libtiff/tif_getimage.c:959: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip`.

libtiff/tif_getimage.c:916:14: Call
914. 	int ret = 1, flip, colorchannels;
915. 
916. 	stripsize = TIFFStripSize(tif);  
                  ^
917. 	p0 = buf = (unsigned char *)_TIFFmalloc((alpha?4:3)*stripsize);
918. 	if (buf == 0) {

libtiff/tif_strip.c:235:1: Parameter `tif->tif_dir.td_imagelength`
  233. 	return (TIFFVStripSize64(tif, rps));
  234. }
  235. tmsize_t
       ^
  236. TIFFStripSize(TIFF* tif)
  237. {

libtiff/tif_strip.c:241:4: Call
  239. 	uint64 m;
  240. 	tmsize_t n;
  241. 	m=TIFFStripSize64(tif);
          ^
  242. 	n=(tmsize_t)m;
  243. 	if ((uint64)n!=m)

libtiff/tif_strip.c:226:1: Parameter `tif->tif_dir.td_imagelength`
    224.  * to hold the strip.
    225.  */
    226. uint64
         ^
    227. TIFFStripSize64(TIFF* tif)
    228. {

libtiff/tif_getimage.c:959:7: Call
957. 		nrow = (row + rowstoread > h ? h - row : rowstoread);
958. 		offset_row = row + img->row_offset;
959. 		if (TIFFReadEncodedStrip(tif, TIFFComputeStrip(tif, offset_row, 0),
           ^
960. 		    p0, ((row + img->row_offset)%rowsperstrip + nrow) * scanline)==(tmsize_t)(-1)
961. 		    && img->stoponerr)

libtiff/tif_read.c:306:1: <LHS trace>
304.  * amount into the user-supplied buffer.
305.  */
306. tmsize_t
     ^
307. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
308. {

libtiff/tif_read.c:306:1: Parameter `tif->tif_dir.td_imagelength`
  304.  * amount into the user-supplied buffer.
  305.  */
  306. tmsize_t
       ^
  307. TIFFReadEncodedStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
  308. {

libtiff/tif_read.c:334:2: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TIFFReadEncodedStrip` 
  332. 	if (rowsperstrip>td->td_imagelength)
  333. 		rowsperstrip=td->td_imagelength;
  334. 	stripsperplane=((td->td_imagelength+rowsperstrip-1)/rowsperstrip);
        ^
  335. 	stripinplane=(strip%stripsperplane);
  336. 	plane=(strip/stripsperplane);
