contrib/addtiffo/tif_overview.c:565: error: Integer Overflow L2
  ([0, max(0, `hTIFF->tif_dir.td_tilelength`)] - 1):unsigned32 by call to `TIFFReadEncodedTile`.

contrib/addtiffo/tif_overview.c:540:1: Parameter `hTIFF->tif_dir.td_tilelength`
538. /************************************************************************/
539. 
540. void TIFF_ProcessFullResBlock( TIFF *hTIFF, int nPlanarConfig,
     ^
541.                                int bSubsampled,
542.                                int nHorSubsampling, int nVerSubsampling,

contrib/addtiffo/tif_overview.c:569:38: Call
567.                                                      0, (tsample_t)iSample ),
568.                                      pabySrcTile,
569.                                      TIFFTileSize(hTIFF));
                                          ^
570.             }
571.             else

libtiff/tif_tile.c:274:1: Parameter `tif->tif_dir.td_tilelength`
  272. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  273. }
  274. tmsize_t
       ^
  275. TIFFTileSize(TIFF* tif)
  276. {

libtiff/tif_tile.c:280:4: Call
  278. 	uint64 m;
  279. 	tmsize_t n;
  280. 	m=TIFFTileSize64(tif);
          ^
  281. 	n=(tmsize_t)m;
  282. 	if ((uint64)n!=m)

libtiff/tif_tile.c:269:1: Parameter `tif->tif_dir.td_tilelength`
    267.  * Compute the # bytes in a row-aligned tile.
    268.  */
    269. uint64
         ^
    270. TIFFTileSize64(TIFF* tif)
    271. {

libtiff/tif_tile.c:272:10: Call
    270. TIFFTileSize64(TIFF* tif)
    271. {
    272. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    273. }
    274. tmsize_t

libtiff/tif_tile.c:203:1: Parameter `tif->tif_dir.td_tilelength`
      201.  * Compute the # bytes in a variable length, row-aligned tile.
      202.  */
      203. uint64
           ^
      204. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      205. {

contrib/addtiffo/tif_overview.c:565:17: Call
563.             if( TIFFIsTiled(hTIFF) )
564.             {
565.                 TIFFReadEncodedTile( hTIFF,
                     ^
566.                                      TIFFComputeTile(hTIFF, nSXOff, nSYOff,
567.                                                      0, (tsample_t)iSample ),

libtiff/tif_read.c:428:1: Parameter `tif->tif_dir.td_tilelength`
  426.  * amount into the user-supplied buffer.
  427.  */
  428. tmsize_t
       ^
  429. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
  430. {

libtiff/tif_read.c:447:6: Call
  445. 	else if (size > tilesize)
  446. 		size = tilesize;
  447. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
            ^
  448. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
  449. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:568:1: Parameter `tif->tif_dir.td_tilelength`
    566.  * expanded, as necessary, to hold the tile's data.
    567.  */
    568. int
         ^
    569. TIFFFillTile(TIFF* tif, uint32 tile)
    570. {

libtiff/tif_read.c:657:10: Call
    655. 		}
    656. 	}
    657. 	return (TIFFStartTile(tif, tile));
                  ^
    658. }
    659. 

libtiff/tif_read.c:737:1: <LHS trace>
735.  * tile has just been read in.
736.  */
737. static int
     ^
738. TIFFStartTile(TIFF* tif, uint32 tile)
739. {

libtiff/tif_read.c:737:1: Parameter `tif->tif_dir.td_tilelength`
      735.  * tile has just been read in.
      736.  */
      737. static int
           ^
      738. TIFFStartTile(TIFF* tif, uint32 tile)
      739. {

libtiff/tif_read.c:751:2: Binary operation: ([0, max(0, hTIFF->tif_dir.td_tilelength)] - 1):unsigned32 by call to `TIFFReadEncodedTile` 
      749. 	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
      750. 		td->td_tilelength;
      751. 	tif->tif_col =
            ^
      752. 	    (tile % TIFFhowmany_32(td->td_imagelength, td->td_tilelength)) *
      753. 		td->td_tilewidth;
