libtiff/tif_dirwrite.c:819: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalDoubleArray`.

libtiff/tif_dirwrite.c:770:25: Assignment
768. 		{
769.                         uint16 tag = (uint16)tif->tif_dir.td_customValues[m].info->field_tag;
770.                         uint32 count = tif->tif_dir.td_customValues[m].count;
                             ^
771. 			switch (tif->tif_dir.td_customValues[m].info->field_type)
772. 			{

libtiff/tif_dirwrite.c:819:13: Call
817. 						tv_size = _TIFFSetGetFieldSize(tif->tif_dir.td_customValues[m].info->set_field_type);
818. 						if (tv_size == 8) {
819. 							if (!TIFFWriteDirectoryTagRationalDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))
                 ^
820. 								goto bad;
821. 						} else {

libtiff/tif_dirwrite.c:1609:1: Parameter `count`
  1607. 
  1608. /*-- Rational2Double: additional write functions */
  1609. static int
        ^
  1610. TIFFWriteDirectoryTagRationalDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
  1611. {

libtiff/tif_dirwrite.c:1617:9: Call
  1615. 		return(1);
  1616. 	}
  1617. 	return(TIFFWriteDirectoryTagCheckedRationalDoubleArray(tif,ndir,dir,tag,count,value));
                ^
  1618. }
  1619. 

libtiff/tif_dirwrite.c:2560:1: Parameter `count`
    2558. 
    2559. /*-- Rational2Double: additional write functions for double arrays */
    2560. static int
          ^
    2561. TIFFWriteDirectoryTagCheckedRationalDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
    2562. {

libtiff/tif_dirwrite.c:2570:4: Call
    2568. 	int o;
    2569. 	assert(sizeof(uint32)==4);
    2570. 	m=_TIFFmalloc(count*2*sizeof(uint32));
             ^
    2571. 	if (m==NULL)
    2572. 	{

libtiff/tif_unix.c:312:17: Assignment
      310. {
      311.         if (s == 0)
      312.                 return ((void *) NULL);
                           ^
      313. 
      314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:2570:2: Assignment
    2568. 	int o;
    2569. 	assert(sizeof(uint32)==4);
    2570. 	m=_TIFFmalloc(count*2*sizeof(uint32));
           ^
    2571. 	if (m==NULL)
    2572. 	{

libtiff/tif_dirwrite.c:2576:17: Assignment
    2574. 		return(0);
    2575. 	}
    2576. 	for (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)
                          ^
    2577. 	{
    2578. 		DoubleToRational(*na, &nb[0], &nb[1]);

libtiff/tif_dirwrite.c:2578:3: Call
    2576. 	for (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)
    2577. 	{
    2578. 		DoubleToRational(*na, &nb[0], &nb[1]);
            ^
    2579. 	}
    2580. 	if (tif->tif_flags&TIFF_SWAB)

libtiff/tif_dirwrite.c:2821:1: <Length trace>
2819. * using the Euclidean algorithm to find the greatest common divisor (GCD)
2820. ------------------------------------------------------------------------*/
2821. static
      ^
2822. void DoubleToRational(double value, uint32 *num, uint32 *denom)
2823. {

libtiff/tif_dirwrite.c:2821:1: Parameter `*denom`
      2819. * using the Euclidean algorithm to find the greatest common divisor (GCD)
      2820. ------------------------------------------------------------------------*/
      2821. static
            ^
      2822. void DoubleToRational(double value, uint32 *num, uint32 *denom)
      2823. {

libtiff/tif_dirwrite.c:2844:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalDoubleArray` 
      2842. 	if (value == (uint32)(value)) {
      2843. 		*num = (uint32)value;
      2844. 		*denom = 1;
              ^
      2845. 		return;
      2846. 	}

