tools/tiff2pdf.c:5677: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `t2p_readwrite_pdf_image_tile`.

tools/tiff2pdf.c:5676:5: Call
5674. 				written += t2p_write_pdf_stream_start(output);
5675. 				streamlen=written;
5676. 				t2p_read_tiff_size_tile(t2p, input, i2);
          ^
5677. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
5678. 				t2p_write_advance_directory(t2p, output);

tools/tiff2pdf.c:2137:4: Assignment
  2135. 		} else {
  2136. 			TIFFGetField(input, TIFFTAG_TILEBYTECOUNTS, &tbc);
  2137. 			k=tbc[tile];
           ^
  2138. #ifdef OJPEG_SUPPORT
  2139. 			if(t2p->tiff_compression==COMPRESSION_OJPEG){

tools/tiff2pdf.c:2154:4: Assignment
  2152. 			}
  2153. #endif
  2154. 			t2p->tiff_datasize = (tsize_t) k;
           ^
  2155. 			if ((uint64) t2p->tiff_datasize != k) {
  2156. 				TIFFError(TIFF2PDF_MODULE, "Integer overflow");

tools/tiff2pdf.c:5677:16: Call
5675. 				streamlen=written;
5676. 				t2p_read_tiff_size_tile(t2p, input, i2);
5677. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
                     ^
5678. 				t2p_write_advance_directory(t2p, output);
5679. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2862:1: Parameter `t2p->tiff_datasize`
  2860.  */
  2861. 
  2862. tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){
        ^
  2863. 
  2864. 	uint16 edge=0;

tools/tiff2pdf.c:2897:29: Call
  2895. #ifdef CCITT_SUPPORT
  2896. 		if(t2p->pdf_compression == T2P_COMPRESS_G4){
  2897. 			buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize);
                                    ^
  2898. 			if(buffer==NULL){
  2899. 				TIFFError(TIFF2PDF_MODULE, 

libtiff/tif_unix.c:312:17: Assignment
    310. {
    311.         if (s == 0)
    312.                 return ((void *) NULL);
                         ^
    313. 
    314. 	return (malloc((size_t) s));

tools/tiff2pdf.c:2897:4: Assignment
  2895. #ifdef CCITT_SUPPORT
  2896. 		if(t2p->pdf_compression == T2P_COMPRESS_G4){
  2897. 			buffer= (unsigned char*) _TIFFmalloc(t2p->tiff_datasize);
           ^
  2898. 			if(buffer==NULL){
  2899. 				TIFFError(TIFF2PDF_MODULE, 

tools/tiff2pdf.c:2916:6: Call
  2914. 			}
  2915. 			if (t2p->tiff_fillorder==FILLORDER_LSB2MSB){
  2916. 					TIFFReverseBits(buffer, t2p->tiff_datasize);
             ^
  2917. 			}
  2918. 			t2pWriteFile(output, (tdata_t) buffer, t2p->tiff_datasize);

libtiff/tif_swab.c:283:1: <Length trace>
281. }
282. 
283. void
     ^
284. TIFFReverseBits(uint8* cp, tmsize_t n)  
285. {

libtiff/tif_swab.c:283:1: Parameter `*cp`
    281. }
    282. 
    283. void
         ^
    284. TIFFReverseBits(uint8* cp, tmsize_t n)  
    285. {

libtiff/tif_swab.c:294:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `t2p_readwrite_pdf_image_tile` 
    292. 		cp[5] = TIFFBitRevTable[cp[5]];
    293. 		cp[6] = TIFFBitRevTable[cp[6]];
    294. 		cp[7] = TIFFBitRevTable[cp[7]];
           ^
    295. 		cp += 8;
    296. 	}
