tools/tiffcrop.c:6578: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage`.

tools/tiffcrop.c:6542:1: Parameter `(*out)->tif_dir.td_rowsperstrip`
6540.   } /* end extractImageSection */
6541. 
6542. static int 
      ^
6543. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6544.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6572:14: Call
6570.     case ONE_FILE_SEPARATED: /* Regions as separated images */
6571.          autoindex = 0;
6572.          if (update_output_file (out, mp, autoindex, filename, page))
                   ^
6573.            return (1);
6574.          page_count = crop->selections * total_pages;

tools/tiffcrop.c:2027:1: Parameter `(*tiffout)->tif_dir.td_rowsperstrip`
  2025.  * so TIFFTAG PAGENUM will be correct in image.
  2026.  */
  2027. static int 
        ^
  2028. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2029.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6578:16: Call
6576.            {
6577.            crop_buff = seg_buffs[i].buffer;
6578.            if (writeCroppedImage(in, *out, image, dump,
                     ^
6579.                                  crop->regionlist[i].width, 
6580.                                  crop->regionlist[i].length, 

tools/tiffcrop.c:7381:1: Parameter `out->tif_dir.td_rowsperstrip`
  7379.  * then passed in as an argument.
  7380.  */
  7381. static int  
        ^
  7382. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7383.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7641:11: Call
  7639.     if (config == PLANARCONFIG_CONTIG)
  7640.       {
  7641.       if (writeBufferToContigStrips (out, crop_buff, length))
                  ^
  7642.         TIFFError("","Unable to write contiguous strip data for page %d", pagenum);
  7643.       }

tools/tiffcrop.c:1086:1: Parameter `out->tif_dir.td_rowsperstrip`
    1084.   }
    1085. 
    1086. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
          ^
    1087.   {
    1088.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1098:9: Call
    1096. 	     imagelength - row : rowsperstrip;
    1097.     stripsize = TIFFVStripSize(out, nrows);
    1098.     if (TIFFWriteEncodedStrip(out, strip++, buf, stripsize) < 0)
                  ^
    1099.       {
    1100.       TIFFError(TIFFFileName(out), "Error, can't write strip %u", strip - 1);

libtiff/tif_write.c:183:1: Parameter `tif->tif_dir.td_rowsperstrip`
      181.  * NB: Image length must be setup before writing.
      182.  */
      183. tmsize_t
           ^
      184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
      185. {

libtiff/tif_write.c:190:7: Call
      188. 	uint16 sample;
      189. 
      190. 	if (!WRITECHECKSTRIPS(tif, module))
                 ^
      191. 		return ((tmsize_t) -1);
      192. 	/*

libtiff/tif_write.c:488:1: Parameter `tif->tif_dir.td_rowsperstrip`
        486.  * that important information is not changed.
        487.  */
        488. int
             ^
        489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
        490. {

libtiff/tif_write.c:533:46: Call
        531. 		}
        532. 	}
        533. 	if (tif->tif_dir.td_stripoffset == NULL && !TIFFSetupStrips(tif)) {
                                                          ^
        534. 		tif->tif_dir.td_nstrips = 0;
        535. 		TIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",

libtiff/tif_write.c:448:1: Parameter `tif->tif_dir.td_rowsperstrip`
          446.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
          447. 
          448. int
               ^
          449. TIFFSetupStrips(TIFF* tif)
          450. {

libtiff/tif_write.c:460:29: Call
          458. 		td->td_stripsperimage =
          459. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
          460. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                           ^
          461. 	td->td_nstrips = td->td_stripsperimage;
          462. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:86:1: <LHS trace>
84.  * Compute how many strips are in an image.
85.  */
86. uint32
    ^
87. TIFFNumberOfStrips(TIFF* tif)
88. {

libtiff/tif_strip.c:86:1: Parameter `tif->tif_dir.td_imagelength`
            84.  * Compute how many strips are in an image.
            85.  */
            86. uint32
                ^
            87. TIFFNumberOfStrips(TIFF* tif)
            88. {

libtiff/tif_strip.c:93:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage` 
            91. 
            92. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
            93. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                      ^
            94. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
            95. 		nstrips = multiply_32(tif, nstrips, (uint32)td->td_samplesperpixel,
