tools/tiffcrop.c:4869: error: Buffer Overrun L3
  Offset: [2, 4294967294] Size: [3, 4294967295].

tools/tiffcrop.c:4801:26: <Offset trace>
4799.   tstrip_t  strip;
4800.   tsize_t scanlinesize = TIFFScanlineSize(in);
4801.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4802.   unsigned char *srcbuffs[MAX_SAMPLES];
4803.   unsigned char *buff = NULL;

tools/tiffcrop.c:4801:26: Call
4799.   tstrip_t  strip;
4800.   tsize_t scanlinesize = TIFFScanlineSize(in);
4801.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4802.   unsigned char *srcbuffs[MAX_SAMPLES];
4803.   unsigned char *buff = NULL;

libtiff/tif_strip.c:206:4: Call
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
          ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:199:10: Call
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
                  ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:104:4: Assignment
      102. 			TIFFErrorExt(tif->tif_clientdata,module,
      103. 			    "Invalid td_samplesperpixel value");
      104. 			return 0;
              ^
      105. 		}
      106. 		TIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,

libtiff/tif_strip.c:199:2: Assignment
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
          ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:206:2: Assignment
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
        ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:207:9: Call
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  208. }
  209. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:207:2: Assignment
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  208. }
  209. 

tools/tiffcrop.c:4801:3: Assignment
4799.   tstrip_t  strip;
4800.   tsize_t scanlinesize = TIFFScanlineSize(in);
4801.   tsize_t stripsize    = TIFFStripSize(in);
        ^
4802.   unsigned char *srcbuffs[MAX_SAMPLES];
4803.   unsigned char *buff = NULL;

tools/tiffcrop.c:4801:26: <Length trace>
4799.   tstrip_t  strip;
4800.   tsize_t scanlinesize = TIFFScanlineSize(in);
4801.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4802.   unsigned char *srcbuffs[MAX_SAMPLES];
4803.   unsigned char *buff = NULL;

tools/tiffcrop.c:4801:26: Call
4799.   tstrip_t  strip;
4800.   tsize_t scanlinesize = TIFFScanlineSize(in);
4801.   tsize_t stripsize    = TIFFStripSize(in);
                               ^
4802.   unsigned char *srcbuffs[MAX_SAMPLES];
4803.   unsigned char *buff = NULL;

libtiff/tif_strip.c:206:4: Call
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
          ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:199:10: Call
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
                  ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:104:4: Assignment
      102. 			TIFFErrorExt(tif->tif_clientdata,module,
      103. 			    "Invalid td_samplesperpixel value");
      104. 			return 0;
              ^
      105. 		}
      106. 		TIFFGetFieldDefaulted(tif,TIFFTAG_YCBCRSUBSAMPLING,ycbcrsubsampling+0,

libtiff/tif_strip.c:199:2: Assignment
    197. 	if (rps > td->td_imagelength)
    198. 		rps = td->td_imagelength;
    199. 	return (TIFFVStripSize64(tif, rps));
          ^
    200. }
    201. tmsize_t

libtiff/tif_strip.c:206:2: Assignment
  204. 	static const char module[] = "TIFFStripSize";
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
        ^
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
  208. }

libtiff/tif_strip.c:207:9: Call
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
               ^
  208. }
  209. 

libtiff/tif_aux.c:90:9: Assignment
    88.             TIFFErrorExt(tif->tif_clientdata,module,"Integer overflow");
    89.         }
    90.         return 0;
                ^
    91.     }
    92.     return (tmsize_t)val;

libtiff/tif_strip.c:207:2: Assignment
  205. 	uint64 m;
  206. 	m=TIFFStripSize64(tif);
  207. 	return _TIFFCastUInt64ToSSize(tif, m, module);
        ^
  208. }
  209. 

tools/tiffcrop.c:4801:3: Assignment
4799.   tstrip_t  strip;
4800.   tsize_t scanlinesize = TIFFScanlineSize(in);
4801.   tsize_t stripsize    = TIFFStripSize(in);
        ^
4802.   unsigned char *srcbuffs[MAX_SAMPLES];
4803.   unsigned char *buff = NULL;

tools/tiffcrop.c:4858:12: Call
4856.     {
4857.     srcbuffs[s] = NULL;
4858.     buff = limitMalloc(stripsize + 3);
                 ^
4859.     if (!buff)
4860.       {

tools/tiffcrop.c:634:76: Assignment
  632.     fprintf(stderr, "MemoryLimitError: allocation of " TIFF_UINT64_FORMAT " bytes is forbidden. Limit is " TIFF_UINT64_FORMAT ".\n",
  633.             (uint64)s, (uint64)maxMalloc);
  634.     fprintf(stderr, "                  use -k option to change limit.\n"); return NULL;
                                                                                  ^
  635.   }
  636.   return _TIFFmalloc(s);

tools/tiffcrop.c:4858:5: Assignment
4856.     {
4857.     srcbuffs[s] = NULL;
4858.     buff = limitMalloc(stripsize + 3);
          ^
4859.     if (!buff)
4860.       {

tools/tiffcrop.c:4869:5: Array access: Offset: [2, 4294967294] Size: [3, 4294967295]
4867.     buff[stripsize] = 0;
4868.     buff[stripsize+1] = 0;
4869.     buff[stripsize+2] = 0;
          ^
4870.     srcbuffs[s] = buff;
4871.     }
