libtiff/tif_dirread.c:2597: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

libtiff/tif_dirread.c:2437:6: <Length trace>
2435. 			return(TIFFReadDirEntryErrType);
2436. 	}
2437. 	err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
           ^
2438. 	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2439. 	{

libtiff/tif_dirread.c:2437:6: Call
2435. 			return(TIFFReadDirEntryErrType);
2436. 	}
2437. 	err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
           ^
2438. 	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
2439. 	{

libtiff/tif_dirread.c:756:1: Parameter `**value`
  754. }
  755. 
  756. static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)
       ^
  757. {
  758. 	int typesize;

libtiff/tif_dirread.c:2588:5: Assignment
2586. 				double* mb;
2587. 				uint32 n;
2588. 				ma=(uint32*)origdata;
          ^
2589. 				mb=data;
2590. 				for (n=0; n<count; n++)

libtiff/tif_dirread.c:2594:11: Assignment
2592. 					if (tif->tif_flags&TIFF_SWAB)
2593. 						TIFFSwabLong(ma);
2594. 					maa=*ma++;
                ^
2595. 					if (tif->tif_flags&TIFF_SWAB)
2596. 						TIFFSwabLong(ma);

libtiff/tif_dirread.c:2597:10: Array access: Offset: [1, +oo] Size: [0, +oo]
2595. 					if (tif->tif_flags&TIFF_SWAB)
2596. 						TIFFSwabLong(ma);
2597. 					mab=*ma++;
               ^
2598. 					if (mab==0)
2599. 						*mb++=0.0;

