tools/tiffmedian.c:829: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

tools/tiffmedian.c:824:43: <Length trace>
822. 	imax = imagelength - 1;
823. 	jmax = imagewidth - 1;
824. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                               ^
825. 	thisline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));
826. 	nextline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));

tools/tiffmedian.c:824:43: Call
822. 	imax = imagelength - 1;
823. 	jmax = imagewidth - 1;
824. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                               ^
825. 	thisline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));
826. 	nextline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));

libtiff/tif_strip.c:318:4: Call
  316. 	static const char module[] = "TIFFScanlineSize";
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
          ^
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  320. }

libtiff/tif_strip.c:287:29: Assignment
    285.                             TIFFErrorExt(tif->tif_clientdata,module,
    286.                                          "Invalid YCbCr subsampling");
    287.                             return 0;
                                     ^
    288. 			}
    289. 			samplingblock_samples = ycbcrsubsampling[0]*ycbcrsubsampling[1]+2;

libtiff/tif_strip.c:318:2: Assignment
  316. 	static const char module[] = "TIFFScanlineSize";
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
        ^
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  320. }

libtiff/tif_strip.c:319:9: Call
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  320. }
  321. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:319:2: Assignment
  317. 	uint64 m;
  318. 	m=TIFFScanlineSize64(tif);
  319. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  320. }
  321. 

tools/tiffmedian.c:824:31: Call
822. 	imax = imagelength - 1;
823. 	jmax = imagewidth - 1;
824. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
                                   ^
825. 	thisline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));
826. 	nextline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));

libtiff/tif_unix.c:312:17: Assignment
  310. {
  311.         if (s == 0)
  312.                 return ((void *) NULL);
                       ^
  313. 
  314. 	return (malloc((size_t) s));

tools/tiffmedian.c:824:2: Assignment
822. 	imax = imagelength - 1;
823. 	jmax = imagewidth - 1;
824. 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
      ^
825. 	thisline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));
826. 	nextline = (short *)_TIFFmalloc(imagewidth * 3 * sizeof (short));

tools/tiffmedian.c:829:2: Assignment
827. 	outline = (unsigned char *) _TIFFmalloc(TIFFScanlineSize(out));
828. 
829. 	GetInputLine(in, 0, goto bad);		/* get first line */
      ^
830. 	for (i = 1; i <= imagelength; ++i) {
831. 		SWAP(short *, thisline, nextline);

tools/tiffmedian.c:829:2: Assignment
827. 	outline = (unsigned char *) _TIFFmalloc(TIFFScanlineSize(out));
828. 
829. 	GetInputLine(in, 0, goto bad);		/* get first line */
      ^
830. 	for (i = 1; i <= imagelength; ++i) {
831. 		SWAP(short *, thisline, nextline);

tools/tiffmedian.c:829:2: Array access: Offset: [1, +oo] Size: [0, +oo]
827. 	outline = (unsigned char *) _TIFFmalloc(TIFFScanlineSize(out));
828. 
829. 	GetInputLine(in, 0, goto bad);		/* get first line */
      ^
830. 	for (i = 1; i <= imagelength; ++i) {
831. 		SWAP(short *, thisline, nextline);
