tools/tiffcrop.c:6735: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage`.

tools/tiffcrop.c:6699:1: Parameter `(*out)->tif_dir.td_rowsperstrip`
6697.   } /* end extractImageSection */
6698. 
6699. static int 
      ^
6700. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6701.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6729:14: Call
6727.     case ONE_FILE_SEPARATED: /* Regions as separated images */
6728.          autoindex = 0;
6729.          if (update_output_file (out, mp, autoindex, filename, page))
                   ^
6730.            return (1);
6731.          page_count = crop->selections * total_pages;

tools/tiffcrop.c:2033:1: Parameter `(*tiffout)->tif_dir.td_rowsperstrip`
  2031.  * so TIFFTAG PAGENUM will be correct in image.
  2032.  */
  2033. static int 
        ^
  2034. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2035.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6735:16: Call
6733.            {
6734.            crop_buff = seg_buffs[i].buffer;
6735.            if (writeCroppedImage(in, *out, image, dump,
                     ^
6736.                                  crop->regionlist[i].width, 
6737.                                  crop->regionlist[i].length, 

tools/tiffcrop.c:7541:1: Parameter `out->tif_dir.td_rowsperstrip`
  7539.  * then passed in as an argument.
  7540.  */
  7541. static int  
        ^
  7542. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7543.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7784:11: Call
  7782.     if (config == PLANARCONFIG_CONTIG)
  7783.       {
  7784.       if (writeBufferToContigTiles (out, crop_buff, length, width, spp, dump))
                  ^
  7785.         TIFFError("","Unable to write contiguous tile data for page %d", pagenum);
  7786.       }

tools/tiffcrop.c:1190:1: Parameter `out->tif_dir.td_rowsperstrip`
    1188.  * to be written out as a tile.
    1189.  */
    1190. static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
          ^
    1191. 				       uint32 imagewidth, tsample_t spp, 
    1192.                                        struct dump_opts* dump)

tools/tiffcrop.c:1247:11: Call
    1245.         }
    1246. 
    1247.       if (TIFFWriteTile(out, tilebuf, col, row, 0, 0) < 0)
                    ^
    1248.         {
    1249. 	TIFFError("writeBufferToContigTiles",

libtiff/tif_write.c:312:1: Parameter `tif->tif_dir.td_rowsperstrip`
      310.  * tile is selected by the (x,y,z,s) coordinates.
      311.  */
      312. tmsize_t
           ^
      313. TIFFWriteTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
      314. {

libtiff/tif_write.c:323:10: Call
      321. 	 *     after the output buffer is setup in TIFFWriteBufferSetup.
      322. 	 */
      323. 	return (TIFFWriteEncodedTile(tif,
                    ^
      324. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
      325. }

libtiff/tif_write.c:339:1: Parameter `tif->tif_dir.td_rowsperstrip`
        337.  *     the image on each write (as TIFFWriteScanline does).
        338.  */
        339. tmsize_t
             ^
        340. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
        341. {

libtiff/tif_write.c:346:7: Call
        344. 	uint16 sample;
        345. 
        346. 	if (!WRITECHECKTILES(tif, module))
                   ^
        347. 		return ((tmsize_t)(-1));
        348. 	td = &tif->tif_dir;

libtiff/tif_write.c:488:1: Parameter `tif->tif_dir.td_rowsperstrip`
          486.  * that important information is not changed.
          487.  */
          488. int
               ^
          489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
          490. {

libtiff/tif_write.c:533:46: Call
          531. 		}
          532. 	}
          533. 	if (tif->tif_dir.td_stripoffset == NULL && !TIFFSetupStrips(tif)) {
                                                            ^
          534. 		tif->tif_dir.td_nstrips = 0;
          535. 		TIFFErrorExt(tif->tif_clientdata, module, "No space for %s arrays",

libtiff/tif_write.c:448:1: Parameter `tif->tif_dir.td_rowsperstrip`
            446.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
            447. 
            448. int
                 ^
            449. TIFFSetupStrips(TIFF* tif)
            450. {

libtiff/tif_write.c:460:29: Call
            458. 		td->td_stripsperimage =
            459. 		    isUnspecified(tif, FIELD_ROWSPERSTRIP) ?
            460. 			td->td_samplesperpixel : TIFFNumberOfStrips(tif);
                                             ^
            461. 	td->td_nstrips = td->td_stripsperimage;
            462. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:60:1: <LHS trace>
58.  * Compute how many strips are in an image.
59.  */
60. uint32
    ^
61. TIFFNumberOfStrips(TIFF* tif)
62. {

libtiff/tif_strip.c:60:1: Parameter `tif->tif_dir.td_imagelength`
              58.  * Compute how many strips are in an image.
              59.  */
              60. uint32
                  ^
              61. TIFFNumberOfStrips(TIFF* tif)
              62. {

libtiff/tif_strip.c:67:7: Binary operation: ([0, +oo] - 1):unsigned32 by call to `writeCroppedImage` 
              65. 
              66. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
              67. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
                        ^
              68. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)
              69. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
