tools/tiffcrop.c:6977: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `update_output_file`.

tools/tiffcrop.c:6891:1: Parameter `(*out)->tif_dir.td_rowsperstrip`
6889.   } /* end extractImageSection */
6890. 
6891. static int 
      ^
6892. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6893.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6977:16: Call
6975.          for (i = 0; i < crop->selections; i++)
6976.            {
6977.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6978.              return (1);
6979. 

tools/tiffcrop.c:2106:1: Parameter `(*tiffout)->tif_dir.td_rowsperstrip`
  2104.  * so TIFFTAG PAGENUM will be correct in image.
  2105.  */
  2106. static int
        ^
  2107. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2108.                     char *outname, unsigned int *page)

tools/tiffcrop.c:2119:5: Call
  2117.     {
  2118.     /* Close any export file that was previously opened */
  2119.     TIFFClose (*tiffout);
            ^
  2120.     *tiffout = NULL;
  2121.     }

libtiff/tif_close.c:120:1: Parameter `tif->tif_dir.td_rowsperstrip`
    118.  */
    119. 
    120. void
         ^
    121. TIFFClose(TIFF* tif)
    122. {

libtiff/tif_close.c:126:2: Call
    124. 	thandle_t fd = tif->tif_clientdata;
    125. 
    126. 	TIFFCleanup(tif);
          ^
    127. 	(void) (*closeproc)(fd);
    128. }

libtiff/tif_close.c:44:1: Parameter `tif->tif_dir.td_rowsperstrip`
      42.  */
      43. 
      44. void
          ^
      45. TIFFCleanup(TIFF* tif)
      46. {

libtiff/tif_close.c:51:3: Call
      49.          */
      50. 	if (tif->tif_mode != O_RDONLY)
      51. 		TIFFFlush(tif);
            ^
      52. 	(*tif->tif_cleanup)(tif);
      53. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_rowsperstrip`
        28. #include "tiffiop.h"
        29. 
        30. int
            ^
        31. TIFFFlush(TIFF* tif)
        32. {

libtiff/tif_flush.c:48:13: Call
        46.         && tif->tif_mode == O_RDWR )
        47.     {
        48.         if( TIFFForceStrileArrayWriting(tif) )
                        ^
        49.             return 1;
        50.     }

libtiff/tif_flush.c:78:1: Parameter `tif->tif_dir.td_rowsperstrip`
          76.  * Returns 1 in case of success, 0 otherwise.
          77.  */
          78. int TIFFForceStrileArrayWriting(TIFF* tif)
              ^
          79. {
          80.     static const char module[] = "TIFFForceStrileArrayWriting";

libtiff/tif_flush.c:120:55: Call
          118.         }
          119. 
          120.         if (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif))
                                                                     ^
          121.             return 0;
          122.     }

libtiff/tif_write.c:522:1: Parameter `tif->tif_dir.td_rowsperstrip`
            520.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
            521. 
            522. int
                 ^
            523. TIFFSetupStrips(TIFF* tif)
            524. {

libtiff/tif_write.c:534:29: Call
            532. 		td->td_stripsperimage =
            533. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
            534. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                             ^
            535. 	td->td_nstrips = td->td_stripsperimage;
            536. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:58:1: <LHS trace>
56.  * Compute how many strips are in an image.
57.  */
58. uint32
    ^
59. TIFFNumberOfStrips(TIFF* tif)
60. {

libtiff/tif_strip.c:58:1: Parameter `tif->tif_dir.td_imagelength`
              56.  * Compute how many strips are in an image.
              57.  */
              58. uint32
                  ^
              59. TIFFNumberOfStrips(TIFF* tif)
              60. {

libtiff/tif_strip.c:65:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `update_output_file` 
              63. 
              64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
              65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                        ^
              66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
              67. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,

