contrib/addtiffo/tif_ovrcache.c:194: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFWriteEncodedTile`.

contrib/addtiffo/tif_ovrcache.c:170:12: Call
168. /* -------------------------------------------------------------------- */
169.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
170.     nRet = TIFFSetSubDirectory( psCache->hTIFF, psCache->nDirOffset );
                ^
171.     assert( nRet == 1 );
172. 

libtiff/tif_dir.c:1578:10: Call
  1576. 	 */
  1577. 	tif->tif_dirnumber = 0;
  1578. 	return (TIFFReadDirectory(tif));
                 ^
  1579. }
  1580. 

libtiff/tif_dirread.c:3402:1: Parameter `tif->tif_dir.td_rowsperstrip`
    3400.  * format. We read directories sequentially.
    3401.  */
    3402. int
          ^
    3403. TIFFReadDirectory(TIFF* tif)
    3404. {

contrib/addtiffo/tif_ovrcache.c:194:6: Call
192. 					    iTileY * psCache->nBlockYSize,
193. 					    0, (tsample_t) iSample );
194. 					TIFFWriteEncodedTile( psCache->hTIFF, nTileID,
          ^
195. 					    pabyData,
196. 					    TIFFTileSize(psCache->hTIFF) );

libtiff/tif_write.c:363:1: Parameter `tif->tif_dir.td_rowsperstrip`
  361.  *     the image on each write (as TIFFWriteScanline does).
  362.  */
  363. tmsize_t
       ^
  364. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
  365. {

libtiff/tif_write.c:371:7: Call
  369.         uint32 howmany32;
  370. 
  371. 	if (!WRITECHECKTILES(tif, module))
             ^
  372. 		return ((tmsize_t)(-1));
  373. 	td = &tif->tif_dir;

libtiff/tif_write.c:532:1: Parameter `tif->tif_dir.td_rowsperstrip`
    530.  * that important information is not changed.
    531.  */
    532. int
         ^
    533. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    534. {

libtiff/tif_write.c:579:46: Call
    577. 		}
    578. 	}
    579. 	if (tif->tif_dir.td_stripoffset == NULL && !TIFFSetupStrips(tif)) {
                                                      ^
    580. 		tif->tif_dir.td_nstrips = 0;
    581. 		TIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",

libtiff/tif_write.c:492:1: Parameter `tif->tif_dir.td_rowsperstrip`
      490.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
      491. 
      492. int
           ^
      493. TIFFSetupStrips(TIFF* tif)
      494. {

libtiff/tif_write.c:504:29: Call
      502. 		td->td_stripsperimage =
      503. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
      504. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                       ^
      505. 	td->td_nstrips = td->td_stripsperimage;
      506. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:60:1: <LHS trace>
58.  * Compute how many strips are in an image.
59.  */
60. uint32
    ^
61. TIFFNumberOfStrips(TIFF* tif)
62. {

libtiff/tif_strip.c:60:1: Parameter `tif->tif_dir.td_imagelength`
        58.  * Compute how many strips are in an image.
        59.  */
        60. uint32
            ^
        61. TIFFNumberOfStrips(TIFF* tif)
        62. {

libtiff/tif_strip.c:67:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFWriteEncodedTile` 
        65. 
        66. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
        67. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                  ^
        68. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
        69. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
