tools/tiffcrop.c:6982: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage`.

tools/tiffcrop.c:6891:1: Parameter `(*out)->tif_dir.td_rowsperstrip`
6889.   } /* end extractImageSection */
6890. 
6891. static int 
      ^
6892. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6893.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6977:16: Call
6975.          for (i = 0; i < crop->selections; i++)
6976.            {
6977.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6978.              return (1);
6979. 

tools/tiffcrop.c:2106:1: Parameter `(*tiffout)->tif_dir.td_rowsperstrip`
  2104.  * so TIFFTAG PAGENUM will be correct in image.
  2105.  */
  2106. static int
        ^
  2107. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2108.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6982:16: Call
6980.            crop_buff = seg_buffs[i].buffer;
6981.            /* Write the current region to the current file */
6982.            if (writeCroppedImage(in, *out, image, dump,
                     ^
6983.                                  crop->regionlist[i].width, 
6984.                                  crop->regionlist[i].length, 

tools/tiffcrop.c:7734:1: Parameter `out->tif_dir.td_rowsperstrip`
  7732.  * then passed in as an argument.
  7733.  */
  7734. static int  
        ^
  7735. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7736.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7978:11: Call
  7976.     if (config == PLANARCONFIG_CONTIG)
  7977.       {
  7978.       if (writeBufferToContigTiles (out, crop_buff, length, width, spp, dump))
                  ^
  7979.         TIFFError("","Unable to write contiguous tile data for page %d", pagenum);
  7980.       }

tools/tiffcrop.c:1227:1: Parameter `out->tif_dir.td_rowsperstrip`
    1225.  * to be written out as a tile.
    1226.  */
    1227. static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
          ^
    1228. 				       uint32 imagewidth, tsample_t spp, 
    1229.                                        struct dump_opts* dump)

tools/tiffcrop.c:1304:11: Call
    1302.         }
    1303. 
    1304.       if (TIFFWriteTile(out, tilebuf, col, row, 0, 0) < 0)
                    ^
    1305.         {
    1306. 	TIFFError("writeBufferToContigTiles",

libtiff/tif_write.c:363:1: Parameter `tif->tif_dir.td_rowsperstrip`
      361.  * tile is selected by the (x,y,z,s) coordinates.
      362.  */
      363. tmsize_t
           ^
      364. TIFFWriteTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
      365. {

libtiff/tif_write.c:374:10: Call
      372. 	 *     after the output buffer is setup in TIFFWriteBufferSetup.
      373. 	 */
      374. 	return (TIFFWriteEncodedTile(tif,
                    ^
      375. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
      376. }

libtiff/tif_write.c:390:1: Parameter `tif->tif_dir.td_rowsperstrip`
        388.  *     the image on each write (as TIFFWriteScanline does).
        389.  */
        390. tmsize_t
             ^
        391. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
        392. {

libtiff/tif_write.c:398:7: Call
        396.         uint32 howmany32;
        397. 
        398. 	if (!WRITECHECKTILES(tif, module))
                   ^
        399. 		return ((tmsize_t)(-1));
        400. 	td = &tif->tif_dir;

libtiff/tif_write.c:564:1: Parameter `tif->tif_dir.td_rowsperstrip`
          562.  * that important information is not changed.
          563.  */
          564. int
               ^
          565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
          566. {

libtiff/tif_write.c:640:13: Call
          638.             !(tif->tif_flags & TIFF_DIRTYDIRECT)  )
          639.         {
          640.             TIFFForceStrileArrayWriting(tif);
                           ^
          641.         }
          642. 

libtiff/tif_flush.c:78:1: Parameter `tif->tif_dir.td_rowsperstrip`
            76.  * Returns 1 in case of success, 0 otherwise.
            77.  */
            78. int TIFFForceStrileArrayWriting(TIFF* tif)
                ^
            79. {
            80.     static const char module[] = "TIFFForceStrileArrayWriting";

libtiff/tif_flush.c:120:55: Call
            118.         }
            119. 
            120.         if (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif))
                                                                       ^
            121.             return 0;
            122.     }

libtiff/tif_write.c:522:1: Parameter `tif->tif_dir.td_rowsperstrip`
              520.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
              521. 
              522. int
                   ^
              523. TIFFSetupStrips(TIFF* tif)
              524. {

libtiff/tif_write.c:534:29: Call
              532. 		td->td_stripsperimage =
              533. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
              534. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                               ^
              535. 	td->td_nstrips = td->td_stripsperimage;
              536. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:58:1: <LHS trace>
56.  * Compute how many strips are in an image.
57.  */
58. uint32
    ^
59. TIFFNumberOfStrips(TIFF* tif)
60. {

libtiff/tif_strip.c:58:1: Parameter `tif->tif_dir.td_imagelength`
                56.  * Compute how many strips are in an image.
                57.  */
                58. uint32
                    ^
                59. TIFFNumberOfStrips(TIFF* tif)
                60. {

libtiff/tif_strip.c:65:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage` 
                63. 
                64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
                65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                          ^
                66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
                67. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
