tools/tiffmedian.c:375: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

tools/tiffmedian.c:356:43: <Length trace>
354. 	unsigned char *inputline;
355. 
356. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                               ^
357. 	if (inputline == NULL) {
358. 		fprintf(stderr, "No space for scanline buffer\n");

tools/tiffmedian.c:356:43: Call
354. 	unsigned char *inputline;
355. 
356. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                               ^
357. 	if (inputline == NULL) {
358. 		fprintf(stderr, "No space for scanline buffer\n");

libtiff/tif_strip.c:318:4: Call
  316. 	static const char module[] = "TIFFScanlineSize";
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
          ^
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  320. }

libtiff/tif_strip.c:287:29: Assignment
    285.                             TIFFErrorExt(tif->tif_clientdata,module,
    286.                                          "Invalid YCbCr subsampling");
    287.                             return 0;
                                     ^
    288. 			}
    289. 			samplingblock_samples = ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;

libtiff/tif_strip.c:318:2: Assignment
  316. 	static const char module[] = "TIFFScanlineSize";
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
        ^
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  320. }

libtiff/tif_strip.c:319:9: Call
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  320. }
  321. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:319:2: Assignment
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  320. }
  321. 

tools/tiffmedian.c:356:31: Call
354. 	unsigned char *inputline;
355. 
356. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                   ^
357. 	if (inputline == NULL) {
358. 		fprintf(stderr, "No space for scanline buffer\n");

libtiff/tif_unix.c:312:17: Assignment
  310. {
  311.         if (s == 0)
  312.                 return ((void *) NULL);
                       ^
  313. 
  314. 	return (malloc((size_t) s));

tools/tiffmedian.c:356:2: Assignment
354. 	unsigned char *inputline;
355. 
356. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
      ^
357. 	if (inputline == NULL) {
358. 		fprintf(stderr, "No space for scanline buffer\n");

tools/tiffmedian.c:372:3: Assignment
370. 		if (TIFFReadScanline(in, inputline, i, 0) <= 0)
371. 			break;
372. 		inptr = inputline;
       ^
373. 		for (j = imagewidth; j-- > 0;) {
374. 			red = (*inptr++) & 0xff >> COLOR_SHIFT;

tools/tiffmedian.c:374:12: Assignment
372. 		inptr = inputline;
373. 		for (j = imagewidth; j-- > 0;) {
374. 			red = (*inptr++) & 0xff >> COLOR_SHIFT;
                ^
375. 			green = (*inptr++) & 0xff >> COLOR_SHIFT;
376. 			blue = (*inptr++) & 0xff >> COLOR_SHIFT;

tools/tiffmedian.c:375:12: Array access: Offset: [1, +oo] Size: [0, +oo]
373. 		for (j = imagewidth; j-- > 0;) {
374. 			red = (*inptr++) & 0xff >> COLOR_SHIFT;
375. 			green = (*inptr++) & 0xff >> COLOR_SHIFT;
                ^
376. 			blue = (*inptr++) & 0xff >> COLOR_SHIFT;
377.                         if ((red | green | blue) >= B_LEN) {
