tools/tiffmedian.c:775: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

tools/tiffmedian.c:766:43: <Length trace>
764. 	register int red, green, blue;
765. 
766. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                               ^
767. 	outline = (unsigned char *)_TIFFmalloc(imagewidth);
768. 	for (i = 0; i < imagelength; i++) {

tools/tiffmedian.c:766:43: Call
764. 	register int red, green, blue;
765. 
766. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                               ^
767. 	outline = (unsigned char *)_TIFFmalloc(imagewidth);
768. 	for (i = 0; i < imagelength; i++) {

libtiff/tif_strip.c:318:4: Call
  316. 	static const char module[] = "TIFFScanlineSize";
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
          ^
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  320. }

libtiff/tif_strip.c:287:29: Assignment
    285.                             TIFFErrorExt(tif->tif_clientdata,module,
    286.                                          "Invalid YCbCr subsampling");
    287.                             return 0;
                                     ^
    288. 			}
    289. 			samplingblock_samples = ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;

libtiff/tif_strip.c:318:2: Assignment
  316. 	static const char module[] = "TIFFScanlineSize";
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
        ^
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  320. }

libtiff/tif_strip.c:319:9: Call
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  320. }
  321. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:319:2: Assignment
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  320. }
  321. 

tools/tiffmedian.c:766:31: Call
764. 	register int red, green, blue;
765. 
766. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                   ^
767. 	outline = (unsigned char *)_TIFFmalloc(imagewidth);
768. 	for (i = 0; i < imagelength; i++) {

libtiff/tif_unix.c:312:17: Assignment
  310. {
  311.         if (s == 0)
  312.                 return ((void *) NULL);
                       ^
  313. 
  314. 	return (malloc((size_t) s));

tools/tiffmedian.c:766:2: Assignment
764. 	register int red, green, blue;
765. 
766. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
      ^
767. 	outline = (unsigned char *)_TIFFmalloc(imagewidth);
768. 	for (i = 0; i < imagelength; i++) {

tools/tiffmedian.c:771:3: Assignment
769. 		if (TIFFReadScanline(in, inputline, i, 0) <= 0)
770. 			break;
771. 		inptr = inputline;
       ^
772. 		outptr = outline;
773. 		for (j = 0; j < imagewidth; j++) {

tools/tiffmedian.c:774:11: Assignment
772. 		outptr = outline;
773. 		for (j = 0; j < imagewidth; j++) {
774. 			red = *inptr++ >> COLOR_SHIFT;
               ^
775. 			green = *inptr++ >> COLOR_SHIFT;
776. 			blue = *inptr++ >> COLOR_SHIFT;

tools/tiffmedian.c:775:12: Array access: Offset: [1, +oo] Size: [0, +oo]
773. 		for (j = 0; j < imagewidth; j++) {
774. 			red = *inptr++ >> COLOR_SHIFT;
775. 			green = *inptr++ >> COLOR_SHIFT;
                ^
776. 			blue = *inptr++ >> COLOR_SHIFT;
777. 			*outptr++ = (unsigned char)histogram[red][green][blue];
