tools/tiffcrop.c:751: error: Integer Overflow L2
  ([0, `in->tif_dir.td_tilewidth`] - 1):unsigned32 by call to `TIFFReadTile`.

tools/tiffcrop.c:725:1: Parameter `in->tif_dir.td_tilewidth`
723. };
724. 
725. static int readContigTilesIntoBuffer (TIFF* in, uint8* buf, 
     ^
726.                                       uint32 imagelength, 
727.                                       uint32 imagewidth, 

tools/tiffcrop.c:731:32: Call
729. {
730. 	int status = 1;
731. 	tdata_t tilebuf = _TIFFmalloc(TIFFTileSize(in));
                                    ^
732. 	uint32 imagew = TIFFScanlineSize(in);
733. 	uint32 tilew  = TIFFTileRowSize(in);

libtiff/tif_tile.c:274:1: Parameter `tif->tif_dir.td_tilewidth`
  272. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  273. }
  274. tmsize_t
       ^
  275. TIFFTileSize(TIFF* tif)
  276. {

libtiff/tif_tile.c:280:4: Call
  278. 	uint64 m;
  279. 	tmsize_t n;
  280. 	m=TIFFTileSize64(tif);
          ^
  281. 	n=(tmsize_t)m;
  282. 	if ((uint64)n!=m)

libtiff/tif_tile.c:269:1: Parameter `tif->tif_dir.td_tilewidth`
    267.  * Compute the # bytes in a row-aligned tile.
    268.  */
    269. uint64
         ^
    270. TIFFTileSize64(TIFF* tif)
    271. {

libtiff/tif_tile.c:272:10: Call
    270. TIFFTileSize64(TIFF* tif)
    271. {
    272. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    273. }
    274. tmsize_t

libtiff/tif_tile.c:203:1: Parameter `tif->tif_dir.td_tilewidth`
      201.  * Compute the # bytes in a variable length, row-aligned tile.
      202.  */
      203. uint64
           ^
      204. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      205. {

tools/tiffcrop.c:733:18: Call
731. 	tdata_t tilebuf = _TIFFmalloc(TIFFTileSize(in));
732. 	uint32 imagew = TIFFScanlineSize(in);
733. 	uint32 tilew  = TIFFTileRowSize(in);
                      ^
734. 	int iskew = imagew - tilew;
735. 	uint8* bufp = (uint8*) buf;

libtiff/tif_tile.c:184:1: Parameter `tif->tif_dir.td_tilewidth`
  182. 	return (TIFFhowmany8_64(rowsize));
  183. }
  184. tmsize_t
       ^
  185. TIFFTileRowSize(TIFF* tif)
  186. {

libtiff/tif_tile.c:190:4: Call
  188. 	uint64 m;
  189. 	tmsize_t n;
  190. 	m=TIFFTileRowSize64(tif);
          ^
  191. 	n=(tmsize_t)m;
  192. 	if ((uint64)n!=m)

libtiff/tif_tile.c:169:1: Parameter `tif->tif_dir.td_tilewidth`
    167.  * Compute the # bytes in each row of a tile.
    168.  */
    169. uint64
         ^
    170. TIFFTileRowSize64(TIFF* tif)
    171. {

tools/tiffcrop.c:751:8: Call
749. 
750. 		for (col = 0; col < imagewidth; col += tw) {
751. 			if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
            ^
752. 			    && !ignore) {
753. 				TIFFError(TIFFFileName(in),

libtiff/tif_read.c:415:1: Parameter `tif->tif_dir.td_tilewidth`
  413.  * tile is selected by the (x,y,z,s) coordinates.
  414.  */
  415. tmsize_t
       ^
  416. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  417. {

libtiff/tif_read.c:420:10: Call
  418. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  419. 		return ((tmsize_t)(-1));
  420. 	return (TIFFReadEncodedTile(tif,
                ^
  421. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  422. }

libtiff/tif_read.c:428:1: Parameter `tif->tif_dir.td_tilewidth`
    426.  * amount into the user-supplied buffer.
    427.  */
    428. tmsize_t
         ^
    429. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
    430. {

libtiff/tif_read.c:447:6: Call
    445. 	else if (size > tilesize)
    446. 		size = tilesize;
    447. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
              ^
    448. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
    449. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:568:1: Parameter `tif->tif_dir.td_tilewidth`
      566.  * expanded, as necessary, to hold the tile's data.
      567.  */
      568. int
           ^
      569. TIFFFillTile(TIFF* tif, uint32 tile)
      570. {

libtiff/tif_read.c:657:10: Call
      655. 		}
      656. 	}
      657. 	return (TIFFStartTile(tif, tile));
                    ^
      658. }
      659. 

libtiff/tif_read.c:737:1: <LHS trace>
735.  * tile has just been read in.
736.  */
737. static int
     ^
738. TIFFStartTile(TIFF* tif, uint32 tile)
739. {

libtiff/tif_read.c:737:1: Parameter `tif->tif_dir.td_tilewidth`
        735.  * tile has just been read in.
        736.  */
        737. static int
             ^
        738. TIFFStartTile(TIFF* tif, uint32 tile)
        739. {

libtiff/tif_read.c:748:2: Binary operation: ([0, in->tif_dir.td_tilewidth] - 1):unsigned32 by call to `TIFFReadTile` 
        746. 	}
        747. 	tif->tif_curtile = tile;
        748. 	tif->tif_row =
              ^
        749. 	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
        750. 		td->td_tilelength;