static enum TIFFReadDirEntryErr
TIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)
{
	enum TIFFReadDirEntryErr err;
	uint32 count;
	void* origdata;
	double* data;
	switch (direntry->tdir_type)
	{
		case TIFF_BYTE:
		case TIFF_SBYTE:
		case TIFF_SHORT:
		case TIFF_SSHORT:
		case TIFF_LONG:
		case TIFF_SLONG:
		case TIFF_LONG8:
		case TIFF_SLONG8:
		case TIFF_RATIONAL:
		case TIFF_SRATIONAL:
		case TIFF_FLOAT:
		case TIFF_DOUBLE:
			break;
		default:
			return(TIFFReadDirEntryErrType);
	}
	err=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);
	if ((err!=TIFFReadDirEntryErrOk)||(origdata==0))
	{
		*value=0;
		return(err);
	}
	switch (direntry->tdir_type)
	{
		case TIFF_DOUBLE:
			if (tif->tif_flags&TIFF_SWAB)
				TIFFSwabArrayOfLong8((uint64*)origdata,count);
			TIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);
			*value=(double*)origdata;
			return(TIFFReadDirEntryErrOk);
	}
	data=(double*)_TIFFmalloc(count*sizeof(double));
	if (data==0)
	{
		_TIFFfree(origdata);
		return(TIFFReadDirEntryErrAlloc);
	}
	switch (direntry->tdir_type)
	{
		case TIFF_BYTE:
			{
				uint8* ma;
				double* mb;
				uint32 n;
				ma=(uint8*)origdata;
				mb=data;
				for (n=0; n<count; n++)
					*mb++=(double)(*ma++);
			}
			break;
		case TIFF_SBYTE:
			{
				int8* ma;
				double* mb;
				uint32 n;
				ma=(int8*)origdata;
				mb=data;
				for (n=0; n<count; n++)
					*mb++=(double)(*ma++);
			}
			break;
		case TIFF_SHORT:
			{
				uint16* ma;
				double* mb;
				uint32 n;
				ma=(uint16*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabShort(ma);
					*mb++=(double)(*ma++);
				}
			}
			break;
		case TIFF_SSHORT:
			{
				int16* ma;
				double* mb;
				uint32 n;
				ma=(int16*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabShort((uint16*)ma);
					*mb++=(double)(*ma++);
				}
			}
			break;
		case TIFF_LONG:
			{
				uint32* ma;
				double* mb;
				uint32 n;
				ma=(uint32*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong(ma);
					*mb++=(double)(*ma++);
				}
			}
			break;
		case TIFF_SLONG:
			{
				int32* ma;
				double* mb;
				uint32 n;
				ma=(int32*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong((uint32*)ma);
					*mb++=(double)(*ma++);
				}
			}
			break;
		case TIFF_LONG8:
			{
				uint64* ma;
				double* mb;
				uint32 n;
				ma=(uint64*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong8(ma);
#if defined(__WIN32__) && (_MSC_VER < 1500)
					*mb++ = _TIFFUInt64ToDouble(*ma++);
#else
					*mb++ = (double)(*ma++);
#endif
				}
			}
			break;
		case TIFF_SLONG8:
			{
				int64* ma;
				double* mb;
				uint32 n;
				ma=(int64*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong8((uint64*)ma);
					*mb++=(double)(*ma++);
				}
			}
			break;
		case TIFF_RATIONAL:
			{
				uint32* ma;
				uint32 maa;
				uint32 mab;
				double* mb;
				uint32 n;
				ma=(uint32*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong(ma);
					maa=*ma++;
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong(ma);
					mab=*ma++;
					if (mab==0)
						*mb++=0.0;
					else
						*mb++=(double)maa/(double)mab;
				}
			}
			break;
		case TIFF_SRATIONAL:
			{
				uint32* ma;
				int32 maa;
				uint32 mab;
				double* mb;
				uint32 n;
				ma=(uint32*)origdata;
				mb=data;
				for (n=0; n<count; n++)
				{
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong(ma);
					maa=*(int32*)ma;
					ma++;
					if (tif->tif_flags&TIFF_SWAB)
						TIFFSwabLong(ma);
					mab=*ma++;
					if (mab==0)
						*mb++=0.0;
					else
						*mb++=(double)maa/(double)mab;
				}
			}
			break;
		case TIFF_FLOAT:
			{
				float* ma;
				double* mb;
				uint32 n;
				if (tif->tif_flags&TIFF_SWAB)
					TIFFSwabArrayOfLong((uint32*)origdata,count);
				TIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);
				ma=(float*)origdata;
				mb=data;
				for (n=0; n<count; n++)
					*mb++=(double)(*ma++);
			}
			break;
	}
	_TIFFfree(origdata);
	if (err!=TIFFReadDirEntryErrOk)
	{
		_TIFFfree(data);
		return(err);
	}
	*value=data;
	return(TIFFReadDirEntryErrOk);
}
['static enum TIFFReadDirEntryErr\nTIFFReadDirEntryDoubleArray(TIFF* tif, TIFFDirEntry* direntry, double** value)\n{\n\tenum TIFFReadDirEntryErr err;\n\tuint32 count;\n\tvoid* origdata;\n\tdouble* data;\n\tswitch (direntry->tdir_type)\n\t{\n\t\tcase TIFF_BYTE:\n\t\tcase TIFF_SBYTE:\n\t\tcase TIFF_SHORT:\n\t\tcase TIFF_SSHORT:\n\t\tcase TIFF_LONG:\n\t\tcase TIFF_SLONG:\n\t\tcase TIFF_LONG8:\n\t\tcase TIFF_SLONG8:\n\t\tcase TIFF_RATIONAL:\n\t\tcase TIFF_SRATIONAL:\n\t\tcase TIFF_FLOAT:\n\t\tcase TIFF_DOUBLE:\n\t\t\tbreak;\n\t\tdefault:\n\t\t\treturn(TIFFReadDirEntryErrType);\n\t}\n\terr=TIFFReadDirEntryArray(tif,direntry,&count,8,&origdata);\n\tif ((err!