tools/tiffdump.c:490: error: Buffer Overrun L3
  Offset: [8, +oo] Size: [0, +oo] by call to `PrintData`.

tools/tiffdump.c:283:3: Assignment
281. 		if (swabflag)
282. 			TIFFSwabShort(&dircount);
283. 		direntrysize = 12;
       ^
284. 	} else {
285. 		uint64 dircount64;

tools/tiffdump.c:299:11: Call
297. 		direntrysize = 20;
298. 	}
299. 	dirmem = _TIFFmalloc(dircount * direntrysize);
               ^
300. 	if (dirmem == NULL) {
301. 		Fatal("No space for TIFF directory");

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

tools/tiffdump.c:299:2: Assignment
297. 		direntrysize = 20;
298. 	}
299. 	dirmem = _TIFFmalloc(dircount * direntrysize);
      ^
300. 	if (dirmem == NULL) {
301. 		Fatal("No space for TIFF directory");

tools/tiffdump.c:341:7: Assignment
339. 	    (unsigned long long)nextdiroff, (unsigned long long)nextdiroff);
340. #endif
341. 	for (dp = (uint8*)dirmem, n = dircount; n > 0; n--) {
           ^
342. 		uint16 tag;
343. 		uint16 type;

tools/tiffdump.c:354:3: Assignment
352. 		if (swabflag)
353. 			TIFFSwabShort(&tag);
354. 		dp += sizeof(uint16);
       ^
355. 		type = *(uint16*)dp;
356. 		dp += sizeof(uint16);

tools/tiffdump.c:356:3: Assignment
354. 		dp += sizeof(uint16);
355. 		type = *(uint16*)dp;
356. 		dp += sizeof(uint16);
       ^
357. 		if (swabflag)
358. 			TIFFSwabShort(&type);

tools/tiffdump.c:369:4: Assignment
367. 			if (swabflag)
368. 				TIFFSwabLong(&count32);
369. 			dp += sizeof(uint32);
        ^
370. 			count = count32;
371. 		}

tools/tiffdump.c:390:3: Assignment
388. 		datasize = count*typewidth;
389. 		datafits = 1;
390. 		datamem = dp;
       ^
391. 		dataoffset = 0;
392. 		datatruncated = 0;

tools/tiffdump.c:490:4: Call
488. 				}
489. 			}
490. 			PrintData(stdout,type,(uint32)count,datamem);
        ^
491. 			if (datatruncated)
492. 				printf(" ...");

tools/tiffdump.c:672:1: Parameter `*data`
  670. }
  671. 
  672. static void
       ^
  673. PrintData(FILE* fd, uint16 type, uint32 count, unsigned char* data)
  674. {

tools/tiffdump.c:691:3: Call
  689. 		break;
  690. 	case TIFF_ASCII:
  691. 		PrintASCII(fd, count, data);
         ^
  692. 		break;
  693. 	case TIFF_SHORT: {

tools/tiffdump.c:650:1: <Length trace>
648. #include <ctype.h>
649. 
650. static void
     ^
651. PrintASCII(FILE* fd, uint32 cc, const unsigned char* cp)
652. {

tools/tiffdump.c:650:1: Parameter `*cp`
    648. #include <ctype.h>
    649. 
    650. static void
         ^
    651. PrintASCII(FILE* fd, uint32 cc, const unsigned char* cp)
    652. {

tools/tiffdump.c:656:7: Array access: Offset: [8, +oo] Size: [0, +oo] by call to `PrintData` 
    654. 		const char* tp;
    655. 
    656. 		if (isprint(*cp)) {
               ^
    657. 			fputc(*cp, fd);
    658. 			continue;

