tools/tiffdump.c:490: error: Buffer Overrun L3
  Offset: [71, +oo] (⇐ [64, +oo] + 7) Size: [0, +oo] by call to `TIFFSwabArrayOfLong8`.

tools/tiffdump.c:287:3: Assignment
285. 		if (swabflag)
286. 			TIFFSwabShort(&dircount);
287. 		direntrysize = 12;
       ^
288. 	} else {
289. 		uint64 dircount64;

tools/tiffdump.c:303:11: Call
301. 		direntrysize = 20;
302. 	}
303. 	dirmem = _TIFFmalloc(dircount * direntrysize);
               ^
304. 	if (dirmem == NULL) {
305. 		Fatal("No space for TIFF directory");

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

tools/tiffdump.c:303:2: Assignment
301. 		direntrysize = 20;
302. 	}
303. 	dirmem = _TIFFmalloc(dircount * direntrysize);
      ^
304. 	if (dirmem == NULL) {
305. 		Fatal("No space for TIFF directory");

tools/tiffdump.c:345:7: Assignment
343. 	    (unsigned long long)nextdiroff, (unsigned long long)nextdiroff);
344. #endif
345. 	for (dp = (uint8*)dirmem, n = dircount; n > 0; n--) {
           ^
346. 		uint16 tag;
347. 		uint16 type;

tools/tiffdump.c:358:3: Assignment
356. 		if (swabflag)
357. 			TIFFSwabShort(&tag);
358. 		dp += sizeof(uint16);
       ^
359. 		type = *(uint16*)dp;
360. 		dp += sizeof(uint16);

tools/tiffdump.c:360:3: Assignment
358. 		dp += sizeof(uint16);
359. 		type = *(uint16*)dp;
360. 		dp += sizeof(uint16);
       ^
361. 		if (swabflag)
362. 			TIFFSwabShort(&type);

tools/tiffdump.c:373:4: Assignment
371. 			if (swabflag)
372. 				TIFFSwabLong(&count32);
373. 			dp += sizeof(uint32);
        ^
374. 			count = count32;
375. 		}

tools/tiffdump.c:394:3: Assignment
392. 		datasize = count*typewidth;
393. 		datafits = 1;
394. 		datamem = dp;
       ^
395. 		dataoffset = 0;
396. 		datatruncated = 0;

tools/tiffdump.c:490:7: Call
488. 					case TIFF_SLONG8:
489. 					case TIFF_IFD8:
490. 						TIFFSwabArrayOfLong8((uint64*)datamem,(tmsize_t)count);
           ^
491. 						break;
492. 				}

libtiff/tif_swab.c:121:1: <Length trace>
119. 
120. #ifndef TIFFSwabArrayOfLong8
121. void
     ^
122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
123. {

libtiff/tif_swab.c:121:1: Parameter `*lp`
  119. 
  120. #ifndef TIFFSwabArrayOfLong8
  121. void
       ^
  122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
  123. {

libtiff/tif_swab.c:129:3: Assignment
  127. 	/* XXX unroll loop some */
  128. 	while (n-- > 0) {
  129. 		cp = (unsigned char *)lp;
         ^
  130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
  131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:130:7: Array access: Offset: [71, +oo] (⇐ [64, +oo] + 7) Size: [0, +oo] by call to `TIFFSwabArrayOfLong8` 
  128. 	while (n-- > 0) {
  129. 		cp = (unsigned char *)lp;
  130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
             ^
  131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
  132. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;

