libtiff/tif_dirread.c:4250: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [0, +oo] by call to `EstimateStripByteCounts`.

libtiff/tif_dirread.c:4050:13: Call
4048.         {
4049.             /* Directory typically created with TIFFDeferStrileArrayWriting() */
4050.             TIFFSetupStrips(tif);
                  ^
4051.         }
4052.         else if( !(tif->tif_flags&TIFF_DEFERSTRILELOAD) )

libtiff/tif_write.c:537:46: Assignment
  535. 	td->td_nstrips = td->td_stripsperimage;
  536.         /* TIFFWriteDirectoryTagData has a limitation to 0x80000000U bytes */
  537.         if( td->td_nstrips >= 0x80000000U / ((tif->tif_flags&TIFF_BIGTIFF)?0x8U:0x4U) )
                                                    ^
  538.         {
  539.             TIFFErrorExt(tif->tif_clientdata, "TIFFSetupStrips",

libtiff/tif_dirread.c:4235:10: Call
4233. 			   && tif->tif_dir.td_nstrips > 2
4234. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4235. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
               ^
4236. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4237. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6363:1: Parameter `tif->tif_dir.td_nstrips`
  6361. 
  6362. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6365:12: Call
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6366. }
  6367. 

libtiff/tif_dirread.c:6369:1: Parameter `tif->tif_dir.td_nstrips`
    6367. 
    6368. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6369. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6372:12: Call
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;
    6372.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6373.                                &(td->td_stripbytecount_entry),
    6374.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6304:1: Parameter `strile`
      6302. }
      6303. 
      6304. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6305.                                                    TIFFDirEntry* dirent,
      6306.                                                    uint64** parray,

libtiff/tif_dirread.c:4235:44: Call
4233. 			   && tif->tif_dir.td_nstrips > 2
4234. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4235. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                 ^
4236. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4237. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6363:1: Parameter `tif->tif_dir.td_nstrips`
  6361. 
  6362. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6365:12: Call
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6366. }
  6367. 

libtiff/tif_dirread.c:6369:1: Parameter `tif->tif_dir.td_nstrips`
    6367. 
    6368. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6369. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6372:12: Call
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;
    6372.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6373.                                &(td->td_stripbytecount_entry),
    6374.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6304:1: Parameter `strile`
      6302. }
      6303. 
      6304. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6305.                                                    TIFFDirEntry* dirent,
      6306.                                                    uint64** parray,

libtiff/tif_dirread.c:4236:10: Call
4234. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4235. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4236. 			   && TIFFGetStrileByteCount(tif, 0) != 0
               ^
4237. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {
4238. 			/*

libtiff/tif_dirread.c:6363:1: Parameter `tif->tif_dir.td_nstrips`
  6361. 
  6362. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6365:12: Call
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6366. }
  6367. 

libtiff/tif_dirread.c:6369:1: Parameter `tif->tif_dir.td_nstrips`
    6367. 
    6368. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6369. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6372:12: Call
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;
    6372.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6373.                                &(td->td_stripbytecount_entry),
    6374.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6304:1: Parameter `strile`
      6302. }
      6303. 
      6304. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6305.                                                    TIFFDirEntry* dirent,
      6306.                                                    uint64** parray,

libtiff/tif_dirread.c:4237:10: Call
4235. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4236. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4237. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {
               ^
4238. 			/*
4239. 			 * XXX: Some vendors fill StripByteCount array with

libtiff/tif_dirread.c:6363:1: Parameter `tif->tif_dir.td_nstrips`
  6361. 
  6362. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6365:12: Call
  6363. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6364. {
  6365.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6366. }
  6367. 

libtiff/tif_dirread.c:6369:1: Parameter `tif->tif_dir.td_nstrips`
    6367. 
    6368. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6369. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6372:12: Call
    6370. {
    6371.     TIFFDirectory *td = &tif->tif_dir;
    6372.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6373.                                &(td->td_stripbytecount_entry),
    6374.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6304:1: Parameter `strile`
      6302. }
      6303. 
      6304. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6305.                                                    TIFFDirEntry* dirent,
      6306.                                                    uint64** parray,

libtiff/tif_dirread.c:4250:8: Call
4248. 			TIFFWarningExt(tif->tif_clientdata, module,
4249. 			    "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
4250. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
             ^
4251. 			    goto bad;
4252. 		}

libtiff/tif_dirread.c:4548:1: <Offset trace>
4546. }
4547. 
4548. static int
      ^
4549. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4550. {

libtiff/tif_dirread.c:4548:1: Parameter `tif->tif_dir.td_nstrips`
  4546. }
  4547. 
  4548. static int
        ^
  4549. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
  4550. {

libtiff/tif_dirread.c:4623:3: Assignment
  4621. 		 * of data in the strip and trim this number back accordingly.
  4622. 		 */
  4623. 		strip--;
          ^
  4624.                 if (td->td_stripoffset_p[strip] > TIFF_UINT64_MAX - td->td_stripbytecount_p[strip])
  4625.                     return -1;

libtiff/tif_dirread.c:4548:1: <Length trace>
4546. }
4547. 
4548. static int
      ^
4549. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4550. {

libtiff/tif_dirread.c:4548:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  4546. }
  4547. 
  4548. static int
        ^
  4549. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
  4550. {

libtiff/tif_dirread.c:4558:14: Call
  4556. 
  4557.     /* Do not try to load stripbytecount as we will compute it */
  4558.         if( !_TIFFFillStrilesInternal( tif, 0 ) )
                     ^
  4559.             return -1;
  4560. 

libtiff/tif_dirread.c:6383:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    6381. }
    6382. 
    6383. static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount )
          ^
    6384. {
    6385.     register TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:4624:21: Array access: Offset: [2, +oo] Size: [0, +oo] by call to `EstimateStripByteCounts` 
  4622. 		 */
  4623. 		strip--;
  4624.                 if (td->td_stripoffset_p[strip] > TIFF_UINT64_MAX - td->td_stripbytecount_p[strip])
                            ^
  4625.                     return -1;
  4626. 		if (td->td_stripoffset_p[strip]+td->td_stripbytecount_p[strip] > filesize) {