=TIFFReadDirEntryErrOk)||(origdata==0))\n\t{\n\t\t*value=0;\n\t\treturn(err);\n\t}\n\tswitch (direntry->tdir_type)\n\t{\n\t\tcase TIFF_DOUBLE:\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabArrayOfLong8((uint64*)origdata,count);\n\t\t\tTIFFCvtIEEEDoubleToNative(tif,count,(double*)origdata);\n\t\t\t*value=(double*)origdata;\n\t\t\treturn(TIFFReadDirEntryErrOk);\n\t}\n\tdata=(double*)_TIFFmalloc(count*sizeof(double));\n\tif (data==0)\n\t{\n\t\t_TIFFfree(origdata);\n\t\treturn(TIFFReadDirEntryErrAlloc);\n\t}\n\tswitch (direntry->tdir_type)\n\t{\n\t\tcase TIFF_BYTE:\n\t\t\t{\n\t\t\t\tuint8* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint8*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SBYTE:\n\t\t\t{\n\t\t\t\tint8* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int8*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SHORT:\n\t\t\t{\n\t\t\t\tuint16* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint16*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabShort(ma);\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SSHORT:\n\t\t\t{\n\t\t\t\tint16* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int16*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabShort((uint16*)ma);\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_LONG:\n\t\t\t{\n\t\t\t\tuint32* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SLONG:\n\t\t\t{\n\t\t\t\tint32* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong((uint32*)ma);\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_LONG8:\n\t\t\t{\n\t\t\t\tuint64* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint64*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong8(ma);\n#if defined(__WIN32__) && (_MSC_VER < 1500)\n\t\t\t\t\t*mb++ = _TIFFUInt64ToDouble(*ma++);\n#else\n\t\t\t\t\t*mb++ = (double)(*ma++);\n#endif\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SLONG8:\n\t\t\t{\n\t\t\t\tint64* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(int64*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong8((uint64*)ma);\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_RATIONAL:\n\t\t\t{\n\t\t\t\tuint32* ma;\n\t\t\t\tuint32 maa;\n\t\t\t\tuint32 mab;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmaa=*ma++;\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmab=*ma++;\n\t\t\t\t\tif (mab==0)\n\t\t\t\t\t\t*mb++=0.0;\n\t\t\t\t\telse\n\t\t\t\t\t\t*mb++=(double)maa/(double)mab;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_SRATIONAL:\n\t\t\t{\n\t\t\t\tuint32* ma;\n\t\t\t\tint32 maa;\n\t\t\t\tuint32 mab;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tma=(uint32*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t{\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmaa=*(int32*)ma;\n\t\t\t\t\tma++;\n\t\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\t\tTIFFSwabLong(ma);\n\t\t\t\t\tmab=*ma++;\n\t\t\t\t\tif (mab==0)\n\t\t\t\t\t\t*mb++=0.0;\n\t\t\t\t\telse\n\t\t\t\t\t\t*mb++=(double)maa/(double)mab;\n\t\t\t\t}\n\t\t\t}\n\t\t\tbreak;\n\t\tcase TIFF_FLOAT:\n\t\t\t{\n\t\t\t\tfloat* ma;\n\t\t\t\tdouble* mb;\n\t\t\t\tuint32 n;\n\t\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\t\tTIFFSwabArrayOfLong((uint32*)origdata,count);\n\t\t\t\tTIFFCvtIEEEFloatToNative(tif,count,(float*)origdata);\n\t\t\t\tma=(float*)origdata;\n\t\t\t\tmb=data;\n\t\t\t\tfor (n=0; n<count; n++)\n\t\t\t\t\t*mb++=(double)(*ma++);\n\t\t\t}\n\t\t\tbreak;\n\t}\n\t_TIFFfree(origdata);\n\tif (err!=TIFFReadDirEntryErrOk)\n\t{\n\t\t_TIFFfree(data);\n\t\treturn(err);\n\t}\n\t*value=data;\n\treturn(TIFFReadDirEntryErrOk);\n}', 'static enum TIFFReadDirEntryErr TIFFReadDirEntryArray(TIFF* tif, TIFFDirEntry* direntry, uint32* count, uint32 desttypesize, void** value)\n{\n\tint typesize;\n\tuint32 datasize;\n\tvoid* data;\n\ttypesize=TIFFDataWidth(direntry->tdir_type);\n\tif ((direntry->tdir_count==0)||(typesize==0))\n\t{\n\t\t*value=0;\n\t\treturn(TIFFReadDirEntryErrOk);\n\t}\n        (void) desttypesize;\n#ifdef notdef\n\tif ((uint64)(4*1024*1024/typesize)<direntry->tdir_count)\n\t\treturn(TIFFReadDirEntryErrSizesan);\n\tif ((uint64)(4*1024*1024/desttypesize)<direntry->tdir_count)\n\t\treturn(TIFFReadDirEntryErrSizesan);\n#endif\n\t*count=(uint32)direntry->tdir_count;\n\tdatasize=(*count)*typesize;\n\tassert((tmsize_t)datasize>0);\n\tdata=_TIFFmalloc(datasize);\n\tif (data==0)\n\t\treturn(TIFFReadDirEntryErrAlloc);\n\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t{\n\t\tif (datasize<=4)\n\t\t\t_TIFFmemcpy(data,&direntry->tdir_offset,datasize);\n\t\telse\n\t\t{\n\t\t\tenum TIFFReadDirEntryErr err;\n\t\t\tuint32 offset = direntry->tdir_offset.toff_long;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabLong(&offset);\n\t\t\terr=TIFFReadDirEntryData(tif,(uint64)offset,(tmsize_t)datasize,data);\n\t\t\tif (err!=TIFFReadDirEntryErrOk)\n\t\t\t{\n\t\t\t\t_TIFFfree(data);\n\t\t\t\treturn(err);\n\t\t\t}\n\t\t}\n\t}\n\telse\n\t{\n\t\tif (datasize<=8)\n\t\t\t_TIFFmemcpy(data,&direntry->tdir_offset,datasize);\n\t\telse\n\t\t{\n\t\t\tenum TIFFReadDirEntryErr err;\n\t\t\tuint64 offset = direntry->tdir_offset.toff_long8;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabLong8(&offset);\n\t\t\terr=TIFFReadDirEntryData(tif,offset,(tmsize_t)datasize,data);\n\t\t\tif (err!=TIFFReadDirEntryErrOk)\n\t\t\t{\n\t\t\t\t_TIFFfree(data);\n\t\t\t\treturn(err);\n\t\t\t}\n\t\t}\n\t}\n\t*value=data;\n\treturn(TIFFReadDirEntryErrOk);\n}']