tools/tiff2pdf.c:5338: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `t2p_readwrite_pdf_image_tile`.

tools/tiff2pdf.c:5337:5: Call
5335. 				written += t2p_write_pdf_stream_start(output);
5336. 				streamlen=written;
5337. 				t2p_read_tiff_size_tile(t2p, input, i2);
          ^
5338. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
5339. 				t2p_write_advance_directory(t2p, output);

tools/tiff2pdf.c:1961:4: Assignment
  1959. 		} else {
  1960. 			TIFFGetField(input, TIFFTAG_TILEBYTECOUNTS, &tbc);
  1961. 			k=tbc[tile];
           ^
  1962. #ifdef OJPEG_SUPPORT
  1963. 			if(t2p->tiff_compression==COMPRESSION_OJPEG){

tools/tiff2pdf.c:1978:4: Assignment
  1976. 			}
  1977. #endif
  1978. 			t2p->tiff_datasize = (tsize_t) k;
           ^
  1979. 			if ((uint64) t2p->tiff_datasize != k) {
  1980. 				TIFFError(TIFF2PDF_MODULE, "Integer overflow");

tools/tiff2pdf.c:5338:16: Call
5336. 				streamlen=written;
5337. 				t2p_read_tiff_size_tile(t2p, input, i2);
5338. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
                     ^
5339. 				t2p_write_advance_directory(t2p, output);
5340. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2649:1: Parameter `t2p->tiff_datasize`
  2647.  */
  2648. 
  2649. tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){
        ^
  2650. 
  2651. 	uint16 edge=0;

tools/tiff2pdf.c:2684:29: Call
  2682. #ifdef CCITT_SUPPORT
  2683. 		if(t2p->pdf_compression == T2P_COMPRESS_G4){
  2684. 			buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize);
                                    ^
  2685. 			if(buffer==NULL){
  2686. 				TIFFError(TIFF2PDF_MODULE, 

libtiff/tif_unix.c:257:1: Parameter `s`
    255. #endif
    256. 
    257. void*
         ^
    258. _TIFFmalloc(tmsize_t s)
    259. {

libtiff/tif_unix.c:260:10: Array declaration
    258. _TIFFmalloc(tmsize_t s)
    259. {
    260. 	return (malloc((size_t) s));
                  ^
    261. }
    262. 

libtiff/tif_unix.c:260:2: Assignment
    258. _TIFFmalloc(tmsize_t s)
    259. {
    260. 	return (malloc((size_t) s));
          ^
    261. }
    262. 

tools/tiff2pdf.c:2684:4: Assignment
  2682. #ifdef CCITT_SUPPORT
  2683. 		if(t2p->pdf_compression == T2P_COMPRESS_G4){
  2684. 			buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize);
           ^
  2685. 			if(buffer==NULL){
  2686. 				TIFFError(TIFF2PDF_MODULE, 

tools/tiff2pdf.c:2696:6: Call
  2694. 			TIFFReadRawTile(input, tile, (tdata_t) buffer, t2p->tiff_datasize);
  2695. 			if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){
  2696. 					TIFFReverseBits(buffer, t2p->tiff_datasize);
             ^
  2697. 			}
  2698. 			t2pWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize);

libtiff/tif_swab.c:285:1: <Length trace>
283. }
284. 
285. void
     ^
286. TIFFReverseBits(uint8* cp, tmsize_t n)  
287. {

libtiff/tif_swab.c:285:1: Parameter `*cp`
    283. }
    284. 
    285. void
         ^
    286. TIFFReverseBits(uint8* cp, tmsize_t n)  
    287. {

libtiff/tif_swab.c:296:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `t2p_readwrite_pdf_image_tile` 
    294. 		cp[5] = TIFFBitRevTable[cp[5]];
    295. 		cp[6] = TIFFBitRevTable[cp[6]];
    296. 		cp[7] = TIFFBitRevTable[cp[7]];
           ^
    297. 		cp += 8;
    298. 	}
