tools/tiffcp.c:1299: error: Integer Overflow L2
  ([0, max(0, `in->tif_dir.td_tilewidth`)] - 1):unsigned32 by call to `TIFFReadTile`.

tools/tiffcp.c:1273:1: Parameter `in->tif_dir.td_tilewidth`
1271. }
1272. 
1273. DECLAREreadFunc(readContigTilesIntoBuffer)
      ^
1274. {
1275. 	int status = 1;

tools/tiffcp.c:1276:21: Call
1274. {
1275. 	int status = 1;
1276. 	tsize_t tilesize = TIFFTileSize(in);
                          ^
1277. 	tdata_t tilebuf;
1278. 	uint32 imagew = TIFFScanlineSize(in);

libtiff/tif_tile.c:248:1: Parameter `tif->tif_dir.td_tilewidth`
  246. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  247. }
  248. tmsize_t
       ^
  249. TIFFTileSize(TIFF* tif)
  250. {

libtiff/tif_tile.c:254:4: Call
  252. 	uint64 m;
  253. 	tmsize_t n;
  254. 	m=TIFFTileSize64(tif);
          ^
  255. 	n=(tmsize_t)m;
  256. 	if ((uint64)n!=m)

libtiff/tif_tile.c:243:1: Parameter `tif->tif_dir.td_tilewidth`
    241.  * Compute the # bytes in a row-aligned tile.
    242.  */
    243. uint64
         ^
    244. TIFFTileSize64(TIFF* tif)
    245. {

libtiff/tif_tile.c:246:10: Call
    244. TIFFTileSize64(TIFF* tif)
    245. {
    246. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    247. }
    248. tmsize_t

libtiff/tif_tile.c:177:1: Parameter `tif->tif_dir.td_tilewidth`
      175.  * Compute the # bytes in a variable length, row-aligned tile.
      176.  */
      177. uint64
           ^
      178. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      179. {

tools/tiffcp.c:1279:18: Call
1277. 	tdata_t tilebuf;
1278. 	uint32 imagew = TIFFScanlineSize(in);
1279. 	uint32 tilew  = TIFFTileRowSize(in);
                       ^
1280. 	int iskew = imagew - tilew;
1281. 	uint8* bufp = (uint8*) buf;

libtiff/tif_tile.c:158:1: Parameter `tif->tif_dir.td_tilewidth`
  156. 	return (TIFFhowmany8_64(rowsize));
  157. }
  158. tmsize_t
       ^
  159. TIFFTileRowSize(TIFF* tif)
  160. {

libtiff/tif_tile.c:164:4: Call
  162. 	uint64 m;
  163. 	tmsize_t n;
  164. 	m=TIFFTileRowSize64(tif);
          ^
  165. 	n=(tmsize_t)m;
  166. 	if ((uint64)n!=m)

libtiff/tif_tile.c:143:1: Parameter `tif->tif_dir.td_tilewidth`
    141.  * Compute the # bytes in each row of a tile.
    142.  */
    143. uint64
         ^
    144. TIFFTileRowSize64(TIFF* tif)
    145. {

tools/tiffcp.c:1299:8: Call
1297. 
1298. 		for (col = 0; col < imagewidth; col += tw) {
1299. 			if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
             ^
1300. 			    && !ignore) {
1301. 				TIFFError(TIFFFileName(in),

libtiff/tif_read.c:604:1: Parameter `tif->tif_dir.td_tilewidth`
  602.  * tile is selected by the (x,y,z,s) coordinates.
  603.  */
  604. tmsize_t
       ^
  605. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  606. {

libtiff/tif_read.c:609:10: Call
  607. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  608. 		return ((tmsize_t)(-1));
  609. 	return (TIFFReadEncodedTile(tif,
                ^
  610. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  611. }

libtiff/tif_read.c:617:1: Parameter `tif->tif_dir.td_tilewidth`
    615.  * amount into the user-supplied buffer.
    616.  */
    617. tmsize_t
         ^
    618. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
    619. {

libtiff/tif_read.c:636:6: Call
    634. 	else if (size > tilesize)
    635. 		size = tilesize;
    636. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
              ^
    637. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
    638. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:757:1: Parameter `tif->tif_dir.td_tilewidth`
      755.  * expanded, as necessary, to hold the tile's data.
      756.  */
      757. int
           ^
      758. TIFFFillTile(TIFF* tif, uint32 tile)
      759. {

libtiff/tif_read.c:853:10: Call
      851. 		}
      852. 	}
      853. 	return (TIFFStartTile(tif, tile));
                    ^
      854. }
      855. 

libtiff/tif_read.c:933:1: <LHS trace>
931.  * tile has just been read in.
932.  */
933. static int
     ^
934. TIFFStartTile(TIFF* tif, uint32 tile)
935. {

libtiff/tif_read.c:933:1: Parameter `tif->tif_dir.td_imagewidth`
        931.  * tile has just been read in.
        932.  */
        933. static int
             ^
        934. TIFFStartTile(TIFF* tif, uint32 tile)
        935. {

libtiff/tif_read.c:945:14: Binary operation: ([0, max(0, in->tif_dir.td_tilewidth)] - 1):unsigned32 by call to `TIFFReadTile` 
        943. 	tif->tif_curtile = tile;
        944. 	tif->tif_row =
        945. 	    (tile % TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth)) *
                          ^
        946. 		td->td_tilelength;
        947. 	tif->tif_col =