void
TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
{
	register unsigned char *cp;
	register unsigned char t;
	assert(sizeof(uint64)==8);
	while (n-- > 0) {
		cp = (unsigned char *)lp;
		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
		t = cp[4]; cp[4] = cp[3]; cp[3] = t;
		lp++;
	}
}
['static uint64\nReadDirectory(int fd, unsigned int ix, uint64 off)\n{\n\tuint16 dircount;\n\tuint32 direntrysize;\n\tvoid* dirmem = NULL;\n\tuint64 nextdiroff;\n\tuint32 n;\n\tuint8* dp;\n\tif (off == 0)\n\t\tgoto done;\n#if defined(__WIN32__) && defined(_MSC_VER)\n\tif (_lseeki64(fd, (__int64)off, SEEK_SET) != (__int64)off) {\n#else\n\tif (lseek(fd, (off_t)off, SEEK_SET) != (off_t)off) {\n#endif\n\t\tFatal("Seek error accessing TIFF directory");\n\t\tgoto done;\n\t}\n\tif (!bigtiff) {\n\t\tif (read(fd, (char*) &dircount, sizeof (uint16)) != sizeof (uint16)) {\n\t\t\tReadError("directory count");\n\t\t\tgoto done;\n\t\t}\n\t\tif (swabflag)\n\t\t\tTIFFSwabShort(&dircount);\n\t\tdirentrysize = 12;\n\t} else {\n\t\tuint64 dircount64;\n\t\tif (read(fd, (char*) &dircount64, sizeof (uint64)) != sizeof (uint64)) {\n\t\t\tReadError("directory count");\n\t\t\tgoto done;\n\t\t}\n\t\tif (swabflag)\n\t\t\tTIFFSwabLong8(&dircount64);\n\t\tif (dircount64>0xFFFF) {\n\t\t\tError("Sanity check on directory count failed");\n\t\t\tgoto done;\n\t\t}\n\t\tdircount = (uint16)dircount64;\n\t\tdirentrysize = 20;\n\t}\n\tdirmem = _TIFFmalloc(dircount * direntrysize);\n\tif (dirmem == NULL) {\n\t\tFatal("No space for TIFF directory");\n\t\tgoto done;\n\t}\n\tn = read(fd, (char*) dirmem, dircount*direntrysize);\n\tif (n != dircount*direntrysize) {\n\t\tn /= direntrysize;\n\t\tError(\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t    "Could only read %lu of %u entries in directory at offset %#I64x",\n\t\t      (unsigned long)n, dircount, (unsigned __int64) off);\n#else\n\t    "Could only read %lu of %u entries in directory at offset %#llx",\n\t\t      (unsigned long)n, dircount, (unsigned long long) off);\n#endif\n\t\tdircount = n;\n\t\tnextdiroff = 0;\n\t} else {\n\t\tif (!bigtiff) {\n\t\t\tuint32 nextdiroff32;\n\t\t\tif (read(fd, (char*) &nextdiroff32, sizeof (uint32)) != sizeof (uint32))\n\t\t\t\tnextdiroff32 = 0;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong(&nextdiroff32);\n\t\t\tnextdiroff = nextdiroff32;\n\t\t} else {\n\t\t\tif (read(fd, (char*) &nextdiroff, sizeof (uint64)) != sizeof (uint64))\n\t\t\t\tnextdiroff = 0;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong8(&nextdiroff);\n\t\t}\n\t}\n#if defined(__WIN32__) && defined(_MSC_VER)\n\tprintf("Directory %u: offset %I64u (%#I64x) next %I64u (%#I64x)\\n", ix,\n\t    (unsigned __int64)off, (unsigned __int64)off,\n\t    (unsigned __int64)nextdiroff, (unsigned __int64)nextdiroff);\n#else\n\tprintf("Directory %u: offset %llu (%#llx) next %llu (%#llx)\\n", ix,\n\t    (unsigned long long)off, (unsigned long long)off,\n\t    (unsigned long long)nextdiroff, (unsigned long long)nextdiroff);\n#endif\n\tfor (dp = (uint8*)dirmem, n = dircount; n > 0; n--) {\n\t\tuint16 tag;\n\t\tuint16 type;\n\t\tuint16 typewidth;\n\t\tuint64 count;\n\t\tuint64 datasize;\n\t\tint datafits;\n\t\tvoid* datamem;\n\t\tuint64 dataoffset;\n\t\tint datatruncated;\n\t\ttag = *(uint16*)dp;\n\t\tif (swabflag)\n\t\t\tTIFFSwabShort(&tag);\n\t\tdp += sizeof(uint16);\n\t\ttype = *(uint16*)dp;\n\t\tdp += sizeof(uint16);\n\t\tif (swabflag)\n\t\t\tTIFFSwabShort(&type);\n\t\tPrintTag(stdout, tag);\n\t\tputchar(\' \');\n\t\tPrintType(stdout, type);\n\t\tputchar(\' \');\n\t\tif (!bigtiff)\n\t\t{\n\t\t\tuint32 count32;\n\t\t\tcount32 = *(uint32*)dp;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong(&count32);\n\t\t\tdp += sizeof(uint32);\n\t\t\tcount = count32;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tcount = *(uint64*)dp;\n\t\t\tif (swabflag)\n\t\t\t\tTIFFSwabLong8(&count);\n\t\t\tdp += sizeof(uint64);\n\t\t}\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\tprintf("%I64u<", (unsigned __int64)count);\n#else\n\t\tprintf("%llu<", (unsigned long long)count);\n#endif\n\t\tif (type >= NWIDTHS)\n\t\t\ttypewidth = 0;\n\t\telse\n\t\t\ttypewidth = datawidth[type];\n\t\tdatasize = count*typewidth;\n\t\tdatafits = 1;\n\t\tdatamem = dp;\n\t\tdataoffset = 0;\n\t\tdatatruncated = 0;\n\t\tif (!bigtiff)\n\t\t{\n\t\t\tif (datasize>4)\n\t\t\t{\n\t\t\t\tuint32 dataoffset32;\n\t\t\t\tdatafits = 0;\n\t\t\t\tdatamem = NULL;\n\t\t\t\tdataoffset32 = *(uint32*)dp;\n\t\t\t\tif (swabflag)\n\t\t\t\t\tTIFFSwabLong(&dataoffset32);\n\t\t\t\tdataoffset = dataoffset32;\n\t\t\t}\n\t\t\tdp += sizeof(uint32);\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif (datasize>8)\n\t\t\t{\n\t\t\t\tdatafits = 0;\n\t\t\t\tdatamem = NULL;\n\t\t\t\tdataoffset = *(uint64*)dp;\n\t\t\t\tif (swabflag)\n\t\t\t\t\tTIFFSwabLong8(&dataoffset);\n\t\t\t}\n\t\t\tdp += sizeof(uint64);\n\t\t}\n\t\tif (datasize>0x10000)\n\t\t{\n\t\t\tdatatruncated = 1;\n\t\t\tcount = 0x10000/typewidth;\n\t\t\tdatasize = count*typewidth;\n\t\t}\n\t\tif (count>maxitems)\n\t\t{\n\t\t\tdatatruncated = 1;\n\t\t\tcount = maxitems;\n\t\t\tdatasize = count*typewidth;\n\t\t}\n\t\tif (!datafits)\n\t\t{\n\t\t\tdatamem = _TIFFmalloc((uint32)datasize);\n\t\t\tif (datamem) {\n#if defined(__WIN32__) && defined(_MSC_VER)\n\t\t\t\tif (_lseeki64(fd, (__int64)dataoffset, SEEK_SET)\n\t\t\t\t    != (__int64)dataoffset) {\n#else\n\t\t\t\tif (lseek(fd, (off_t)dataoffset, 0) !=\n\t\t\t\t    (off_t)dataoffset) {\n#endif\n\t\t\t\t\tError(\n\t\t\t\t"Seek error accessing tag %u value", tag);\n\t\t\t\t\t_TIFFfree(datamem);\n\t\t\t\t\tdatamem = NULL;\n\t\t\t\t}\n\t\t\t\tif (read(fd, datamem, (size_t)datasize) != (TIFF_SSIZE_T)datasize)\n\t\t\t\t{\n\t\t\t\t\tError(\n\t\t\t\t"Read error accessing tag %u value", tag);\n\t\t\t\t\t_TIFFfree(datamem);\n\t\t\t\t\tdatamem = NULL;\n\t\t\t\t}\n\t\t\t} else\n\t\t\t\tError("No space for data for tag %u",tag);\n\t\t}\n\t\tif (datamem)\n\t\t{\n\t\t\tif (swabflag)\n\t\t\t{\n\t\t\t\tswitch (type)\n\t\t\t\t{\n\t\t\t\t\tcase TIFF_BYTE:\n\t\t\t\t\tcase TIFF_ASCII:\n\t\t\t\t\tcase TIFF_SBYTE:\n\t\t\t\t\tcase TIFF_UNDEFINED:\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_SHORT:\n\t\t\t\t\tcase TIFF_SSHORT:\n\t\t\t\t\t\tTIFFSwabArrayOfShort((uint16*)datamem,(tmsize_t)count);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_LONG:\n\t\t\t\t\tcase TIFF_SLONG:\n\t\t\t\t\tcase TIFF_FLOAT:\n\t\t\t\t\tcase TIFF_IFD:\n\t\t\t\t\t\tTIFFSwabArrayOfLong((uint32*)datamem,(tmsize_t)count);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_RATIONAL:\n\t\t\t\t\tcase TIFF_SRATIONAL:\n\t\t\t\t\t\tTIFFSwabArrayOfLong((uint32*)datamem,(tmsize_t)count*2);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase TIFF_DOUBLE:\n\t\t\t\t\tcase TIFF_LONG8:\n\t\t\t\t\tcase TIFF_SLONG8:\n\t\t\t\t\tcase TIFF_IFD8:\n\t\t\t\t\t\tTIFFSwabArrayOfLong8((uint64*)datamem,(tmsize_t)count);\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tPrintData(stdout,type,(uint32)count,datamem);\n\t\t\tif (datatruncated)\n\t\t\t\tprintf(" ...");\n\t\t\tif (!datafits)\n\t\t\t\t_TIFFfree(datamem);\n\t\t}\n\t\tprintf(">\\n");\n\t}\ndone:\n\tif (dirmem)\n\t\t_TIFFfree((char *)dirmem);\n\treturn (nextdiroff);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n\treturn (malloc((size_t) s));\n}', 'void\nTIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)\n{\n\tregister unsigned char *cp;\n\tregister unsigned char t;\n\tassert(sizeof(uint64)==8);\n\twhile (n-- > 0) {\n\t\tcp = (unsigned char *)lp;\n\t\tt = cp[7]; cp[7] = cp[0]; cp[0] = t;\n\t\tt = cp[6]; cp[6] = cp[1]; cp[1] = t;\n\t\tt = cp[5]; cp[5] = cp[2]; cp[2] = t;\n\t\tt = cp[4]; cp[4] = cp[3]; cp[3] = t;\n\t\tlp++;\n\t}\n}']