static void
PrintASCII(FILE* fd, uint32 cc, const unsigned char* cp)
{
	for (; cc > 0; cc--, cp++) {
		const char* tp;
		if (isprint(*cp)) {
			fputc(*cp, fd);
			continue;
		}
		for (tp = "\tt\bb\rr\nn\vv"; *tp; tp++)
			if (*tp++ == *cp)
				break;
		if (*tp)
			fprintf(fd, "\\%c", *tp);
		else if (*cp)
			fprintf(fd, "\\%03o", *cp);
		else
			fprintf(fd, "\\0");
	}
}
['static uint64\nReadDirectory(int fd, unsigned int ix, uint64 off)\n{\n\tuint16 dircount;\n\tuint32 direntrysize;\n\tvoid* dirmem = NULL;\n\tuint64 nextdiroff;\n\tuint32 n;\n\tuint8* dp;\n\tif (off == 0)\n\t\tgoto done;\n#if defined(__WIN32__) && defined(_MSC_VER)\n\tif (_lseeki64(fd, (__int64)off, SEEK_SET) != (__int64)off) {\n#else\n\tif (lseek(fd, (off_t)off, SEEK_SET) != (off_t)off) {\n#endif\n\t\tFatal("Seek error accessing TIFF directory");\n\t\tgoto done;\n\t}\n\tif (!bigtiff) {\n\t\tif (read(fd, (char*) &dircount, sizeof (uint16)) != sizeof (uint16)) {\n\t\t\tReadError("directory count");\n\t\t\tgoto done;\n\t\t}\n\t\tif (swabflag)\n\t\t\tTIFFSwabShort(&dircount);\n\t\tdirentrysize = 12;\n\t} else {\n\t\tuint64 dircount64;\n\t\tif (read(fd, (char*) &dircount64, sizeof (uint64)) != sizeof (uint64)) {\n\t\t\tReadError("directory count");\n\t\t\tgoto done;\n\t\t}\n\t\tif (swabflag)\n\t\t\tTIFFSwabLong8(&dircount64);\n\t\tif (dircount64>0xFFFF) {\n\t\t\tError("Sanity check on directory count failed");\n\t\t\tgoto done;\n\t\t}\n\t\tdircount = (uint16)dircount64;\n\t\tdirentrysize = 20;\n\t}\n\tdirmem = _TIFFmalloc(dircount * direntrysize);\n\tif (dirmem == NULL) {\n\t\tFatal("No space for TIFF directory");\n\t\tgoto done;\n\t}\n\tn = read(fd, (char*) dirmem, dircount*direntrysize);\n\tif (n != dircount*direntrysize) {\n\t\tn /= direntrysize;\n\t\tError(\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t    "Could only read %lu of %u entries in directory at offset %#I64x",\n\t\t      (unsigned long)n, dircount, (unsigned __int64) off);\n#else\n\t    "Could only read %lu of %u entries in directory at offset %#llx",\n\t\t      (unsigned long)n, dircount, (unsigned long long) off);\n#endif\n\t\tdircount = n;\n\t\tnextdiroff = 0;\n\t} else {\n\t\tif (!bigtiff) {\n\t\t\tuint32 nextdiroff32;\n\t\t\tif (read(fd, (char*) &nextdiroff32, sizeof (uint32)) != sizeof (uint32))\n\t\t\t\tnextdiroff32 = 0;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong(&nextdiroff32);\n\t\t\tnextdiroff = nextdiroff32;\n\t\t} else {\n\t\t\tif (read(fd, (char*) &nextdiroff, sizeof (uint64)) != sizeof (uint64))\n\t\t\t\tnextdiroff = 0;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong8(&nextdiroff);\n\t\t}\n\t}\n#if defined(__WIN32__) && defined(_MSC_VER)\n\tprintf("Directory %u: offset %I64u (%#I64x) next %I64u (%#I64x)\\n", ix,\n\t    (unsigned __int64)off, (unsigned __int64)off,\n\t    (unsigned __int64)nextdiroff, (unsigned __int64)nextdiroff);\n#else\n\tprintf("Directory %u: offset %llu (%#llx) next %llu (%#llx)\\n", ix,\n\t    (unsigned long long)off, (unsigned long long)off,\n\t    (unsigned long long)nextdiroff, (unsigned long long)nextdiroff);\n#endif\n\tfor (dp = (uint8*)dirmem, n = dircount; n > 0; n--) {\n\t\tuint16 tag;\n\t\tuint16 type;\n\t\tuint16 typewidth;\n\t\tuint64 count;\n\t\tuint64 datasize;\n\t\tint datafits;\n\t\tvoid* datamem;\n\t\tuint64 dataoffset;\n\t\tint datatruncated;\n\t\ttag = *(uint16*)dp;\n\t\tif (swabflag)\n\t\t\tTIFFSwabShort(&tag);\n\t\tdp += sizeof(uint16);\n\t\ttype = *(uint16*)dp;\n\t\tdp += sizeof(uint16);\n\t\tif (swabflag)\n\t\t\tTIFFSwabShort(&type);\n\t\tPrintTag(stdout, tag);\n\t\tputchar(\' \');\n\t\tPrintType(stdout, type);\n\t\tputchar(\' \');\n\t\tif (!bigtiff)\n\t\t{\n\t\t\tuint32 count32;\n\t\t\tcount32 = *(uint32*)dp;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong(&count32);\n\t\t\tdp += sizeof(uint32);\n\t\t\tcount = count32;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tcount = *(uint64*)dp;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong8(&count);\n\t\t\tdp += sizeof(uint64);\n\t\t}\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\tprintf("%I64u<", (unsigned __int64)count);\n#else\n\t\tprintf("%llu<", (unsigned long long)count);\n#endif\n\t\tif (type >= NWIDTHS)\n\t\t\ttypewidth = 0;\n\t\telse\n\t\t\ttypewidth = datawidth[type];\n\t\tdatasize = count*typewidth;\n\t\tdatafits = 1;\n\t\tdatamem = dp;\n\t\tdataoffset = 0;\n\t\tdatatruncated = 0;\n\t\tif (!bigtiff)\n\t\t{\n\t\t\tif (datasize>4)\n\t\t\t{\n\t\t\t\tuint32 dataoffset32;\n\t\t\t\tdatafits = 0;\n\t\t\t\tdatamem = NULL;\n\t\t\t\tdataoffset32 = *(uint32*)dp;\n\t\t\t\tif (swabflag)\n\t\t\t\t\tTIFFSwabLong(&dataoffset32);\n\t\t\t\tdataoffset = dataoffset32;\n\t\t\t}\n\t\t\tdp += sizeof(uint32);\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif (datasize>8)\n\t\t\t{\n\t\t\t\tdatafits = 0;\n\t\t\t\tdatamem = NULL;\n\t\t\t\tdataoffset = *(uint64*)dp;\n\t\t\t\tif (swabflag)\n\t\t\t\t\tTIFFSwabLong8(&dataoffset);\n\t\t\t}\n\t\t\tdp += sizeof(uint64);\n\t\t}\n\t\tif (datasize>0x10000)\n\t\t{\n\t\t\tdatatruncated = 1;\n\t\t\tcount = 0x10000/typewidth;\n\t\t\tdatasize = count*typewidth;\n\t\t}\n\t\tif (count>maxitems)\n\t\t{\n\t\t\tdatatruncated = 1;\n\t\t\tcount = maxitems;\n\t\t\tdatasize = count*typewidth;\n\t\t}\n\t\tif (!datafits)\n\t\t{\n\t\t\tdatamem = _TIFFmalloc((uint32)datasize);\n\t\t\tif (datamem) {\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\t\tif (_lseeki64(fd, (__int64)dataoffset, SEEK_SET)\n\t\t\t\t    != (__int64)dataoffset) {\n#else\n\t\t\t\tif (lseek(fd, (off_t)dataoffset, 0) !