libtiff/tif_dirread.c:4210: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [0, +oo] by call to `EstimateStripByteCounts`.

libtiff/tif_dirread.c:3795:29: Call
3793. 	 */
3794. 	if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3795. 		tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);  
                                  ^
3796. 		tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3797. 		tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;

libtiff/tif_strip.c:64:13: Assignment
  62. 	uint32 nstrips;
  63. 
  64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
                  ^
  65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
  66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:64:2: Assignment
  62. 	uint32 nstrips;
  63. 
  64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
       ^
  65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
  66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:69:2: Assignment
  67. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
  68. 		    "TIFFNumberOfStrips");
  69. 	return (nstrips);
       ^
  70. }
  71. 

libtiff/tif_dirread.c:3795:3: Assignment
3793. 	 */
3794. 	if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3795. 		tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);  
        ^
3796. 		tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3797. 		tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;

libtiff/tif_dirread.c:4195:10: Call
4193. 			   && tif->tif_dir.td_nstrips > 2
4194. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4195. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
               ^
4196. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4197. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6305:1: Parameter `tif->tif_dir.td_nstrips`
  6303. 
  6304. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6307:12: Call
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6308. }
  6309. 

libtiff/tif_dirread.c:6311:1: Parameter `tif->tif_dir.td_nstrips`
    6309. 
    6310. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6311. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6314:12: Call
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;
    6314.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6315.                                &(td->td_stripbytecount_entry),
    6316.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6246:1: Parameter `strile`
      6244. }
      6245. 
      6246. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6247.                                                    TIFFDirEntry* dirent,
      6248.                                                    uint64** parray,

libtiff/tif_dirread.c:4195:44: Call
4193. 			   && tif->tif_dir.td_nstrips > 2
4194. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4195. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                 ^
4196. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4197. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6305:1: Parameter `tif->tif_dir.td_nstrips`
  6303. 
  6304. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6307:12: Call
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6308. }
  6309. 

libtiff/tif_dirread.c:6311:1: Parameter `tif->tif_dir.td_nstrips`
    6309. 
    6310. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6311. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6314:12: Call
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;
    6314.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6315.                                &(td->td_stripbytecount_entry),
    6316.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6246:1: Parameter `strile`
      6244. }
      6245. 
      6246. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6247.                                                    TIFFDirEntry* dirent,
      6248.                                                    uint64** parray,

libtiff/tif_dirread.c:4196:10: Call
4194. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4195. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4196. 			   && TIFFGetStrileByteCount(tif, 0) != 0
               ^
4197. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {
4198. 			/*

libtiff/tif_dirread.c:6305:1: Parameter `tif->tif_dir.td_nstrips`
  6303. 
  6304. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6307:12: Call
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6308. }
  6309. 

libtiff/tif_dirread.c:6311:1: Parameter `tif->tif_dir.td_nstrips`
    6309. 
    6310. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6311. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6314:12: Call
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;
    6314.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6315.                                &(td->td_stripbytecount_entry),
    6316.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6246:1: Parameter `strile`
      6244. }
      6245. 
      6246. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6247.                                                    TIFFDirEntry* dirent,
      6248.                                                    uint64** parray,

libtiff/tif_dirread.c:4197:10: Call
4195. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4196. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4197. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {
               ^
4198. 			/*
4199. 			 * XXX: Some vendors fill StripByteCount array with

libtiff/tif_dirread.c:6305:1: Parameter `tif->tif_dir.td_nstrips`
  6303. 
  6304. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6307:12: Call
  6305. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6306. {
  6307.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6308. }
  6309. 

libtiff/tif_dirread.c:6311:1: Parameter `tif->tif_dir.td_nstrips`
    6309. 
    6310. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6311. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6314:12: Call
    6312. {
    6313.     TIFFDirectory *td = &tif->tif_dir;
    6314.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6315.                                &(td->td_stripbytecount_entry),
    6316.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6246:1: Parameter `strile`
      6244. }
      6245. 
      6246. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6247.                                                    TIFFDirEntry* dirent,
      6248.                                                    uint64** parray,

libtiff/tif_dirread.c:4210:8: Call
4208. 			TIFFWarningExt(tif->tif_clientdata, module,
4209. 			    "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
4210. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
             ^
4211. 			    goto bad;
4212. 		}

libtiff/tif_dirread.c:4508:1: <Offset trace>
4506. }
4507. 
4508. static int
      ^
4509. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4510. {

libtiff/tif_dirread.c:4508:1: Parameter `tif->tif_dir.td_nstrips`
  4506. }
  4507. 
  4508. static int
        ^
  4509. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
  4510. {

libtiff/tif_dirread.c:4583:3: Assignment
  4581. 		 * of data in the strip and trim this number back accordingly.
  4582. 		 */
  4583. 		strip--;
          ^
  4584.                 if (td->td_stripoffset_p[strip] > TIFF_UINT64_MAX - td->td_stripbytecount_p[strip])
  4585.                     return -1;

libtiff/tif_dirread.c:4508:1: <Length trace>
4506. }
4507. 
4508. static int
      ^
4509. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4510. {

libtiff/tif_dirread.c:4508:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  4506. }
  4507. 
  4508. static int
        ^
  4509. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
  4510. {

libtiff/tif_dirread.c:4518:14: Call
  4516. 
  4517.     /* Do not try to load stripbytecount as we will compute it */
  4518.         if( !_TIFFFillStrilesInternal( tif, 0 ) )
                     ^
  4519.             return -1;
  4520. 

libtiff/tif_dirread.c:6325:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    6323. }
    6324. 
    6325. static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount )
          ^
    6326. {
    6327.     register TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:4584:21: Array access: Offset: [2, +oo] Size: [0, +oo] by call to `EstimateStripByteCounts` 
  4582. 		 */
  4583. 		strip--;
  4584.                 if (td->td_stripoffset_p[strip] > TIFF_UINT64_MAX - td->td_stripbytecount_p[strip])
                            ^
  4585.                     return -1;
  4586. 		if (td->td_stripoffset_p[strip]+td->td_stripbytecount_p[strip] > filesize) {
