libtiff/tif_dirread.c:4202: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [0, +oo] by call to `EstimateStripByteCounts`.

libtiff/tif_dirread.c:3787:29: Call
3785. 	 */
3786. 	if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3787. 		tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);  
                                  ^
3788. 		tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3789. 		tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;

libtiff/tif_strip.c:64:13: Assignment
  62. 	uint32 nstrips;
  63. 
  64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
                  ^
  65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
  66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:64:2: Assignment
  62. 	uint32 nstrips;
  63. 
  64. 	nstrips = (td->td_rowsperstrip == (uint32) -1 ? 1 :
       ^
  65. 	     TIFFhowmany_32(td->td_imagelength, td->td_rowsperstrip));
  66. 	if (td->td_planarconfig == PLANARCONFIG_SEPARATE)

libtiff/tif_strip.c:69:2: Assignment
  67. 		nstrips = _TIFFMultiply32(tif, nstrips, (uint32)td->td_samplesperpixel,
  68. 		    "TIFFNumberOfStrips");
  69. 	return (nstrips);
       ^
  70. }
  71. 

libtiff/tif_dirread.c:3787:3: Assignment
3785. 	 */
3786. 	if (!TIFFFieldSet(tif, FIELD_TILEDIMENSIONS)) {
3787. 		tif->tif_dir.td_nstrips = TIFFNumberOfStrips(tif);  
        ^
3788. 		tif->tif_dir.td_tilewidth = tif->tif_dir.td_imagewidth;
3789. 		tif->tif_dir.td_tilelength = tif->tif_dir.td_rowsperstrip;

libtiff/tif_dirread.c:4187:10: Call
4185. 			   && tif->tif_dir.td_nstrips > 2
4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
               ^
4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6282:1: Parameter `tif->tif_dir.td_nstrips`
  6280. 
  6281. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6284:12: Call
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6285. }
  6286. 

libtiff/tif_dirread.c:6288:1: Parameter `tif->tif_dir.td_nstrips`
    6286. 
    6287. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6288. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6291:12: Call
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;
    6291.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6292.                                &(td->td_stripbytecount_entry),
    6293.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6223:1: Parameter `strile`
      6221. }
      6222. 
      6223. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6224.                                                    TIFFDirEntry* dirent,
      6225.                                                    uint64** parray,

libtiff/tif_dirread.c:4187:44: Call
4185. 			   && tif->tif_dir.td_nstrips > 2
4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                 ^
4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6282:1: Parameter `tif->tif_dir.td_nstrips`
  6280. 
  6281. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6284:12: Call
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6285. }
  6286. 

libtiff/tif_dirread.c:6288:1: Parameter `tif->tif_dir.td_nstrips`
    6286. 
    6287. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6288. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6291:12: Call
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;
    6291.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6292.                                &(td->td_stripbytecount_entry),
    6293.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6223:1: Parameter `strile`
      6221. }
      6222. 
      6223. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6224.                                                    TIFFDirEntry* dirent,
      6225.                                                    uint64** parray,

libtiff/tif_dirread.c:4188:10: Call
4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
               ^
4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {
4190. 			/*

libtiff/tif_dirread.c:6282:1: Parameter `tif->tif_dir.td_nstrips`
  6280. 
  6281. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6284:12: Call
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6285. }
  6286. 

libtiff/tif_dirread.c:6288:1: Parameter `tif->tif_dir.td_nstrips`
    6286. 
    6287. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6288. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6291:12: Call
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;
    6291.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6292.                                &(td->td_stripbytecount_entry),
    6293.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6223:1: Parameter `strile`
      6221. }
      6222. 
      6223. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6224.                                                    TIFFDirEntry* dirent,
      6225.                                                    uint64** parray,

libtiff/tif_dirread.c:4189:10: Call
4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {
               ^
4190. 			/*
4191. 			 * XXX: Some vendors fill StripByteCount array with

libtiff/tif_dirread.c:6282:1: Parameter `tif->tif_dir.td_nstrips`
  6280. 
  6281. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        ^
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6284:12: Call
  6282. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
  6283. {
  6284.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                   ^
  6285. }
  6286. 

libtiff/tif_dirread.c:6288:1: Parameter `tif->tif_dir.td_nstrips`
    6286. 
    6287. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6288. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
          ^
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6291:12: Call
    6289. {
    6290.     TIFFDirectory *td = &tif->tif_dir;
    6291.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                     ^
    6292.                                &(td->td_stripbytecount_entry),
    6293.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6223:1: Parameter `strile`
      6221. }
      6222. 
      6223. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
            ^
      6224.                                                    TIFFDirEntry* dirent,
      6225.                                                    uint64** parray,

libtiff/tif_dirread.c:4202:8: Call
4200. 			TIFFWarningExt(tif->tif_clientdata, module,
4201. 			    "Wrong \"StripByteCounts\" field, ignoring and calculating from imagelength");
4202. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
             ^
4203. 			    goto bad;
4204. 		}

libtiff/tif_dirread.c:4500:1: <Offset trace>
4498. }
4499. 
4500. static int
      ^
4501. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4502. {

libtiff/tif_dirread.c:4500:1: Parameter `tif->tif_dir.td_nstrips`
  4498. }
  4499. 
  4500. static int
        ^
  4501. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
  4502. {

libtiff/tif_dirread.c:4575:3: Assignment
  4573. 		 * of data in the strip and trim this number back accordingly.
  4574. 		 */
  4575. 		strip--;
          ^
  4576. 		if (td->td_stripoffset_p[strip]+td->td_stripbytecount_p[strip] > filesize) {
  4577.                     if( td->td_stripoffset_p[strip] >= filesize ) {

libtiff/tif_dirread.c:4500:1: <Length trace>
4498. }
4499. 
4500. static int
      ^
4501. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4502. {

libtiff/tif_dirread.c:4500:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  4498. }
  4499. 
  4500. static int
        ^
  4501. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
  4502. {

libtiff/tif_dirread.c:4510:14: Call
  4508. 
  4509.     /* Do not try to load stripbytecount as we will compute it */
  4510.         if( !_TIFFFillStrilesInternal( tif, 0 ) )
                     ^
  4511.             return -1;
  4512. 

libtiff/tif_dirread.c:6302:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    6300. }
    6301. 
    6302. static int _TIFFFillStrilesInternal( TIFF *tif, int loadStripByteCount )
          ^
    6303. {
    6304.     register TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:4576:7: Array access: Offset: [2, +oo] Size: [0, +oo] by call to `EstimateStripByteCounts` 
  4574. 		 */
  4575. 		strip--;
  4576. 		if (td->td_stripoffset_p[strip]+td->td_stripbytecount_p[strip] > filesize) {
              ^
  4577.                     if( td->td_stripoffset_p[strip] >= filesize ) {
  4578.                         /* Not sure what we should in that case... */
