libtiff/tif_getimage.c:840: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip`.

libtiff/tif_getimage.c:813:37: Call
811. 	int ret = 1, flip;
812. 
813. 	buf = (unsigned char*) _TIFFmalloc(TIFFStripSize(tif));
                                         ^
814. 	if (buf == 0) {
815. 		TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "No space for strip buffer");

libtiff/tif_strip.c:235:1: Parameter `tif->tif_dir.td_imagelength`
  233. 	return (TIFFVStripSize64(tif, rps));
  234. }
  235. tmsize_t
       ^
  236. TIFFStripSize(TIFF* tif)
  237. {

libtiff/tif_strip.c:241:4: Call
  239. 	uint64 m;
  240. 	tmsize_t n;
  241. 	m=TIFFStripSize64(tif);
          ^
  242. 	n=(tmsize_t)m;
  243. 	if ((uint64)n!=m)

libtiff/tif_strip.c:226:1: Parameter `tif->tif_dir.td_imagelength`
    224.  * to hold the strip.
    225.  */
    226. uint64
         ^
    227. TIFFStripSize64(TIFF* tif)
    228. {

libtiff/tif_getimage.c:818:22: Call
816. 		return (0);
817. 	}
818. 	_TIFFmemset(buf, 0, TIFFStripSize(tif));
                          ^
819. 
820. 	flip = setorientation(img);

libtiff/tif_strip.c:235:1: Parameter `tif->tif_dir.td_imagelength`
  233. 	return (TIFFVStripSize64(tif, rps));
  234. }
  235. tmsize_t
       ^
  236. TIFFStripSize(TIFF* tif)
  237. {

libtiff/tif_strip.c:241:4: Call
  239. 	uint64 m;
  240. 	tmsize_t n;
  241. 	m=TIFFStripSize64(tif);
          ^
  242. 	n=(tmsize_t)m;
  243. 	if ((uint64)n!=m)

libtiff/tif_strip.c:226:1: Parameter `tif->tif_dir.td_imagelength`
    224.  * to hold the strip.
    225.  */
    226. uint64
         ^
    227. TIFFStripSize64(TIFF* tif)
    228. {

libtiff/tif_getimage.c:840:7: Call
838. 		if ((nrowsub%subsamplingver)!=0)
839. 			nrowsub+=subsamplingver-nrowsub%subsamplingver;
840. 		if (TIFFReadEncodedStrip(tif,
           ^
841. 		    TIFFComputeStrip(tif,row+img->row_offset, 0),
842. 		    buf,

libtiff/tif_read.c:123:1: <LHS trace>
121.  * amount into the user-supplied buffer.
122.  */
123. tmsize_t
     ^
124. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
125. {

libtiff/tif_read.c:123:1: Parameter `tif->tif_dir.td_imagelength`
  121.  * amount into the user-supplied buffer.
  122.  */
  123. tmsize_t
       ^
  124. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  125. {

libtiff/tif_read.c:151:2: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip` 
  149. 	if (rowsperstrip>td->td_imagelength)
  150. 		rowsperstrip=td->td_imagelength;
  151. 	stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
        ^
  152. 	stripinplane=(strip%stripsperplane);
  153. 	plane=(strip/stripsperplane);
