contrib/addtiffo/tif_overview.c:582: error: Integer Overflow L2
  ([0, max(0, `hTIFF->tif_dir.td_tilelength`)] - 1):unsigned32 by call to `TIFFReadEncodedTile`.

contrib/addtiffo/tif_overview.c:557:1: Parameter `hTIFF->tif_dir.td_tilelength`
555. /************************************************************************/
556. 
557. void TIFF_ProcessFullResBlock( TIFF *hTIFF, int nPlanarConfig,
     ^
558.                                int bSubsampled,
559.                                int nHorSubsampling, int nVerSubsampling,

contrib/addtiffo/tif_overview.c:586:38: Call
584.                                                      0, (tsample_t)iSample ),
585.                                      pabySrcTile,
586.                                      TIFFTileSize(hTIFF));
                                          ^
587.             }
588.             else

libtiff/tif_tile.c:272:1: Parameter `tif->tif_dir.td_tilelength`
  270. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  271. }
  272. tmsize_t
       ^
  273. TIFFTileSize(TIFF* tif)
  274. {

libtiff/tif_tile.c:278:4: Call
  276. 	uint64 m;
  277. 	tmsize_t n;
  278. 	m=TIFFTileSize64(tif);
          ^
  279. 	n=(tmsize_t)m;
  280. 	if ((uint64)n!=m)

libtiff/tif_tile.c:267:1: Parameter `tif->tif_dir.td_tilelength`
    265.  * Compute the # bytes in a row-aligned tile.
    266.  */
    267. uint64
         ^
    268. TIFFTileSize64(TIFF* tif)
    269. {

libtiff/tif_tile.c:270:10: Call
    268. TIFFTileSize64(TIFF* tif)
    269. {
    270. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    271. }
    272. tmsize_t

libtiff/tif_tile.c:200:1: Parameter `tif->tif_dir.td_tilelength`
      198.  * Compute the # bytes in a variable length, row-aligned tile.
      199.  */
      200. uint64
           ^
      201. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      202. {

contrib/addtiffo/tif_overview.c:582:17: Call
580.             if( TIFFIsTiled(hTIFF) )
581.             {
582.                 TIFFReadEncodedTile( hTIFF,
                     ^
583.                                      TIFFComputeTile(hTIFF, nSXOff, nSYOff,
584.                                                      0, (tsample_t)iSample ),

libtiff/tif_read.c:649:1: Parameter `tif->tif_dir.td_tilelength`
  647.  * amount into the user-supplied buffer.
  648.  */
  649. tmsize_t
       ^
  650. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  651. {

libtiff/tif_read.c:668:6: Call
  666. 	else if (size > tilesize)
  667. 		size = tilesize;
  668. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
            ^
  669. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
  670. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:792:1: Parameter `tif->tif_dir.td_tilelength`
    790.  * expanded, as necessary, to hold the tile's data.
    791.  */
    792. int
         ^
    793. TIFFFillTile(TIFF* tif, uint32 tile)
    794. {

libtiff/tif_read.c:901:10: Call
    899. 		}
    900. 	}
    901. 	return (TIFFStartTile(tif, tile));
                  ^
    902. }
    903. 

libtiff/tif_read.c:990:1: <LHS trace>
988.  * tile has just been read in.
989.  */
990. static int
     ^
991. TIFFStartTile(TIFF* tif, uint32 tile)
992. {

libtiff/tif_read.c:990:1: Parameter `tif->tif_dir.td_imagelength`
      988.  * tile has just been read in.
      989.  */
      990. static int
           ^
      991. TIFFStartTile(TIFF* tif, uint32 tile)
      992. {

libtiff/tif_read.c:1012:19: Binary operation: ([0, max(0, hTIFF->tif_dir.td_tilelength)] - 1):unsigned32 by call to `TIFFReadEncodedTile` 
      1010.         }
      1011. 	tif->tif_row = (tile % howmany32) * td->td_tilelength;
      1012.         howmany32=TIFFhowmany_32(td->td_imagelength, td->td_tilelength);
                              ^
      1013.         if (howmany32 == 0) {
      1014.                 TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
