libtiff/tif_dirwrite.c:1916: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray`.

libtiff/tif_dirwrite.c:1892:3: Assignment
1890. 	 */
1891. 	if (n>3)
1892. 		n=3;
        ^
1893. 	if (n==3)
1894. 	{

libtiff/tif_dirwrite.c:1905:4: Call
1903. 	if (n==0)
1904. 		n=1;
1905. 	o=_TIFFmalloc(n*m*sizeof(uint16));
         ^
1906. 	if (o==NULL)
1907. 	{

libtiff/tif_unix.c:314:17: Assignment
  312. {
  313.         if (s == 0)
  314.                 return ((void *) NULL);
                       ^
  315. 
  316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1905:2: Assignment
1903. 	if (n==0)
1904. 		n=1;
1905. 	o=_TIFFmalloc(n*m*sizeof(uint16));
       ^
1906. 	if (o==NULL)
1907. 	{

libtiff/tif_dirwrite.c:1916:4: Call
1914. 	if (n>2)
1915. 		_TIFFmemcpy(&o[2*m],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16));
1916. 	p=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,TIFFTAG_TRANSFERFUNCTION,n*m,o);
         ^
1917. 	_TIFFfree(o);
1918. 	return(p);

libtiff/tif_dirwrite.c:2043:1: Parameter `*value`
  2041. }
  2042. 
  2043. static int
        ^
  2044. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
  2045. {

libtiff/tif_dirwrite.c:2049:3: Call
  2047. 	assert(sizeof(uint16)==2);
  2048. 	if (tif->tif_flags&TIFF_SWAB)
  2049. 		TIFFSwabArrayOfShort(value,count);
          ^
  2050. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
  2051. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfShort)
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
    70. 
    71. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfShort)
    72. void
        ^
    73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
    74. {

libtiff/tif_swab.c:80:3: Assignment
    78. 	/* XXX unroll loop some */
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
          ^
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
    82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray` 
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
              ^
    82. 		wp++;
    83. 	}

void
TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
{
	register unsigned char* cp;
	register unsigned char t;
	assert(sizeof(uint16)==2);
	while (n-- > 0) {
		cp = (unsigned char*) wp;
		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
		wp++;
	}
}
['static int\nTIFFWriteDirectoryTagTransferfunction(TIFF* tif, uint32* ndir, TIFFDirEntry* dir)\n{\n\tstatic const char module[] = "TIFFWriteDirectoryTagTransferfunction";\n\tuint32 m;\n\tuint16 n;\n\tuint16* o;\n\tint p;\n\tif (dir==NULL)\n\t{\n\t\t(*ndir)++;\n\t\treturn(1);\n\t}\n\tm=(1<<tif->tif_dir.td_bitspersample);\n\tn=tif->tif_dir.td_samplesperpixel-tif->tif_dir.td_extrasamples;\n\tif (n>3)\n\t\tn=3;\n\tif (n==3)\n\t{\n\t\tif (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))\n\t\t\tn=2;\n\t}\n\tif (n==2)\n\t{\n\t\tif (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))\n\t\t\tn=1;\n\t}\n\tif (n==0)\n\t\tn=1;\n\to=_TIFFmalloc(n*m*sizeof(uint16));\n\tif (o==NULL)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Out of memory");\n\t\treturn(0);\n\t}\n\t_TIFFmemcpy(&o[0],tif->tif_dir.td_transferfunction[0],m*sizeof(uint16));\n\tif (n>1)\n\t\t_TIFFmemcpy(&o[m],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16));\n\tif (n>2)\n\t\t_TIFFmemcpy(&o[2*m],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16));\n\tp=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,TIFFTAG_TRANSFERFUNCTION,n*m,o);\n\t_TIFFfree(o);\n\treturn(p);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}', 'static int\nTIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)\n{\n\tassert(count<0x80000000);\n\tassert(sizeof(uint16)==2);\n\tif (tif->tif_flags&TIFF_SWAB)\n\t\tTIFFSwabArrayOfShort(value,count);\n\treturn(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));\n}', 'void\nTIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)\n{\n\tregister unsigned char* cp;\n\tregister unsigned char t;\n\tassert(sizeof(uint16)==2);\n\twhile (n-- > 0) {\n\t\tcp = (unsigned char*) wp;\n\t\tt = cp[1]; cp[1] = cp[0]; cp[0] = t;\n\t\twp++;\n\t}\n}']