static
void DoubleToRational(double value, uint32 *num, uint32 *denom)
{
	double dblDiff, dblDiff2;
	unsigned long long ullNum, ullDenom, ullNum2, ullDenom2;
	if (value < 0) {
		*num = *denom = 0;
		TIFFErrorExt(0, "TIFFLib: DoubeToRational()", " Negative Value for Unsigned Rational given.");
		return;
	}
	if (value > 0xFFFFFFFFUL) {
		*num = 0xFFFFFFFFU;
		*denom = 0;
		return;
	}
	if (value == (uint32)(value)) {
		*num = (uint32)value;
		*denom = 1;
		return;
	}
	if (value < 1.0 / (double)0xFFFFFFFFUL) {
		*num = 0;
		*denom = 0xFFFFFFFFU;
		return;
	}
	ToRationalEuclideanGCD(value, FALSE, FALSE, &ullNum, &ullDenom);
	ToRationalEuclideanGCD(value, FALSE, TRUE, &ullNum2, &ullDenom2);
	if (ullNum > 0xFFFFFFFFUL || ullDenom > 0xFFFFFFFFUL || ullNum2 > 0xFFFFFFFFUL || ullDenom2 > 0xFFFFFFFFUL) {
#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
		TIFFErrorExt(0, "TIFFLib: DoubeToRational()", " Num or Denom exceeds ULONG: val=%14.6f, num=%I64u, denom=%I64u | num2=%I64u, denom2=%I64u", value, ullNum, ullDenom, ullNum2, ullDenom2);
#else
		TIFFErrorExt(0, "TIFFLib: DoubeToRational()", " Num or Denom exceeds ULONG: val=%14.6f, num=%12llu, denom=%12llu | num2=%12llu, denom2=%12llu", value, ullNum, ullDenom, ullNum2, ullDenom2);
#endif
		assert(0);
	}
	dblDiff = fabs(value - ((double)ullNum / (double)ullDenom));
	dblDiff2 = fabs(value - ((double)ullNum2 / (double)ullDenom2));
	if (dblDiff < dblDiff2) {
		*num = (uint32)ullNum;
		*denom = (uint32)ullDenom;
	}
	else {
		*num = (uint32)ullNum2;
		*denom = (uint32)ullDenom2;
	}
}
['static int\nTIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)\n{\n\tstatic const char module[] = "TIFFWriteDirectorySec";\n\tuint32 ndir;\n\tTIFFDirEntry* dir;\n\tuint32 dirsize;\n\tvoid* dirmem;\n\tuint32 m;\n\tif (tif->tif_mode == O_RDONLY)\n\t\treturn (1);\n        _TIFFFillStriles( tif );\n\tif (imagedone)\n\t{\n\t\tif (tif->tif_flags & TIFF_POSTENCODE)\n\t\t{\n\t\t\ttif->tif_flags &= ~TIFF_POSTENCODE;\n\t\t\tif (!(*tif->tif_postencode)(tif))\n\t\t\t{\n\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t\t    "Error post-encoding before directory write");\n\t\t\t\treturn (0);\n\t\t\t}\n\t\t}\n\t\t(*tif->tif_close)(tif);\n\t\tif (tif->tif_rawcc > 0\n\t\t    && (tif->tif_flags & TIFF_BEENWRITING) != 0 )\n\t\t{\n\t\t    if( !TIFFFlushData1(tif) )\n                    {\n\t\t\tTIFFErrorExt(tif->tif_clientdata, module,\n\t\t\t    "Error flushing data before directory write");\n\t\t\treturn (0);\n                    }\n\t\t}\n\t\tif ((tif->tif_flags & TIFF_MYBUFFER) && tif->tif_rawdata)\n\t\t{\n\t\t\t_TIFFfree(tif->tif_rawdata);\n\t\t\ttif->tif_rawdata = NULL;\n\t\t\ttif->tif_rawcc = 0;\n\t\t\ttif->tif_rawdatasize = 0;\n                        tif->tif_rawdataoff = 0;\n                        tif->tif_rawdataloaded = 0;\n\t\t}\n\t\ttif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);\n\t}\n\tdir=NULL;\n\tdirmem=NULL;\n\tdirsize=0;\n\twhile (1)\n\t{\n\t\tndir=0;\n\t\tif (isimage)\n\t\t{\n\t\t\tif (TIFFFieldSet(tif,FIELD_IMAGEDIMENSIONS))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_IMAGEWIDTH,tif->tif_dir.td_imagewidth))\n\t\t\t\t\tgoto bad;\n\t\t\t\tif (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_IMAGELENGTH,tif->tif_dir.td_imagelength))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_TILEDIMENSIONS))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_TILEWIDTH,tif->tif_dir.td_tilewidth))\n\t\t\t\t\tgoto bad;\n\t\t\t\tif (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_TILELENGTH,tif->tif_dir.td_tilelength))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_RESOLUTION))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagRational(tif,&ndir,dir,TIFFTAG_XRESOLUTION,tif->tif_dir.td_xresolution))\n\t\t\t\t\tgoto bad;\n\t\t\t\tif (!TIFFWriteDirectoryTagRational(tif,&ndir,dir,TIFFTAG_YRESOLUTION,tif->tif_dir.td_yresolution))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_POSITION))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagRational(tif,&ndir,dir,TIFFTAG_XPOSITION,tif->tif_dir.td_xposition))\n\t\t\t\t\tgoto