libtiff/tif_jpeg.c:817: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `JPEGFixupTagsSubsamplingSkip`.

libtiff/tif_jpeg.c:812:6: Call
810. 					if (n!=8+data->tif->tif_dir.td_samplesperpixel*3)
811. 						return(0);
812. 					JPEGFixupTagsSubsamplingSkip(data,7);
          ^
813. 					if (!JPEGFixupTagsSubsamplingReadByte(data,&p))
814. 						return(0);

libtiff/tif_jpeg.c:912:4: Assignment
  910. 		if (m<=data->filebytesleft)
  911. 		{
  912. 			data->bufferbytesleft=0;
          ^
  913. 			data->fileoffset+=m;
  914. 			data->filebytesleft-=m;

libtiff/tif_jpeg.c:813:11: Call
811. 						return(0);
812. 					JPEGFixupTagsSubsamplingSkip(data,7);
813. 					if (!JPEGFixupTagsSubsamplingReadByte(data,&p))
               ^
814. 						return(0);
815. 					ph=(p>>4);

libtiff/tif_jpeg.c:855:1: Parameter `data->bufferbytesleft`
  853. }
  854. 
  855. static int
       ^
  856. JPEGFixupTagsSubsamplingReadByte(struct JPEGFixupTagsSubsamplingData* data, uint8* result)
  857. {

libtiff/tif_jpeg.c:817:6: Call
815. 					ph=(p>>4);
816. 					pv=(p&15);
817. 					JPEGFixupTagsSubsamplingSkip(data,1);
          ^
818. 					for (o=1; o<data->tif->tif_dir.td_samplesperpixel; o++)
819. 					{

libtiff/tif_jpeg.c:898:1: <LHS trace>
896. }
897. 
898. static void
     ^
899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
900. {

libtiff/tif_jpeg.c:898:1: Parameter `skiplength`
  896. }
  897. 
  898. static void
       ^
  899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
  900. {

libtiff/tif_jpeg.c:898:1: <RHS trace>
896. }
897. 
898. static void
     ^
899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
900. {

libtiff/tif_jpeg.c:898:1: Parameter `skiplength`
  896. }
  897. 
  898. static void
       ^
  899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
  900. {

libtiff/tif_jpeg.c:904:3: Binary operation: ([0, +oo] - 1):unsigned32 by call to `JPEGFixupTagsSubsamplingSkip` 
  902. 	{
  903. 		data->buffercurrentbyte+=skiplength;
  904. 		data->bufferbytesleft-=skiplength;
         ^
  905. 	}
  906. 	else
