libtiff/tif_dirinfo.c:856: error: Buffer Overrun S2
  Offset: `tif->tif_nfieldscompat` Size: [0, +oo].

libtiff/tif_dirinfo.c:827:1: <Offset trace>
825. }
826. 
827. int
     ^
828. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
829. {

libtiff/tif_dirinfo.c:827:1: Parameter `tif->tif_nfieldscompat`
825. }
826. 
827. int
     ^
828. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
829. {

libtiff/tif_dirinfo.c:851:2: Assignment
849. 		return -1;
850. 	}
851. 	nfields = tif->tif_nfieldscompat++;
      ^
852. 
853. 	tif->tif_fieldscompat[nfields].type = tfiatOther;

libtiff/tif_dirinfo.c:827:1: <Length trace>
825. }
826. 
827. int
     ^
828. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
829. {

libtiff/tif_dirinfo.c:827:1: Parameter `*tif->tif_fieldscompat`
825. }
826. 
827. int
     ^
828. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
829. {

libtiff/tif_dirinfo.c:838:4: Call
836. 	if (tif->tif_nfieldscompat > 0) {
837. 		tif->tif_fieldscompat = (TIFFFieldArray *)
838. 			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
        ^
839. 					  tif->tif_nfieldscompat + 1,
840. 					  sizeof(TIFFFieldArray), reason);

libtiff/tif_aux.c:66:2: Assignment
  64. 		  tmsize_t nmemb, tmsize_t elem_size, const char* what)
  65. {
  66. 	void* cp = NULL;
       ^
  67. 	tmsize_t bytes = nmemb * elem_size;
  68. 

libtiff/tif_aux.c:82:2: Assignment
  80. 	}
  81. 
  82. 	return cp;
       ^
  83. }
  84. 

libtiff/tif_dirinfo.c:837:3: Assignment
835. 
836. 	if (tif->tif_nfieldscompat > 0) {
837. 		tif->tif_fieldscompat = (TIFFFieldArray *)
       ^
838. 			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
839. 					  tif->tif_nfieldscompat + 1,

libtiff/tif_dirinfo.c:856:2: Array access: Offset: tif->tif_nfieldscompat Size: [0, +oo]
854. 	tif->tif_fieldscompat[nfields].allocated_size = n;
855. 	tif->tif_fieldscompat[nfields].count = n;
856. 	tif->tif_fieldscompat[nfields].fields =
      ^
857. 		(TIFFField *)_TIFFCheckMalloc(tif, n, sizeof(TIFFField),
858. 					      reason);

