELENGTH, &th);\n\tflip = setorientation(img);\n\tif (flip & FLIP_VERTICALLY) {\n\t\ty = h - 1;\n\t\ttoskew = -(int32)(tw + w);\n\t}\n\telse {\n\t\ty = 0;\n\t\ttoskew = -(int32)(tw - w);\n\t}\n        switch( img->photometric )\n        {\n          case PHOTOMETRIC_MINISWHITE:\n          case PHOTOMETRIC_MINISBLACK:\n          case PHOTOMETRIC_PALETTE:\n            colorchannels = 1;\n            break;\n          default:\n            colorchannels = 3;\n            break;\n        }\n\tleftmost_fromskew = img->col_offset % tw;\n\tleftmost_tw = tw - leftmost_fromskew;\n\tleftmost_toskew = toskew + leftmost_fromskew;\n\tfor (row = 0; ret != 0 && row < h; row += nrow)\n\t{\n\t\trowstoread = th - (row + img->row_offset) % th;\n\t\tnrow = (row + rowstoread > h ? h - row : rowstoread);\n\t\tfromskew = leftmost_fromskew;\n\t\tthis_tw = leftmost_tw;\n\t\tthis_toskew = leftmost_toskew;\n\t\ttocol = 0;\n\t\tcol = img->col_offset;\n\t\twhile (tocol < w)\n\t\t{\n                        if( buf == NULL )\n                        {\n                            if (_TIFFReadTileAndAllocBuffer(\n                                    tif, (void**) &buf, bufsize, col,\n                                    row+img->row_offset,0,0)==(tmsize_t)(-1)\n                                && (buf == NULL || img->stoponerr))\n                            {\n                                    ret = 0;\n                                    break;\n                            }\n                            p0 = buf;\n                            if( colorchannels == 1 )\n                            {\n                                p2 = p1 = p0;\n                                pa = (alpha?(p0+3*tilesize):NULL);\n                            }\n                            else\n                            {\n                                p1 = p0 + tilesize;\n                                p2 = p1 + tilesize;\n                                pa = (alpha?(p2+tilesize):NULL);\n                            }\n                        }\n\t\t\telse if (TIFFReadTile(tif, p0, col,\n\t\t\t    row+img->row_offset,0,0)==(tmsize_t)(-1) && img->stoponerr)\n\t\t\t{\n\t\t\t\tret = 0;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (colorchannels > 1\n                            && TIFFReadTile(tif, p1, col,\n                                            row+img->row_offset,0,1) == (tmsize_t)(-1)\n                            && img->stoponerr)\n\t\t\t{\n\t\t\t\tret = 0;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (colorchannels > 1\n                            && TIFFReadTile(tif, p2, col,\n                                            row+img->row_offset,0,2) == (tmsize_t)(-1)\n                            && img->stoponerr)\n\t\t\t{\n\t\t\t\tret = 0;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (alpha\n                            && TIFFReadTile(tif,pa,col,\n                                            row+img->row_offset,0,colorchannels) == (tmsize_t)(-1)\n                            && img->stoponerr)\n                        {\n                            ret = 0;\n                            break;\n\t\t\t}\n\t\t\tpos = ((row+img->row_offset) % th) * TIFFTileRowSize(tif) + \\\n\t\t\t   ((tmsize_t) fromskew * img->samplesperpixel);\n\t\t\tif (tocol + this_tw > w)\n\t\t\t{\n\t\t\t\tfromskew = tw - (w - tocol);\n\t\t\t\tthis_tw = tw - fromskew;\n\t\t\t\tthis_toskew = toskew + fromskew;\n\t\t\t}\n\t\t\t(*put)(img, raster+y*w+tocol, tocol, y, this_tw, nrow, fromskew, this_toskew, \\\n\t\t\t\tp0 + pos, p1 + pos, p2 + pos, (alpha?(pa+pos):NULL));\n\t\t\ttocol += this_tw;\n\t\t\tcol += this_tw;\n\t\t\tfromskew = 0;\n\t\t\tthis_tw = tw;\n\t\t\tthis_toskew = toskew;\n\t\t}\n\t\ty += ((flip & FLIP_VERTICALLY) ?-(int32) nrow : (int32) nrow);\n\t}\n\tif (flip & FLIP_HORIZONTALLY) {\n\t\tuint32 line;\n\t\tfor (line = 0; line < h; line++) {\n\t\t\tuint32 *left = raster + (line * w);\n\t\t\tuint32 *right = left + w - 1;\n\t\t\twhile ( left < right ) {\n\t\t\t\tuint32 temp = *left;\n\t\t\t\t*left = *right;\n\t\t\t\t*right = temp;\n\t\t\t\tleft++;\n\t\t\t\tright--;\n\t\t\t}\n\t\t}\n\t}\n\t_TIFFfree(buf);\n\treturn (ret);\n}', 'tmsize_t\n_TIFFReadTileAndAllocBuffer(TIFF* tif,\n                            void **buf, tmsize_t bufsizetoalloc,\n                            uint32 x, uint32 y, uint32 z, uint16 s)\n{\n    if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))\n            return ((tmsize_t)(-1));\n    return (_TIFFReadEncodedTileAndAllocBuffer(tif,\n                                               TIFFComputeTile(tif, x, y, z, s),\n                                               buf, bufsizetoalloc,\n                                               (tmsize_t)(-1)));\n}', 'int\nTIFFCheckTile(TIFF* tif, uint32 x, uint32 y, uint32 z, uint16 s)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tif (x >= td->td_imagewidth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Col out of range, max %lu",\n\t\t\t     (unsigned long) x,\n\t\t\t     (unsigned long) (td->td_imagewidth - 1));\n\t\treturn (0);\n\t}\n\tif (y >= td->td_imagelength) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Row out of range, max %lu",\n\t\t\t     (unsigned long) y,\n\t\t\t     (unsigned long) (td->td_imagelength - 1));\n\t\treturn (0);\n\t}\n\tif (z >= td->td_imagedepth) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Depth out of range, max %lu",\n\t\t\t     (unsigned long) z,\n\t\t\t     (unsigned long) (td->td_imagedepth - 1));\n\t\treturn (0);\n\t}\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE &&\n\t    s >= td->td_samplesperpixel) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "%lu: Sample out of range, max %lu",\n\t\t\t     (unsigned long) s,\n\t\t\t     (unsigned long) (td->td_samplesperpixel - 1));\n\t\treturn (0);\n\t}\n\treturn (1);\n}']