tools/tiffcrop.c:6985: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage`.

tools/tiffcrop.c:6894:1: Parameter `(*out)->tif_dir.td_rowsperstrip`
6892.   } /* end extractImageSection */
6893. 
6894. static int 
      ^
6895. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6896.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6980:16: Call
6978.          for (i = 0; i < crop->selections; i++)
6979.            {
6980.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6981.              return (1);
6982. 

tools/tiffcrop.c:2111:1: Parameter `(*tiffout)->tif_dir.td_rowsperstrip`
  2109.  * so TIFFTAG PAGENUM will be correct in image.
  2110.  */
  2111. static int 
        ^
  2112. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2113.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6985:16: Call
6983.            crop_buff = seg_buffs[i].buffer;
6984.            /* Write the current region to the current file */
6985.            if (writeCroppedImage(in, *out, image, dump,
                     ^
6986.                                  crop->regionlist[i].width, 
6987.                                  crop->regionlist[i].length, 

tools/tiffcrop.c:7737:1: Parameter `out->tif_dir.td_rowsperstrip`
  7735.  * then passed in as an argument.
  7736.  */
  7737. static int  
        ^
  7738. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7739.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7994:11: Call
  7992.     if (config == PLANARCONFIG_CONTIG)
  7993.       {
  7994.       if (writeBufferToContigStrips (out, crop_buff, length))
                  ^
  7995.         TIFFError("","Unable to write contiguous strip data for page %d", pagenum);
  7996.       }

tools/tiffcrop.c:1119:1: Parameter `out->tif_dir.td_rowsperstrip`
    1117.   }
    1118. 
    1119. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
          ^
    1120.   {
    1121.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1131:9: Call
    1129. 	     imagelength - row : rowsperstrip;
    1130.     stripsize = TIFFVStripSize(out, nrows);
    1131.     if (TIFFWriteEncodedStrip(out, strip++, buf, stripsize) < 0)
                  ^
    1132.       {
    1133.       TIFFError(TIFFFileName(out), "Error, can't write strip %u", strip - 1);

libtiff/tif_write.c:185:1: Parameter `tif->tif_dir.td_rowsperstrip`
      183.  * NB: Image length must be setup before writing.
      184.  */
      185. tmsize_t
           ^
      186. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
      187. {

libtiff/tif_write.c:192:7: Call
      190. 	uint16 sample;
      191. 
      192. 	if (!WRITECHECKSTRIPS(tif, module))
                 ^
      193. 		return ((tmsize_t) -1);
      194. 	/*

libtiff/tif_write.c:566:1: Parameter `tif->tif_dir.td_rowsperstrip`
        564.  * that important information is not changed.
        565.  */
        566. int
             ^
        567. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
        568. {

libtiff/tif_write.c:613:46: Call
        611. 		}
        612. 	}
        613. 	if (tif->tif_dir.td_stripoffset == NULL && !TIFFSetupStrips(tif)) {
                                                          ^
        614. 		tif->tif_dir.td_nstrips = 0;
        615. 		TIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",

libtiff/tif_write.c:524:1: Parameter `tif->tif_dir.td_rowsperstrip`
          522.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
          523. 
          524. int
               ^
          525. TIFFSetupStrips(TIFF* tif)
          526. {

libtiff/tif_write.c:536:29: Call
          534. 		td->td_stripsperimage =
          535. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
          536. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                           ^
          537. 	td->td_nstrips = td->td_stripsperimage;
          538. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:58:1: <LHS trace>
56.  * Compute how many strips are in an image.
57.  */
58. uint32
    ^
59. TIFFNumberOfStrips(TIFF* tif)
60. {

libtiff/tif_strip.c:58:1: Parameter `tif->tif_dir.td_imagelength`
            56.  * Compute how many strips are in an image.
            57.  */
            58. uint32
                ^
            59. TIFFNumberOfStrips(TIFF* tif)
            60. {

libtiff/tif_strip.c:65:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage` 
            63. 
            64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
            65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                      ^
            66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
            67. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
