libtiff/tif_dirread.c:2309: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFSwabLong8`.

libtiff/tif_dirread.c:2194:6: Call
2192. 			return(TIFFReadDirEntryErrType);
2193. 	}
2194. 	err=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);
           ^
2195. 	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2196. 	{

libtiff/tif_dirread.c:756:1: Parameter `**value`
  754. }
  755. 
  756. static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
       ^
  757. {
  758. 	int typesize;

libtiff/tif_dirread.c:2304:5: Assignment
2302. 				float* mb;
2303. 				uint32 n;
2304. 				ma=(uint64*)origdata;
          ^
2305. 				mb=data;
2306. 				for (n=0; n<count; n++)

libtiff/tif_dirread.c:2309:7: Call
2307. 				{
2308. 					if (tif->tif_flags&TIFF_SWAB)
2309. 						TIFFSwabLong8(ma);
            ^
2310. #if defined(__WIN32__) && (_MSC_VER < 1500)
2311. 					/*

libtiff/tif_swab.c:58:1: <Length trace>
56. 
57. #ifndef TIFFSwabLong8
58. void
    ^
59. TIFFSwabLong8(uint64* lp)
60. {

libtiff/tif_swab.c:58:1: Parameter `*lp`
  56. 
  57. #ifndef TIFFSwabLong8
  58. void
      ^
  59. TIFFSwabLong8(uint64* lp)
  60. {

libtiff/tif_swab.c:61:2: Assignment
  59. TIFFSwabLong8(uint64* lp)
  60. {
  61. 	register unsigned char* cp = (unsigned char*) lp;
       ^
  62. 	unsigned char t;
  63. 	assert(sizeof(uint64)==8);

libtiff/tif_swab.c:64:6: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFSwabLong8` 
  62. 	unsigned char t;
  63. 	assert(sizeof(uint64)==8);
  64. 	t = cp[7]; cp[7] = cp[0]; cp[0] = t;
           ^
  65. 	t = cp[6]; cp[6] = cp[1]; cp[1] = t;
  66. 	t = cp[5]; cp[5] = cp[2]; cp[2] = t;