int
TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
{
	static const char module[] = "TIFFMergeFieldInfo";
	static const char reason[] = "for fields array";
	TIFFField *tp;
	size_t nfields;
	uint32 i;
	if (tif->tif_nfieldscompat > 0) {
		tif->tif_fieldscompat = (TIFFFieldArray *)
			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
					  tif->tif_nfieldscompat + 1,
					  sizeof(TIFFFieldArray), reason);
	} else {
		tif->tif_fieldscompat = (TIFFFieldArray *)
			_TIFFCheckMalloc(tif, 1, sizeof(TIFFFieldArray),
					 reason);
	}
	if (!tif->tif_fieldscompat) {
		TIFFErrorExt(tif->tif_clientdata, module,
			     "Failed to allocate fields array");
		return -1;
	}
	nfields = tif->tif_nfieldscompat++;
	tif->tif_fieldscompat[nfields].type = tfiatOther;
	tif->tif_fieldscompat[nfields].allocated_size = n;
	tif->tif_fieldscompat[nfields].count = n;
	tif->tif_fieldscompat[nfields].fields =
		(TIFFField *)_TIFFCheckMalloc(tif, n, sizeof(TIFFField),
					      reason);
	if (!tif->tif_fieldscompat[nfields].fields) {
		TIFFErrorExt(tif->tif_clientdata, module,
			     "Failed to allocate fields array");
		return -1;
	}
	tp = tif->tif_fieldscompat[nfields].fields;
	for (i = 0; i < n; i++) {
		tp->field_tag = info[i].field_tag;
		tp->field_readcount = info[i].field_readcount;
		tp->field_writecount = info[i].field_writecount;
		tp->field_type = info[i].field_type;
		tp->reserved = 0;
		tp->set_field_type =
		     _TIFFSetGetType(info[i].field_type,
				info[i].field_readcount,
				info[i].field_passcount);
		tp->get_field_type =
		     _TIFFSetGetType(info[i].field_type,
				info[i].field_readcount,
				info[i].field_passcount);
		tp->field_bit = info[i].field_bit;
		tp->field_oktochange = info[i].field_oktochange;
		tp->field_passcount = info[i].field_passcount;
		tp->field_name = info[i].field_name;
		tp->field_subfields = NULL;
		tp++;
	}
	if (!_TIFFMergeFields(tif, tif->tif_fieldscompat[nfields].fields, n)) {
		TIFFErrorExt(tif->tif_clientdata, module,
			     "Setting up field info failed");
		return -1;
	}
	return 0;
}
['int\nTIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)\n{\n\tstatic const char module[] = "TIFFMergeFieldInfo";\n\tstatic const char reason[] = "for fields array";\n\tTIFFField *tp;\n\tsize_t nfields;\n\tuint32 i;\n\tif (tif->tif_nfieldscompat > 0) {\n\t\ttif->tif_fieldscompat = (TIFFFieldArray *)\n\t\t\t_TIFFCheckRealloc(tif, tif->tif_fieldscompat,\n\t\t\t\t\t  tif->tif_nfieldscompat + 1,\n\t\t\t\t\t  sizeof(TIFFFieldArray), reason);\n\t} else {\n\t\ttif->tif_fieldscompat = (TIFFFieldArray *)\n\t\t\t_TIFFCheckMalloc(tif, 1, sizeof(TIFFFieldArray),\n\t\t\t\t\t reason);\n\t}\n\tif (!tif->tif_fieldscompat) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t     "Failed to allocate fields array");\n\t\treturn -1;\n\t}\n\tnfields = tif->tif_nfieldscompat++;\n\ttif->tif_fieldscompat[nfields].type = tfiatOther;\n\ttif->tif_fieldscompat[nfields].allocated_size = n;\n\ttif->tif_fieldscompat[nfields].count = n;\n\ttif->tif_fieldscompat[nfields].fields =\n\t\t(TIFFField *)_TIFFCheckMalloc(tif, n, sizeof(TIFFField),\n\t\t\t\t\t      reason);\n\tif (!tif->tif_fieldscompat[nfields].fields) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t     "Failed to allocate fields array");\n\t\treturn -1;\n\t}\n\ttp = tif->tif_fieldscompat[nfields].fields;\n\tfor (i = 0; i < n; i++) {\n\t\ttp->field_tag = info[i].field_tag;\n\t\ttp->field_readcount = info[i].field_readcount;\n\t\ttp->field_writecount = info[i].field_writecount;\n\t\ttp->field_type = info[i].field_type;\n\t\ttp->reserved = 0;\n\t\ttp->set_field_type =\n\t\t     _TIFFSetGetType(info[i].field_type,\n\t\t\t\tinfo[i].field_readcount,\n\t\t\t\tinfo[i].field_passcount);\n\t\ttp->get_field_type =\n\t\t     _TIFFSetGetType(info[i].field_type,\n\t\t\t\tinfo[i].field_readcount,\n\t\t\t\tinfo[i].field_passcount);\n\t\ttp->field_bit = info[i].field_bit;\n\t\ttp->field_oktochange = info[i].field_oktochange;\n\t\ttp->field_passcount = info[i].field_passcount;\n\t\ttp->field_name = info[i].field_name;\n\t\ttp->field_subfields = NULL;\n\t\ttp++;\n\t}\n\tif (!_TIFFMergeFields(tif, tif->tif_fieldscompat[nfields].fields, n)) {\n\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t     "Setting up field info failed");\n\t\treturn -1;\n\t}\n\treturn 0;\n}', 'void*\n_TIFFCheckRealloc(TIFF* tif, void* buffer,\n\t\t  tmsize_t nmemb, tmsize_t elem_size, const char* what)\n{\n\tvoid* cp = NULL;\n\ttmsize_t bytes = nmemb * elem_size;\n\tif (nmemb && elem_size && bytes / elem_size == nmemb)\n\t\tcp = _TIFFrealloc(buffer, bytes);\n\tif (cp == NULL) {\n\t\tTIFFErrorExt(tif->tif_clientdata, tif->tif_name,\n\t\t\t     "Failed to allocate memory for %s "\n\t\t\t     "(%ld elements of %ld bytes each)",\n\t\t\t     what,(long) nmemb, (long) elem_size);\n\t}\n\treturn cp;\n}']