bad;\n\t\t\t\tif (!TIFFWriteDirectoryTagRational(tif,&ndir,dir,TIFFTAG_YPOSITION,tif->tif_dir.td_yposition))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_SUBFILETYPE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagLong(tif,&ndir,dir,TIFFTAG_SUBFILETYPE,tif->tif_dir.td_subfiletype))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_BITSPERSAMPLE,tif->tif_dir.td_bitspersample))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_COMPRESSION))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_COMPRESSION,tif->tif_dir.td_compression))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_PHOTOMETRIC))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_PHOTOMETRIC,tif->tif_dir.td_photometric))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_THRESHHOLDING))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_THRESHHOLDING,tif->tif_dir.td_threshholding))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_FILLORDER))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_FILLORDER,tif->tif_dir.td_fillorder))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_ORIENTATION))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_ORIENTATION,tif->tif_dir.td_orientation))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_SAMPLESPERPIXEL))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_SAMPLESPERPIXEL,tif->tif_dir.td_samplesperpixel))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_ROWSPERSTRIP))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_ROWSPERSTRIP,tif->tif_dir.td_rowsperstrip))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_MINSAMPLEVALUE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_MINSAMPLEVALUE,tif->tif_dir.td_minsamplevalue))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_MAXSAMPLEVALUE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_MAXSAMPLEVALUE,tif->tif_dir.td_maxsamplevalue))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_PLANARCONFIG))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_PLANARCONFIG,tif->tif_dir.td_planarconfig))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_RESOLUTIONUNIT))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_RESOLUTIONUNIT,tif->tif_dir.td_resolutionunit))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_PAGENUMBER))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortArray(tif,&ndir,dir,TIFFTAG_PAGENUMBER,2,&tif->tif_dir.td_pagenumber[0]))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_STRIPBYTECOUNTS))\n\t\t\t{\n\t\t\t\tif (!isTiled(tif))\n\t\t\t\t{\n\t\t\t\t\tif (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tif (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_TILEBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_STRIPOFFSETS))\n\t\t\t{\n\t\t\t\tif (!isTiled(tif))\n\t\t\t\t{\n                    if (tif->tif_dir.td_stripoffset_p != NULL &&\n                        !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset_p))\n                        goto bad;\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tif (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_TILEOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset_p))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_COLORMAP))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagColormap(tif,&ndir,dir))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_EXTRASAMPLES))\n\t\t\t{\n\t\t\t\tif (tif->tif_dir.td_extrasamples)\n\t\t\t\t{\n\t\t\t\t\tuint16 na;\n\t\t\t\t\tuint16* nb;\n\t\t\t\t\tTIFFGetFieldDefaulted(tif,TIFFTAG_EXTRASAMPLES,&na,&nb);\n\t\t\t\t\tif (!TIFFWriteDirectoryTagShortArray(tif,&ndir,dir,TIFFTAG_EXTRASAMPLES,na,nb))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_SAMPLEFORMAT))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_SAMPLEFORMAT,tif->tif_dir.td_sampleformat))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_SMAXSAMPLEVALUE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMAXSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_smaxsamplevalue))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_IMAGEDEPTH))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagLong(tif,&ndir,dir,TIFFTAG_IMAGEDEPTH,tif->tif_dir.td_imagedepth))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_TILEDEPTH))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagLong(tif,&ndir,dir,TIFFTAG_TILEDEPTH,tif->tif_dir.td_tiledepth))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_HALFTONEHINTS))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortArray(tif,&ndir,dir,TIFFTAG_HALFTONEHINTS,2,&tif->tif_dir.td_halftonehints[0]))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_YCBCRSUBSAMPLING))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShortArray(tif,&ndir,dir,TIFFTAG_YCBCRSUBSAMPLING,2,&tif->tif_dir.td_ycbcrsubsampling[0]))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_YCBCRPOSITIONING))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,TIFFTAG_YCBCRPOSITIONING,tif->tif_dir.td_ycbcrpositioning))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_REFBLACKWHITE))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagRationalArray(tif,&ndir,dir,TIFFTAG_REFERENCEBLACKWHITE,6,tif->tif_dir.td_refblackwhite))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_TRANSFERFUNCTION))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagTransferfunction(tif,&ndir,dir))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_INKNAMES))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagAscii(tif,&ndir,dir,TIFFTAG_INKNAMES,tif->tif_dir.td_inknameslen,tif->tif_dir.td_inknames))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\tif (TIFFFieldSet(tif,FIELD_SUBIFD))\n\t\t\t{\n\t\t\t\tif (!TIFFWriteDirectoryTagSubifd(tif,&ndir,dir))\n\t\t\t\t\tgoto bad;\n\t\t\t}\n\t\t\t{\n\t\t\t\tuint32 n;\n\t\t\t\tfor (n=0; n<tif->tif_nfields; n++) {\n\t\t\t\t\tconst TIFFField* o;\n\t\t\t\t\to = tif->tif_fields[n];\n\t\t\t\t\tif ((o->field_bit>=FIELD_CODEC)&&(TIFFFieldSet(tif,o->field_bit)))\n\t\t\t\t\t{\n\t\t\t\t\t\tswitch (o->get_field_type)\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tcase TIFF_SETGET_ASCII:\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tuint32 pa;\n\t\t\t\t\t\t\t\t\tchar* pb;\n\t\t\t\t\t\t\t\t\tassert(o->field_type==TIFF_ASCII);\n\t\t\t\t\t\t\t\t\tassert(o->field_readcount==TIFF_VARIABLE);\n\t\t\t\t\t\t\t\t\tassert(o->field_passcount==0);\n\t\t\t\t\t\t\t\t\tTIFFGetField(tif,o->field_tag,&pb);\n\t\t\t\t\t\t\t\t\tpa=(uint32)(strlen(pb));\n\t\t\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagAscii(tif,&ndir,dir,(uint16)o->field_tag,pa,pb))\n\t\t\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tcase TIFF_SETGET_UINT16:\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tuint16 p;\n\t\t\t\t\t\t\t\t\tassert(o->field_type==TIFF_SHORT);\n\t\t\t\t\t\t\t\t\tassert(o->field_readcount==1);\n\t\t\t\t\t\t\t\t\tassert(o->field_passcount==0);\n\t\t\t\t\t\t\t\t\tTIFFGetField(tif,o->field_tag,&p);\n\t\t\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagShort(tif,&ndir,dir,(uint16)o->field_tag,p))\n\t\t\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tcase TIFF_SETGET_UINT32:\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tuint32 p;\n\t\t\t\t\t\t\t\t\tassert(o->field_type==TIFF_LONG);\n\t\t\t\t\t\t\t\t\tassert(o->field_readcount==1);\n\t\t\t\t\t\t\t\t\tassert(o->field_passcount==0);\n\t\t\t\t\t\t\t\t\tTIFFGetField(tif,o->field_tag,&p);\n\t\t\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagLong(tif,&ndir,dir,(uint16)o->field_tag,p))\n\t\t\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tcase TIFF_SETGET_C32_UINT8:\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tuint32 pa;\n\t\t\t\t\t\t\t\t\tvoid* pb;\n\t\t\t\t\t\t\t\t\tassert(o->field_type==TIFF_UNDEFINED);\n\t\t\t\t\t\t\t\t\tassert(o->field_readcount==TIFF_VARIABLE2);\n\t\t\t\t\t\t\t\t\tassert(o->field_passcount==1);\n\t\t\t\t\t\t\t\t\tTIFFGetField(tif,o->field_tag,&pa,&pb);\n\t\t\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagUndefinedArray(tif,&ndir,dir,(uint16)o->field_tag,pa,pb))\n\t\t\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tdefault:\n\t\t\t\t\t\t\t\tTIFFErrorExt(tif->tif_clientdata,module,\n\t\t\t\t\t\t\t\t            "Cannot write tag %d (%s)",\n\t\t\t\t\t\t\t\t            TIFFFieldTag(o),\n                                                                            o->field_name ? o->field_name : "unknown");\n\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor (m=0; m<(uint32)(tif->tif_dir.td_customValueCount); m++)\n\t\t{\n                        uint16 tag = (uint16)tif->tif_dir.td_customValues[m].info->field_tag;\n                        uint32 count = tif->tif_dir.td_customValues[m].count;\n\t\t\tswitch (tif->tif_dir.td_customValues[m].info->field_type)\n\t\t\t{\n\t\t\t\tcase TIFF_ASCII:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagAscii(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_UNDEFINED:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagUndefinedArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_BYTE:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagByteArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_SBYTE:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagSbyteArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_SHORT:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagShortArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_SSHORT:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagSshortArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_LONG:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagLongArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_SLONG:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagSlongArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_LONG8:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagLong8Array(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_SLONG8:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagSlong8Array(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_RATIONAL:\n\t\t\t\t\t{\n\t\t\t\t\t\tint tv_size;\n\t\t\t\t\t\ttv_size = _TIFFSetGetFieldSize(tif->tif_dir.td_customValues[m].info->set_field_type);\n\t\t\t\t\t\tif (tv_size == 8) {\n\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagRationalDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagRationalArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t\tif (tv_size != 4) {\n\t\t\t\t\t\t\t\tTIFFErrorExt(0,"TIFFLib: _TIFFWriteDirectorySec()", "Rational2Double: .set_field_type in not 4 but %d", tv_size);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_SRATIONAL:\n\t\t\t\t\t{\n\t\t\t\t\t\tint tv_size;\n\t\t\t\t\t\ttv_size = _TIFFSetGetFieldSize(tif->tif_dir.td_customValues[m].info->set_field_type);\n\t\t\t\t\t\tif (tv_size == 8) {\n\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagSrationalDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tif (!TIFFWriteDirectoryTagSrationalArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\t\t\tgoto bad;\n\t\t\t\t\t\t\tif (tv_size != 4) {\n\t\t\t\t\t\t\t\tTIFFErrorExt(0,"TIFFLib: _TIFFWriteDirectorySec()", "Rational2Double: .set_field_type in not 4 but %d", tv_size);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_FLOAT:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagFloatArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_DOUBLE:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_IFD:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagIfdArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tcase TIFF_IFD8:\n\t\t\t\t\tif (!TIFFWriteDirectoryTagIfdIfd8Array(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))\n\t\t\t\t\t\tgoto bad;\n\t\t\t\t\tbreak;\n\t\t\t\tdefault:\n\t\t\t\t\tassert(0);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tif (dir!=NULL)\n\t\t\tbreak;\n\t\tdir=_TIFFmalloc(ndir*sizeof(TIFFDirEntry));\n\t\tif (dir==NULL)\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Out of memory");\n\t\t\tgoto bad;\n\t\t}\n\t\tif (isimage)\n\t\t{\n\t\t\tif ((tif->tif_diroff==0)&&(!TIFFLinkDirectory(tif)))\n\t\t\t\tgoto bad;\n\t\t}\n\t\telse\n\t\t\ttif->tif_diroff=(TIFFSeekFile(tif,0,SEEK_END)+1)&(~((toff_t)1));\n\t\tif (pdiroff!