libtiff/tif_jpeg.c:829: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `JPEGFixupTagsSubsamplingSkip`.

libtiff/tif_jpeg.c:820:7: Call
818. 					for (o=1; o<data->tif->tif_dir.td_samplesperpixel; o++)
819. 					{
820. 						JPEGFixupTagsSubsamplingSkip(data,1);
           ^
821. 						if (!JPEGFixupTagsSubsamplingReadByte(data,&p))
822. 							return(0);

libtiff/tif_jpeg.c:912:4: Assignment
  910. 		if (m<=data->filebytesleft)
  911. 		{
  912. 			data->bufferbytesleft=0;
          ^
  913. 			data->fileoffset+=m;
  914. 			data->filebytesleft-=m;

libtiff/tif_jpeg.c:821:12: Call
819. 					{
820. 						JPEGFixupTagsSubsamplingSkip(data,1);
821. 						if (!JPEGFixupTagsSubsamplingReadByte(data,&p))
                ^
822. 							return(0);
823. 						if (p!=0x11)

libtiff/tif_jpeg.c:855:1: Parameter `data->bufferbytesleft`
  853. }
  854. 
  855. static int
       ^
  856. JPEGFixupTagsSubsamplingReadByte(struct JPEGFixupTagsSubsamplingData* data, uint8* result)
  857. {

libtiff/tif_jpeg.c:829:7: Call
827. 							return(1);
828. 						}
829. 						JPEGFixupTagsSubsamplingSkip(data,1);
           ^
830. 					}
831. 					if (((ph!=1)&&(ph!=2)&&(ph!=4))||((pv!=1)&&(pv!=2)&&(pv!=4)))

libtiff/tif_jpeg.c:898:1: <LHS trace>
896. }
897. 
898. static void
     ^
899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
900. {

libtiff/tif_jpeg.c:898:1: Parameter `skiplength`
  896. }
  897. 
  898. static void
       ^
  899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
  900. {

libtiff/tif_jpeg.c:898:1: <RHS trace>
896. }
897. 
898. static void
     ^
899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
900. {

libtiff/tif_jpeg.c:898:1: Parameter `skiplength`
  896. }
  897. 
  898. static void
       ^
  899. JPEGFixupTagsSubsamplingSkip(struct JPEGFixupTagsSubsamplingData* data, uint16 skiplength)
  900. {

libtiff/tif_jpeg.c:904:3: Binary operation: ([0, +oo] - 1):unsigned32 by call to `JPEGFixupTagsSubsamplingSkip` 
  902. 	{
  903. 		data->buffercurrentbyte+=skiplength;
  904. 		data->bufferbytesleft-=skiplength;
         ^
  905. 	}
  906. 	else