uint32
TIFFNumberOfStrips(TIFF* tif)
{
	TIFFDirectory *td = &tif->tif_dir;
	uint32 nstrips;
	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
		    "TIFFNumberOfStrips");
	return (nstrips);
}
['static int\nwriteSelections(TIFF *in, TIFF **out, struct crop_mask *crop,\n                struct image_data *image, struct dump_opts *dump,\n                struct buffinfo seg_buffs[], char *mp, char *filename,\n                unsigned int *page, unsigned int total_pages)\n  {\n  int i, page_count;\n  int autoindex = 0;\n  unsigned char *crop_buff = NULL;\n  switch (crop->exp_mode)\n    {\n    case ONE_FILE_COMPOSITE:\n         autoindex = 0;\n         crop_buff = seg_buffs[0].buffer;\n         if (update_output_file (out, mp, autoindex, filename, page))\n           return (1);\n         page_count = total_pages;\n         if (writeCroppedImage(in, *out, image, dump,\n                               crop->combined_width,\n                               crop->combined_length,\n                               crop_buff, *page, total_pages))\n            {\n             TIFFError("writeRegions", "Unable to write new image");\n             return (-1);\n             }\n\t break;\n    case ONE_FILE_SEPARATED:\n         autoindex = 0;\n         if (update_output_file (out, mp, autoindex, filename, page))\n           return (1);\n         page_count = crop->selections * total_pages;\n         for (i = 0; i < crop->selections; i++)\n           {\n           crop_buff = seg_buffs[i].buffer;\n           if (writeCroppedImage(in, *out, image, dump,\n                                 crop->regionlist[i].width,\n                                 crop->regionlist[i].length,\n                                 crop_buff, *page, page_count))\n             {\n             TIFFError("writeRegions", "Unable to write new image");\n             return (-1);\n             }\n\t   }\n         break;\n    case FILE_PER_IMAGE_COMPOSITE:\n         autoindex = 1;\n         if (update_output_file (out, mp, autoindex, filename, page))\n           return (1);\n         crop_buff = seg_buffs[0].buffer;\n         if (writeCroppedImage(in, *out, image, dump,\n                               crop->combined_width,\n                               crop->combined_length,\n                               crop_buff, *page, total_pages))\n           {\n           TIFFError("writeRegions", "Unable to write new image");\n           return (-1);\n           }\n         break;\n    case FILE_PER_IMAGE_SEPARATED:\n         autoindex = 1;\n         page_count = crop->selections;\n         if (update_output_file (out, mp, autoindex, filename, page))\n           return (1);\n         for (i = 0; i < crop->selections; i++)\n           {\n           crop_buff = seg_buffs[i].buffer;\n           if (writeCroppedImage(in, *out, image, dump,\n                                 crop->regionlist[i].width,\n                                 crop->regionlist[i].length,\n                                 crop_buff, *page, page_count))\n             {\n             TIFFError("writeRegions", "Unable to write new image");\n             return (-1);\n             }\n           }\n         break;\n    case FILE_PER_SELECTION:\n         autoindex = 1;\n\t page_count = 1;\n         for (i = 0; i < crop->selections; i++)\n           {\n           if (update_output_file (out, mp, autoindex, filename, page))\n             return (1);\n           crop_buff = seg_buffs[i].buffer;\n           if (writeCroppedImage(in, *out, image, dump,\n                                 crop->regionlist[i].width,\n                                 crop->regionlist[i].length,\n                                 crop_buff, *page, page_count))\n             {\n             TIFFError("writeRegions", "Unable to write new image");\n             return (-1);\n             }\n           }\n\t break;\n    default: return (1);\n    }\n  return (0);\n  }', 'static int\nupdate_output_file (TIFF **tiffout, char *mode, int autoindex,\n                    char *outname, unsigned int *page)\n  {\n  static int findex = 0;\n  size_t basename_len;\n  char  *sep;\n  char   export_ext[16];\n  char   exportname[PATH_MAX];\n  if (autoindex && (*tiffout != NULL))\n    {\n    TIFFClose (*tiffout);\n    *tiffout = NULL;\n    }\n  memcpy (export_ext, ".tiff", 6);\n  memset (exportname, \'\\0\', sizeof(exportname));\n  #define FILENUM_MAX_LENGTH (1+6+1+4+1)\n  strncpy (exportname, outname, sizeof(exportname) - FILENUM_MAX_LENGTH);\n  if (*tiffout == NULL)\n    {\n    if (autoindex)\n      {\n      findex++;\n      if ((sep = strstr(exportname, ".tif")) || (sep = strstr(exportname, ".TIF")))\n        {\n        strncpy (export_ext, sep, 5);\n        *sep = \'\\0\';\n        }\n      else\n        memcpy (export_ext, ".tiff", 5);\n      export_ext[5] = \'\\0\';\n      basename_len = strlen(exportname);\n      if (findex > MAX_EXPORT_PAGES)\n        {\n        TIFFError("update_output_file", "Maximum of %d pages per file exceeded", MAX_EXPORT_PAGES);\n        return 1;\n        }\n      snprintf(exportname + basename_len, sizeof(exportname) - basename_len, "-%03d%.5s", findex, export_ext);\n      }\n    exportname[sizeof(exportname) - 1] = \'\\0\';\n    *tiffout = TIFFOpen(exportname, mode);\n    if (*tiffout == NULL)\n      {\n      TIFFError("update_output_file", "Unable to open output file %s", exportname);\n      return 1;\n      }\n    *page = 0;\n    return 0;\n    }\n  else\n    (*page)++;\n  return 0;\n  }', 'void\nTIFFClose(TIFF* tif)\n{\n\tTIFFCloseProc closeproc = tif->tif_closeproc;\n\tthandle_t fd = tif->tif_clientdata;\n\tTIFFCleanup(tif);\n\t(void) (*closeproc)(fd);\n}', 'void\nTIFFCleanup(TIFF* tif)\n{\n\tif (tif->tif_mode != O_RDONLY)\n\t\tTIFFFlush(tif);\n\t(*tif->tif_cleanup)(tif);\n\tTIFFFreeDirectory(tif);\n\tif (tif->tif_dirlist)\n\t\t_TIFFfree(tif->tif_dirlist);\n\twhile( tif->tif_clientinfo )\n\t{\n\t\tTIFFClientInfoLink *psLink = tif->tif_clientinfo;\n\t\ttif->tif_clientinfo = psLink->next;\n\t\t_TIFFfree( psLink->name );\n\t\t_TIFFfree( psLink );\n\t}\n\tif (tif->tif_rawdata && (tif->tif_flags&TIFF_MYBUFFER))\n\t\t_TIFFfree(tif->tif_rawdata);\n\tif (isMapped(tif))\n\t\tTIFFUnmapFileContents(tif, tif->tif_base, (toff_t)tif->tif_size);\n\tif (tif->tif_fields && tif->tif_nfields > 0) {\n\t\tuint32 i;\n\t\tfor (i = 0; i < tif->tif_nfields; i++) {\n\t\t\tTIFFField *fld = tif->tif_fields[i];\n\t\t\tif (fld->field_bit == FIELD_CUSTOM &&\n\t\t\t    strncmp("Tag ", fld->field_name, 4) == 0) {\n\t\t\t\t_TIFFfree(fld->field_name);\n\t\t\t\t_TIFFfree(fld);\n\t\t\t}\n\t\t}\n\t\t_TIFFfree(tif->tif_fields);\n\t}\n        if (tif->tif_nfieldscompat > 0) {\n                uint32 i;\n                for (i = 0; i < tif->tif_nfieldscompat; i++) {\n                        if (tif->tif_fieldscompat[i].allocated_size)\n                                _TIFFfree(tif->tif_fieldscompat[i].fields);\n                }\n                _TIFFfree(tif->tif_fieldscompat);\n        }\n\t_TIFFfree(tif);\n}', 'int\nTIFFFlush(TIFF* tif)\n{\n    if( tif->tif_mode == O_RDONLY )\n        return 1;\n    if (!TIFFFlushData(tif))\n        return (0);\n    if( (tif->tif_flags & TIFF_DIRTYSTRIP)\n        && !(tif->tif_flags & TIFF_DIRTYDIRECT)\n        && tif->tif_mode == O_RDWR )\n    {\n        if( TIFFForceStrileArrayWriting(tif) )\n            return 1;\n    }\n    if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP))\n        && !TIFFRewriteDirectory(tif))\n        return (0);\n    return (1);\n}', 'int TIFFForceStrileArrayWriting(TIFF* tif)\n{\n    static const char module[] = "TIFFForceStrileArrayWriting";\n    const int isTiled = TIFFIsTiled(tif);\n    if (tif->tif_mode == O_RDONLY)\n    {\n        TIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n                     "File opened in read-only mode");\n        return 0;\n    }\n    if( tif->tif_diroff == 0 )\n    {\n        TIFFErrorExt(tif->tif_clientdata, module,\n                     "Directory has not yet been written");\n        return 0;\n    }\n    if( (tif->tif_flags & TIFF_DIRTYDIRECT) != 0 )\n    {\n        TIFFErrorExt(tif->tif_clientdata, module,\n                     "Directory has changes other than the strile arrays. "\n                     "TIFFRewriteDirectory() should be called instead");\n        return 0;\n    }\n    if( !