void
TIFFSwabLong8(uint64* lp)
{
	register unsigned char* cp = (unsigned char*) lp;
	unsigned char t;
	assert(sizeof(uint64)==8);
	t = cp[7]; cp[7] = cp[0]; cp[0] = t;
	t = cp[6]; cp[6] = cp[1]; cp[1] = t;
	t = cp[5]; cp[5] = cp[2]; cp[2] = t;
	t = cp[4]; cp[4] = cp[3]; cp[3] = t;
}
['static enum TIFFReadDirEntryErr TIFFReadDirEntryFloatArray(TIFF* tif, TIFFDirEntry* direntry, float** value)\n{\n\tenum TIFFReadDirEntryErr err;\n\tuint32 count;\n\tvoid* origdata;\n\tfloat* data;\n\tswitch (direntry->tdir_type)\n\t{\n\t\tcase TIFF_BYTE:\n\t\tcase TIFF_SBYTE:\n\t\tcase TIFF_SHORT:\n\t\tcase TIFF_SSHORT:\n\t\tcase TIFF_LONG:\n\t\tcase TIFF_SLONG:\n\t\tcase TIFF_LONG8:\n\t\tcase TIFF_SLONG8:\n\t\tcase TIFF_RATIONAL:\n\t\tcase TIFF_SRATIONAL:\n\t\tcase TIFF_FLOAT:\n\t\tcase TIFF_DOUBLE:\n\t\t\tbreak;\n\t\tdefault:\n\t\t\treturn(TIFFReadDirEntryErrType);\n\t}\n\terr=TIFFReadDirEntryArray(tif,direntry,&count,4,&origdata);\n\tif ((err!=TIFFReadDirEntryErrOk)||(origdata==0))\n\t{\n\t\t*value=0;\n\t\treturn(err);\n\t}\n\tswitch (direntry->tdir_type)\n\t{\n\t\tcase TIFF_FLOAT:\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabArrayOfLong((uint32*)origdata,count);\n\t\t\tTIFFCvtIEEEDoubleToNative(tif,count,(float*)origdata);\n\t\t\t*value=(float*)origdata;\n\t\t\treturn(TIFFReadDirEntryErrOk);\n\t}\n\tdata=(float*)_TIFFmalloc(count*sizeof(float));\n\tif (data==0)\n\t{\n\t\t_TIFFfree(origdata);\n\t\treturn(TIFFReadDirEntryErrAlloc);\n\t}\n\tswitch (direntry->tdir_type)\n\t{\n\t\tcase TIFF_BYTE:\n\t\t\t{\n\t\t\t\tuint8* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint8*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SBYTE:\n\t\t\t{\n\t\t\t\tint8* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int8*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SHORT:\n\t\t\t{\n\t\t\t\tuint16* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint16*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabShort(ma);\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SSHORT:\n\t\t\t{\n\t\t\t\tint16* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int16*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabShort((uint16*)ma);\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_LONG:\n\t\t\t{\n\t\t\t\tuint32* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SLONG:\n\t\t\t{\n\t\t\t\tint32* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong((uint32*)ma);\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_LONG8:\n\t\t\t{\n\t\t\t\tuint64* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint64*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong8(ma);\n#if defined(__WIN32__) && (_MSC_VER < 1500)\n\t\t\t\t\t*mb++ = _TIFFUInt64ToFloat(*ma++);\n#else\n\t\t\t\t\t*mb++ = (float)(*ma++);\n#endif\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SLONG8:\n\t\t\t{\n\t\t\t\tint64* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int64*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong8((uint64*)ma);\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_RATIONAL:\n\t\t\t{\n\t\t\t\tuint32* ma;\n\t\t\t\tuint32 maa;\n\t\t\t\tuint32 mab;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmaa=*ma++;\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmab=*ma++;\n\t\t\t\t\tif (mab==0)\n\t\t\t\t\t\t*mb++=0.0;\n\t\t\t\t\telse\n\t\t\t\t\t\t*mb++=(float)maa/(float)mab;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SRATIONAL:\n\t\t\t{\n\t\t\t\tuint32* ma;\n\t\t\t\tint32 maa;\n\t\t\t\tuint32 mab;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmaa=*(int32*)ma;\n\t\t\t\t\tma++;\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmab=*ma++;\n\t\t\t\t\tif (mab==0)\n\t\t\t\t\t\t*mb++=0.0;\n\t\t\t\t\telse\n\t\t\t\t\t\t*mb++=(float)maa/(float)mab;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_DOUBLE:\n\t\t\t{\n\t\t\t\tdouble* ma;\n\t\t\t\tfloat* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\tTIFFSwabArrayOfLong8((uint64*)origdata,count);\n\t\t\t\tTIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);\n\t\t\t\tma=(double*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t\t*mb++=(float)(*ma++);\n\t\t\t}\n\t\t\tbreak;\n\t}\n\t_TIFFfree(origdata);\n\tif (err!=TIFFReadDirEntryErrOk)\n\t{\n\t\t_TIFFfree(data);\n\t\treturn(err);\n\t}\n\t*value=data;\n\treturn(TIFFReadDirEntryErrOk);\n}', 'static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)\n{\n\tint typesize;\n\tuint32 datasize;\n\tvoid* data;\n\ttypesize=TIFFDataWidth(direntry->tdir_type);\n\tif ((direntry->tdir_count==0)||(typesize==0))\n\t{\n\t\t*value=0;\n\t\treturn(TIFFReadDirEntryErrOk);\n\t}\n        (void) desttypesize;\n#ifdef notdef\n\tif ((uint64)(4*1024*1024/typesize)<direntry->tdir_count)\n\t\treturn(TIFFReadDirEntryErrSizesan);\n\tif ((uint64)(4*1024*1024/desttypesize)<direntry->tdir_count)\n\t\treturn(TIFFReadDirEntryErrSizesan);\n#endif\n\t*count=(uint32)direntry->tdir_count;\n\tdatasize=(*count)*typesize;\n\tassert((tmsize_t)datasize>0);\n\tdata=_TIFFmalloc(datasize);\n\tif (data==0)\n\t\treturn(TIFFReadDirEntryErrAlloc);\n\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t{\n\t\tif (datasize<=4)\n\t\t\t_TIFFmemcpy(data,&direntry->tdir_offset,datasize);\n\t\telse\n\t\t{\n\t\t\tenum TIFFReadDirEntryErr err;\n\t\t\tuint32 offset = direntry->tdir_offset.toff_long;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabLong(&offset);\n\t\t\terr=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);\n\t\t\tif (err!=TIFFReadDirEntryErrOk)\n\t\t\t{\n\t\t\t\t_TIFFfree(data);\n\t\t\t\treturn(err);\n\t\t\t}\n\t\t}\n\t}\n\telse\n\t{\n\t\tif (datasize<=8)\n\t\t\t_TIFFmemcpy(data,&direntry->tdir_offset,datasize);\n\t\telse\n\t\t{\n\t\t\tenum TIFFReadDirEntryErr err;\n\t\t\tuint64 offset = direntry->tdir_offset.toff_long8;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabLong8(&offset);\n\t\t\terr=TIFFReadDirEntryData(tif,offset,(tmsize_t)datasize,data);\n\t\t\tif (err!=TIFFReadDirEntryErrOk)\n\t\t\t{\n\t\t\t\t_TIFFfree(data);\n\t\t\t\treturn(err);\n\t\t\t}\n\t\t}\n\t}\n\t*value=data;\n\treturn(TIFFReadDirEntryErrOk);\n}', 'void\nTIFFSwabLong8(uint64* lp)\n{\n\tregister unsigned char* cp = (unsigned char*) lp;\n\tunsigned char t;\n\tassert(sizeof(uint64)==8);\n\tt = cp[7]; cp[7] = cp[0]; cp[0] = t;\n\tt = cp[6]; cp[6] = cp[1]; cp[1] = t;\n\tt = cp[5]; cp[5] = cp[2]; cp[2] = t;\n\tt = cp[4]; cp[4] = cp[3]; cp[3] = t;\n}']