tools/tiffdither.c:137: error: Integer Overflow L2
  ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `TIFFWriteScanline`.

tools/tiffdither.c:58:1: Parameter `out->tif_dir.td_imagelength`
56.  * This code is stolen from tiffmedian.
57.  */
58. static int
    ^
59. fsdither(TIFF* in, TIFF* out)
60. {

tools/tiffdither.c:137:7: Call
135. 			}
136. 		}
137. 		if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
           ^
138. 			goto skip_on_error;
139. 	}

libtiff/tif_write.c:46:1: Parameter `tif->tif_dir.td_imagelength`
  44. static int TIFFAppendToStrip(TIFF* tif, uint32 strip, uint8* data, tmsize_t cc);
  45. 
  46. int
      ^
  47. TIFFWriteScanline(TIFF* tif, void* buf, uint32 row, uint16 sample)
  48. {

libtiff/tif_write.c:54:7: Call
  52. 	uint32 strip;
  53. 
  54. 	if (!WRITECHECKSTRIPS(tif, module))
            ^
  55. 		return (-1);
  56. 	/*

libtiff/tif_write.c:564:1: Parameter `tif->tif_dir.td_imagelength`
    562.  * that important information is not changed.
    563.  */
    564. int
         ^
    565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    566. {

libtiff/tif_write.c:640:13: Call
    638.             !(tif->tif_flags & TIFF_DIRTYDIRECT)  )
    639.         {
    640.             TIFFForceStrileArrayWriting(tif);
                     ^
    641.         }
    642. 

libtiff/tif_flush.c:78:1: Parameter `tif->tif_dir.td_imagelength`
      76.  * Returns 1 in case of success, 0 otherwise.
      77.  */
      78. int TIFFForceStrileArrayWriting(TIFF* tif)
          ^
      79. {
      80.     static const char module[] = "TIFFForceStrileArrayWriting";

libtiff/tif_flush.c:120:55: Call
      118.         }
      119. 
      120.         if (tif->tif_dir.td_stripoffset_p == NULL && !TIFFSetupStrips(tif))
                                                                 ^
      121.             return 0;
      122.     }

libtiff/tif_write.c:522:1: Parameter `tif->tif_dir.td_imagelength`
        520.     (TIFFFieldSet(tif,f) && (tif)->tif_dir.td_imagelength == 0)
        521. 
        522. int
             ^
        523. TIFFSetupStrips(TIFF* tif)
        524. {

libtiff/tif_write.c:530:29: Call
        528. 		td->td_stripsperimage =
        529. 		    isUnspecified(tif, FIELD_TILEDIMENSIONS) ?
        530. 			td->td_samplesperpixel : TIFFNumberOfTiles(tif);
                                         ^
        531. 	else
        532. 		td->td_stripsperimage =

libtiff/tif_tile.c:112:1: <LHS trace>
110.  * Compute how many tiles are in an image.
111.  */
112. uint32
     ^
113. TIFFNumberOfTiles(TIFF* tif)
114. {

libtiff/tif_tile.c:112:1: Parameter `tif->tif_dir.td_imagelength`
          110.  * Compute how many tiles are in an image.
          111.  */
          112. uint32
               ^
          113. TIFFNumberOfTiles(TIFF* tif)
          114. {

libtiff/tif_tile.c:112:1: <RHS trace>
110.  * Compute how many tiles are in an image.
111.  */
112. uint32
     ^
113. TIFFNumberOfTiles(TIFF* tif)
114. {

libtiff/tif_tile.c:112:1: Parameter `tif->tif_dir.td_imagelength`
          110.  * Compute how many tiles are in an image.
          111.  */
          112. uint32
               ^
          113. TIFFNumberOfTiles(TIFF* tif)
          114. {

libtiff/tif_tile.c:129:6: Binary operation: ([0, 4294967294] + [0, 4294967294]):unsigned32 by call to `TIFFWriteScanline` 
          127. 	ntiles = (dx == 0 || dy == 0 || dz == 0) ? 0 :
          128. 	    _TIFFMultiply32(tif, _TIFFMultiply32(tif, TIFFhowmany_32(td->td_imagewidth, dx),
          129. 	    TIFFhowmany_32(td->td_imagelength, dy),
                    ^
          130. 	    "TIFFNumberOfTiles"),
          131. 	    TIFFhowmany_32(td->td_imagedepth, dz), "TIFFNumberOfTiles");
