contrib/addtiffo/tif_ovrcache.c:255: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFFlush`.

contrib/addtiffo/tif_ovrcache.c:168:12: Call
166. /* -------------------------------------------------------------------- */
167.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
168.     nRet = TIFFSetSubDirectory( psCache->hTIFF, psCache->nDirOffset );
                ^
169.     assert( nRet == 1 );
170. 

libtiff/tif_dir.c:1658:10: Call
  1656. 	 */
  1657. 	tif->tif_dirnumber = 0;
  1658. 	return (TIFFReadDirectory(tif));
                 ^
  1659. }
  1660. 

libtiff/tif_dirread.c:3578:1: Parameter `tif->tif_dir.td_rowsperstrip`
    3576.  * format. We read directories sequentially.
    3577.  */
    3578. int
          ^
    3579. TIFFReadDirectory(TIFF* tif)
    3580. {

contrib/addtiffo/tif_ovrcache.c:255:5: Call
253. /*      Restore access to original directory.                           */
254. /* -------------------------------------------------------------------- */
255.     TIFFFlush( psCache->hTIFF );
         ^
256.     /* TODO: add checks on error status return of TIFFFlush */
257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_rowsperstrip`
  28. #include "tiffiop.h"
  29. 
  30. int
      ^
  31. TIFFFlush(TIFF* tif)
  32. {

libtiff/tif_flush.c:48:13: Call
  46.         && tif->tif_mode == O_RDWR )
  47.     {
  48.         if( TIFFForceStrileArrayWriting(tif) )
                  ^
  49.             return 1;
  50.     }

libtiff/tif_flush.c:78:1: Parameter `tif->tif_dir.td_rowsperstrip`
    76.  * Returns 1 in case of success, 0 otherwise.
    77.  */
    78. int TIFFForceStrileArrayWriting(TIFF* tif)
        ^
    79. {
    80.     static const char module[] = "TIFFForceStrileArrayWriting";

libtiff/tif_flush.c:120:55: Call
    118.         }
    119. 
    120.         if (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif))
                                                               ^
    121.             return 0;
    122.     }

libtiff/tif_write.c:522:1: Parameter `tif->tif_dir.td_rowsperstrip`
      520.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
      521. 
      522. int
           ^
      523. TIFFSetupStrips(TIFF* tif)
      524. {

libtiff/tif_write.c:534:29: Call
      532. 		td->td_stripsperimage =
      533. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
      534. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                       ^
      535. 	td->td_nstrips = td->td_stripsperimage;
      536. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:58:1: <LHS trace>
56.  * Compute how many strips are in an image.
57.  */
58. uint32
    ^
59. TIFFNumberOfStrips(TIFF* tif)
60. {

libtiff/tif_strip.c:58:1: Parameter `tif->tif_dir.td_imagelength`
        56.  * Compute how many strips are in an image.
        57.  */
        58. uint32
            ^
        59. TIFFNumberOfStrips(TIFF* tif)
        60. {

libtiff/tif_strip.c:65:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFFlush` 
        63. 
        64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
        65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                  ^
        66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
        67. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