=\n\t\t\t\t    (off_t)dataoffset) {\n#endif\n\t\t\t\t\tError(\n\t\t\t\t"Seek error accessing tag %u value", tag);\n\t\t\t\t\t_TIFFfree(datamem);\n\t\t\t\t\tdatamem = NULL;\n\t\t\t\t}\n\t\t\t\tif (read(fd, datamem, datasize) != (TIFF_SSIZE_T)datasize)\n\t\t\t\t{\n\t\t\t\t\tError(\n\t\t\t\t"Read error accessing tag %u value", tag);\n\t\t\t\t\t_TIFFfree(datamem);\n\t\t\t\t\tdatamem = NULL;\n\t\t\t\t}\n\t\t\t} else\n\t\t\t\tError("No space for data for tag %u",tag);\n\t\t}\n\t\tif (datamem)\n\t\t{\n\t\t\tif (swabflag)\n\t\t\t{\n\t\t\t\tswitch (type)\n\t\t\t\t{\n\t\t\t\t\tcase TIFF_BYTE:\n\t\t\t\t\tcase TIFF_ASCII:\n\t\t\t\t\tcase TIFF_SBYTE:\n\t\t\t\t\tcase TIFF_UNDEFINED:\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_SHORT:\n\t\t\t\t\tcase TIFF_SSHORT:\n\t\t\t\t\t\tTIFFSwabArrayOfShort((uint16*)datamem,count);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_LONG:\n\t\t\t\t\tcase TIFF_SLONG:\n\t\t\t\t\tcase TIFF_FLOAT:\n\t\t\t\t\tcase TIFF_IFD:\n\t\t\t\t\t\tTIFFSwabArrayOfLong((uint32*)datamem,count);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_RATIONAL:\n\t\t\t\t\tcase TIFF_SRATIONAL:\n\t\t\t\t\t\tTIFFSwabArrayOfLong((uint32*)datamem,count*2);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_DOUBLE:\n\t\t\t\t\tcase TIFF_LONG8:\n\t\t\t\t\tcase TIFF_SLONG8:\n\t\t\t\t\tcase TIFF_IFD8:\n\t\t\t\t\t\tTIFFSwabArrayOfLong8((uint64*)datamem,count);\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tPrintData(stdout,type,(uint32)count,datamem);\n\t\t\tif (datatruncated)\n\t\t\t\tprintf(" ...");\n\t\t\tif (!datafits)\n\t\t\t\t_TIFFfree(datamem);\n\t\t}\n\t\tprintf(">\\n");\n\t}\ndone:\n\tif (dirmem)\n\t\t_TIFFfree((char *)dirmem);\n\treturn (nextdiroff);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n\treturn (malloc((size_t) s));\n}', 'static void\nPrintData(FILE* fd, uint16 type, uint32 count, unsigned char* data)\n{\n\tchar* sep = "";\n\tswitch (type) {\n\tcase TIFF_BYTE:\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, bytefmt, sep, *data++), sep = " ";\n\t\tbreak;\n\tcase TIFF_SBYTE:\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, sbytefmt, sep, *(char *)data++), sep = " ";\n\t\tbreak;\n\tcase TIFF_UNDEFINED:\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, bytefmt, sep, *data++), sep = " ";\n\t\tbreak;\n\tcase TIFF_ASCII:\n\t\tPrintASCII(fd, count, data);\n\t\tbreak;\n\tcase TIFF_SHORT: {\n\t\tuint16 *wp = (uint16*)data;\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, shortfmt, sep, *wp++), sep = " ";\n\t\tbreak;\n\t}\n\tcase TIFF_SSHORT: {\n\t\tint16 *wp = (int16*)data;\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, sshortfmt, sep, *wp++), sep = " ";\n\t\tbreak;\n\t}\n\tcase TIFF_LONG: {\n\t\tuint32 *lp = (uint32*)data;\n\t\twhile (count-- > 0) {\n\t\t\tfprintf(fd, longfmt, sep, (unsigned long) *lp++);\n\t\t\tsep = " ";\n\t\t}\n\t\tbreak;\n\t}\n\tcase TIFF_SLONG: {\n\t\tint32 *lp = (int32*)data;\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, slongfmt, sep, (long) *lp++), sep = " ";\n\t\tbreak;\n\t}\n\tcase TIFF_LONG8: {\n\t\tuint64 *llp = (uint64*)data;\n\t\twhile (count-- > 0) {\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\tfprintf(fd, long8fmt, sep, (unsigned __int64) *llp++);\n#else\n\t\t\tfprintf(fd, long8fmt, sep, (unsigned long long) *llp++);\n#endif\n\t\t\tsep = " ";\n\t\t}\n\t\tbreak;\n\t}\n\tcase TIFF_SLONG8: {\n\t\tint64 *llp = (int64*)data;\n\t\twhile (count-- > 0)\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\tfprintf(fd, slong8fmt, sep, (__int64) *llp++), sep = " ";\n#else\n\t\t\tfprintf(fd, slong8fmt, sep, (long long) *llp++), sep = " ";\n#endif\n\t\tbreak;\n\t}\n\tcase TIFF_RATIONAL: {\n\t\tuint32 *lp = (uint32*)data;\n\t\twhile (count-- > 0) {\n\t\t\tif (lp[1] == 0)\n\t\t\t\tfprintf(fd, "%sNan (%lu/%lu)", sep,\n\t\t\t\t    (unsigned long) lp[0],\n\t\t\t\t    (unsigned long) lp[1]);\n\t\t\telse\n\t\t\t\tfprintf(fd, rationalfmt, sep,\n\t\t\t\t    (double)lp[0] / (double)lp[1]);\n\t\t\tsep = " ";\n\t\t\tlp += 2;\n\t\t}\n\t\tbreak;\n\t}\n\tcase TIFF_SRATIONAL: {\n\t\tint32 *lp = (int32*)data;\n\t\twhile (count-- > 0) {\n\t\t\tif (lp[1] == 0)\n\t\t\t\tfprintf(fd, "%sNan (%ld/%ld)", sep,\n\t\t\t\t    (long) lp[0], (long) lp[1]);\n\t\t\telse\n\t\t\t\tfprintf(fd, srationalfmt, sep,\n\t\t\t\t    (double)lp[0] / (double)lp[1]);\n\t\t\tsep = " ";\n\t\t\tlp += 2;\n\t\t}\n\t\tbreak;\n\t}\n\tcase TIFF_FLOAT: {\n\t\tfloat *fp = (float *)data;\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, floatfmt, sep, *fp++), sep = " ";\n\t\tbreak;\n\t}\n\tcase TIFF_DOUBLE: {\n\t\tdouble *dp = (double *)data;\n\t\twhile (count-- > 0)\n\t\t\tfprintf(fd, doublefmt, sep, *dp++), sep = " ";\n\t\tbreak;\n\t}\n\tcase TIFF_IFD: {\n\t\tuint32 *lp = (uint32*)data;\n\t\twhile (count-- > 0) {\n\t\t\tfprintf(fd, ifdfmt, sep, (unsigned long) *lp++);\n\t\t\tsep = " ";\n\t\t}\n\t\tbreak;\n\t}\n\tcase TIFF_IFD8: {\n\t\tuint64 *llp = (uint64*)data;\n\t\twhile (count-- > 0) {\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\tfprintf(fd, ifd8fmt, sep, (unsigned __int64) *llp++);\n#else\n\t\t\tfprintf(fd, ifd8fmt, sep, (unsigned long long) *llp++);\n#endif\n\t\t\tsep = " ";\n\t\t}\n\t\tbreak;\n\t}\n\t}\n}', 'static void\nPrintASCII(FILE* fd, uint32 cc, const unsigned char* cp)\n{\n\tfor (; cc > 0; cc--, cp++) {\n\t\tconst char* tp;\n\t\tif (isprint(*cp)) {\n\t\t\tfputc(*cp, fd);\n\t\t\tcontinue;\n\t\t}\n\t\tfor (tp = "\\tt\\bb\\rr\\nn\\vv"; *tp; tp++)\n\t\t\tif (*tp++ == *cp)\n\t\t\t\tbreak;\n\t\tif (*tp)\n\t\t\tfprintf(fd, "\\\\%c", *tp);\n\t\telse if (*cp)\n\t\t\tfprintf(fd, "\\\\%03o", *cp);\n\t\telse\n\t\t\tfprintf(fd, "\\\\0");\n\t}\n}']