tools/tiffcp.c:1341: error: Integer Overflow L2
  ([0, max(0, `in->tif_dir.td_tilewidth`)] - 1):unsigned32 by call to `TIFFReadTile`.

tools/tiffcp.c:1315:1: Parameter `in->tif_dir.td_tilewidth`
1313. }
1314. 
1315. DECLAREreadFunc(readContigTilesIntoBuffer)
      ^
1316. {
1317. 	int status = 1;

tools/tiffcp.c:1318:21: Call
1316. {
1317. 	int status = 1;
1318. 	tsize_t tilesize = TIFFTileSize(in);
                          ^
1319. 	tdata_t tilebuf;
1320. 	uint32 imagew = TIFFScanlineSize(in);

libtiff/tif_tile.c:272:1: Parameter `tif->tif_dir.td_tilewidth`
  270. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
  271. }
  272. tmsize_t
       ^
  273. TIFFTileSize(TIFF* tif)
  274. {

libtiff/tif_tile.c:278:4: Call
  276. 	uint64 m;
  277. 	tmsize_t n;
  278. 	m=TIFFTileSize64(tif);
          ^
  279. 	n=(tmsize_t)m;
  280. 	if ((uint64)n!=m)

libtiff/tif_tile.c:267:1: Parameter `tif->tif_dir.td_tilewidth`
    265.  * Compute the # bytes in a row-aligned tile.
    266.  */
    267. uint64
         ^
    268. TIFFTileSize64(TIFF* tif)
    269. {

libtiff/tif_tile.c:270:10: Call
    268. TIFFTileSize64(TIFF* tif)
    269. {
    270. 	return (TIFFVTileSize64(tif, tif->tif_dir.td_tilelength));
                  ^
    271. }
    272. tmsize_t

libtiff/tif_tile.c:200:1: Parameter `tif->tif_dir.td_tilewidth`
      198.  * Compute the # bytes in a variable length, row-aligned tile.
      199.  */
      200. uint64
           ^
      201. TIFFVTileSize64(TIFF* tif, uint32 nrows)
      202. {

tools/tiffcp.c:1321:18: Call
1319. 	tdata_t tilebuf;
1320. 	uint32 imagew = TIFFScanlineSize(in);
1321. 	uint32 tilew  = TIFFTileRowSize(in);
                       ^
1322. 	int64 iskew = (int64)imagew - (int64)tilew;
1323. 	uint8* bufp = (uint8*) buf;

libtiff/tif_tile.c:181:1: Parameter `tif->tif_dir.td_tilewidth`
  179. 	return (tilerowsize);
  180. }
  181. tmsize_t
       ^
  182. TIFFTileRowSize(TIFF* tif)
  183. {

libtiff/tif_tile.c:187:4: Call
  185. 	uint64 m;
  186. 	tmsize_t n;
  187. 	m=TIFFTileRowSize64(tif);
          ^
  188. 	n=(tmsize_t)m;
  189. 	if ((uint64)n!=m)

libtiff/tif_tile.c:143:1: Parameter `tif->tif_dir.td_tilewidth`
    141.  * Compute the # bytes in each row of a tile.
    142.  */
    143. uint64
         ^
    144. TIFFTileRowSize64(TIFF* tif)
    145. {

tools/tiffcp.c:1341:8: Call
1339. 
1340. 		for (col = 0; col < imagewidth && colb < imagew; col += tw) {
1341. 			if (TIFFReadTile(in, tilebuf, col, row, 0, 0) < 0
             ^
1342. 			    && !ignore) {
1343. 				TIFFError(TIFFFileName(in),

libtiff/tif_read.c:668:1: Parameter `tif->tif_dir.td_tilewidth`
  666.  * tile is selected by the (x,y,z,s) coordinates.
  667.  */
  668. tmsize_t
       ^
  669. TIFFReadTile(TIFF* tif, void* buf, uint32 x, uint32 y, uint32 z, uint16 s)
  670. {

libtiff/tif_read.c:673:10: Call
  671. 	if (!TIFFCheckRead(tif, 1) || !TIFFCheckTile(tif, x, y, z, s))
  672. 		return ((tmsize_t)(-1));
  673. 	return (TIFFReadEncodedTile(tif,
                ^
  674. 	    TIFFComputeTile(tif, x, y, z, s), buf, (tmsize_t)(-1)));
  675. }

libtiff/tif_read.c:681:1: Parameter `tif->tif_dir.td_tilewidth`
    679.  * amount into the user-supplied buffer.
    680.  */
    681. tmsize_t
         ^
    682. TIFFReadEncodedTile(TIFF* tif, uint32 tile, void* buf, tmsize_t size)
    683. {

libtiff/tif_read.c:718:6: Call
    716. 	else if (size > tilesize)
    717. 		size = tilesize;
    718. 	if (TIFFFillTile(tif, tile) && (*tif->tif_decodetile)(tif,
              ^
    719. 	    (uint8*) buf, size, (uint16)(tile/td->td_stripsperimage))) {
    720. 		(*tif->tif_postdecode)(tif, (uint8*) buf, size);

libtiff/tif_read.c:842:1: Parameter `tif->tif_dir.td_tilewidth`
      840.  * expanded, as necessary, to hold the tile's data.
      841.  */
      842. int
           ^
      843. TIFFFillTile(TIFF* tif, uint32 tile)
      844. {

libtiff/tif_read.c:951:10: Call
      949. 		}
      950. 	}
      951. 	return (TIFFStartTile(tif, tile));
                    ^
      952. }
      953. 

libtiff/tif_read.c:1040:1: <LHS trace>
1038.  * tile has just been read in.
1039.  */
1040. static int
      ^
1041. TIFFStartTile(TIFF* tif, uint32 tile)
1042. {

libtiff/tif_read.c:1040:1: Parameter `tif->tif_dir.td_tilewidth`
        1038.  * tile has just been read in.
        1039.  */
        1040. static int
              ^
        1041. TIFFStartTile(TIFF* tif, uint32 tile)
        1042. {

libtiff/tif_read.c:1056:19: Binary operation: ([0, max(0, in->tif_dir.td_tilewidth)] - 1):unsigned32 by call to `TIFFReadTile` 
        1054. 	}
        1055. 	tif->tif_curtile = tile;
        1056.         howmany32=TIFFhowmany_32(td->td_imagewidth, td->td_tilewidth);
                                ^
        1057.         if (howmany32 == 0) {
        1058.                  TIFFErrorExt(tif->tif_clientdata,module,"Zero tiles");