(tif->tif_flags & TIFF_DIRTYSTRIP) )\n    {\n        if( !(tif->tif_dir.td_stripoffset_entry.tdir_tag != 0 &&\n             tif->tif_dir.td_stripoffset_entry.tdir_count == 0 &&\n             tif->tif_dir.td_stripoffset_entry.tdir_type == 0 &&\n             tif->tif_dir.td_stripoffset_entry.tdir_offset.toff_long8 == 0 &&\n             tif->tif_dir.td_stripbytecount_entry.tdir_tag != 0 &&\n             tif->tif_dir.td_stripbytecount_entry.tdir_count == 0 &&\n             tif->tif_dir.td_stripbytecount_entry.tdir_type == 0 &&\n             tif->tif_dir.td_stripbytecount_entry.tdir_offset.toff_long8 == 0) )\n        {\n            TIFFErrorExt(tif->tif_clientdata, module,\n                        "Function not called together with "\n                        "TIFFDeferStrileArrayWriting()");\n            return 0;\n        }\n        if (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif))\n            return 0;\n    }\n    if( _TIFFRewriteField( tif,\n                           isTiled ? TIFFTAG_TILEOFFSETS :\n                                     TIFFTAG_STRIPOFFSETS,\n                           TIFF_LONG8,\n                           tif->tif_dir.td_nstrips,\n                           tif->tif_dir.td_stripoffset_p )\n        && _TIFFRewriteField( tif,\n                              isTiled ? TIFFTAG_TILEBYTECOUNTS :\n                                        TIFFTAG_STRIPBYTECOUNTS,\n                              TIFF_LONG8,\n                              tif->tif_dir.td_nstrips,\n                              tif->tif_dir.td_stripbytecount_p ) )\n    {\n        tif->tif_flags &= ~TIFF_DIRTYSTRIP;\n        tif->tif_flags &= ~TIFF_BEENWRITING;\n        return 1;\n    }\n    return 0;\n}', 'int\nTIFFSetupStrips(TIFF* tif)\n{\n\tTIFFDirectory* td = &tif->tif_dir;\n\tif (isTiled(tif))\n\t\ttd->td_stripsperimage =\n\t\t    isUnspecified(tif, FIELD_TILEDIMENSIONS) ?\n\t\t\ttd->td_samplesperpixel : TIFFNumberOfTiles(tif);\n\telse\n\t\ttd->td_stripsperimage =\n\t\t    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?\n\t\t\ttd->td_samplesperpixel : TIFFNumberOfStrips(tif);\n\ttd->td_nstrips = td->td_stripsperimage;\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\ttd->td_stripsperimage /= td->td_samplesperpixel;\n\ttd->td_stripoffset_p = (uint64 *)\n            _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),\n                             "for \\"StripOffsets\\" array");\n\ttd->td_stripbytecount_p = (uint64 *)\n            _TIFFCheckMalloc(tif, td->td_nstrips, sizeof (uint64),\n                             "for \\"StripByteCounts\\" array");\n\tif (td->td_stripoffset_p == NULL || td->td_stripbytecount_p == NULL)\n\t\treturn (0);\n\t_TIFFmemset(td->td_stripoffset_p, 0, td->td_nstrips*sizeof (uint64));\n\t_TIFFmemset(td->td_stripbytecount_p, 0, td->td_nstrips*sizeof (uint64));\n\tTIFFSetFieldBit(tif, FIELD_STRIPOFFSETS);\n\tTIFFSetFieldBit(tif, FIELD_STRIPBYTECOUNTS);\n\treturn (1);\n}', 'uint32\nTIFFNumberOfStrips(TIFF* tif)\n{\n\tTIFFDirectory *td = &tif->tif_dir;\n\tuint32 nstrips;\n\tnstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :\n\t     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));\n\tif (td->td_planarconfig == PLANARCONFIG_SEPARATE)\n\t\tnstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,\n\t\t    "TIFFNumberOfStrips");\n\treturn (nstrips);\n}']