libtiff/tif_getimage.c:927: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip`.

libtiff/tif_getimage.c:898:14: Call
896. 	int ret = 1, flip;
897. 
898. 	stripsize = TIFFStripSize(tif);  
                  ^
899. 	p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
900. 	if (buf == 0) {

libtiff/tif_strip.c:235:1: Parameter `tif->tif_dir.td_imagelength`
  233. 	return (TIFFVStripSize64(tif, rps));
  234. }
  235. tmsize_t
       ^
  236. TIFFStripSize(TIFF* tif)
  237. {

libtiff/tif_strip.c:241:4: Call
  239. 	uint64 m;
  240. 	tmsize_t n;
  241. 	m=TIFFStripSize64(tif);
          ^
  242. 	n=(tmsize_t)m;
  243. 	if ((uint64)n!=m)

libtiff/tif_strip.c:226:1: Parameter `tif->tif_dir.td_imagelength`
    224.  * to hold the strip.
    225.  */
    226. uint64
         ^
    227. TIFFStripSize64(TIFF* tif)
    228. {

libtiff/tif_getimage.c:927:7: Call
925. 		nrow = (row + rowstoread > h ? h - row : rowstoread);
926. 		offset_row = row + img->row_offset;
927. 		if (TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 0),
           ^
928. 		    p0, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)!=(tmsize_t)(-1)
929. 		    && img->stoponerr)

libtiff/tif_read.c:123:1: <LHS trace>
121.  * amount into the user-supplied buffer.
122.  */
123. tmsize_t
     ^
124. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
125. {

libtiff/tif_read.c:123:1: Parameter `tif->tif_dir.td_imagelength`
  121.  * amount into the user-supplied buffer.
  122.  */
  123. tmsize_t
       ^
  124. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  125. {

libtiff/tif_read.c:151:2: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip` 
  149. 	if (rowsperstrip>td->td_imagelength)
  150. 		rowsperstrip=td->td_imagelength;
  151. 	stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
        ^
  152. 	stripinplane=(strip%stripsperplane);
  153. 	plane=(strip/stripsperplane);