=NULL)\n\t\t\t*pdiroff=tif->tif_diroff;\n\t\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t\t\tdirsize=2+ndir*12+4;\n\t\telse\n\t\t\tdirsize=8+ndir*20+8;\n\t\ttif->tif_dataoff=tif->tif_diroff+dirsize;\n\t\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t\t\ttif->tif_dataoff=(uint32)tif->tif_dataoff;\n\t\tif ((tif->tif_dataoff<tif->tif_diroff)||(tif->tif_dataoff<(uint64)dirsize))\n\t\t{\n\t\t\tTIFFErrorExt(tif->tif_clientdata,module,"Maximum TIFF file size exceeded");\n\t\t\tgoto bad;\n\t\t}\n\t\tif (tif->tif_dataoff&1)\n\t\t\ttif->tif_dataoff++;\n\t\tif (isimage)\n\t\t\ttif->tif_curdir++;\n\t}\n\tif (isimage)\n\t{\n\t\tif (TIFFFieldSet(tif,FIELD_SUBIFD)&&(tif->tif_subifdoff==0))\n\t\t{\n\t\t\tuint32 na;\n\t\t\tTIFFDirEntry* nb;\n\t\t\tfor (na=0, nb=dir; ; na++, nb++)\n\t\t\t{\n\t\t\t\tif( na == ndir )\n                                {\n                                    TIFFErrorExt(tif->tif_clientdata,module,\n                                                 "Cannot find SubIFD tag");\n                                    goto bad;\n                                }\n\t\t\t\tif (nb->tdir_tag==TIFFTAG_SUBIFD)\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t\t\t\ttif->tif_subifdoff=tif->tif_diroff+2+na*12+8;\n\t\t\telse\n\t\t\t\ttif->tif_subifdoff=tif->tif_diroff+8+na*20+12;\n\t\t}\n\t}\n\tdirmem=_TIFFmalloc(dirsize);\n\tif (dirmem==NULL)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Out of memory");\n\t\tgoto bad;\n\t}\n\tif (!(tif->tif_flags&TIFF_BIGTIFF))\n\t{\n\t\tuint8* n;\n\t\tuint32 nTmp;\n\t\tTIFFDirEntry* o;\n\t\tn=dirmem;\n\t\t*(uint16*)n=(uint16)ndir;\n\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\tTIFFSwabShort((uint16*)n);\n\t\tn+=2;\n\t\to=dir;\n\t\tfor (m=0; m<ndir; m++)\n\t\t{\n\t\t\t*(uint16*)n=o->tdir_tag;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabShort((uint16*)n);\n\t\t\tn+=2;\n\t\t\t*(uint16*)n=o->tdir_type;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabShort((uint16*)n);\n\t\t\tn+=2;\n\t\t\tnTmp = (uint32)o->tdir_count;\n\t\t\t_TIFFmemcpy(n,&nTmp,4);\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabLong((uint32*)n);\n\t\t\tn+=4;\n\t\t\t_TIFFmemcpy(n,&o->tdir_offset,4);\n\t\t\tn+=4;\n\t\t\to++;\n\t\t}\n\t\tnTmp = (uint32)tif->tif_nextdiroff;\n\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\tTIFFSwabLong(&nTmp);\n\t\t_TIFFmemcpy(n,&nTmp,4);\n\t}\n\telse\n\t{\n\t\tuint8* n;\n\t\tTIFFDirEntry* o;\n\t\tn=dirmem;\n\t\t*(uint64*)n=ndir;\n\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\tTIFFSwabLong8((uint64*)n);\n\t\tn+=8;\n\t\to=dir;\n\t\tfor (m=0; m<ndir; m++)\n\t\t{\n\t\t\t*(uint16*)n=o->tdir_tag;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabShort((uint16*)n);\n\t\t\tn+=2;\n\t\t\t*(uint16*)n=o->tdir_type;\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabShort((uint16*)n);\n\t\t\tn+=2;\n\t\t\t_TIFFmemcpy(n,&o->tdir_count,8);\n\t\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\t\tTIFFSwabLong8((uint64*)n);\n\t\t\tn+=8;\n\t\t\t_TIFFmemcpy(n,&o->tdir_offset,8);\n\t\t\tn+=8;\n\t\t\to++;\n\t\t}\n\t\t_TIFFmemcpy(n,&tif->tif_nextdiroff,8);\n\t\tif (tif->tif_flags&TIFF_SWAB)\n\t\t\tTIFFSwabLong8((uint64*)n);\n\t}\n\t_TIFFfree(dir);\n\tdir=NULL;\n\tif (!SeekOK(tif,tif->tif_diroff))\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"IO error writing directory");\n\t\tgoto bad;\n\t}\n\tif (!WriteOK(tif,dirmem,(tmsize_t)dirsize))\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"IO error writing directory");\n\t\tgoto bad;\n\t}\n\t_TIFFfree(dirmem);\n\tif (imagedone)\n\t{\n\t\tTIFFFreeDirectory(tif);\n\t\ttif->tif_flags &= ~TIFF_DIRTYDIRECT;\n\t\ttif->tif_flags &= ~TIFF_DIRTYSTRIP;\n\t\t(*tif->tif_cleanup)(tif);\n\t\tTIFFCreateDirectory(tif);\n\t}\n\treturn(1);\nbad:\n\tif (dir!=NULL)\n\t\t_TIFFfree(dir);\n\tif (dirmem!=NULL)\n\t\t_TIFFfree(dirmem);\n\treturn(0);\n}', 'static int\nTIFFWriteDirectoryTagRationalDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)\n{\n\tif (dir==NULL)\n\t{\n\t\t(*ndir)++;\n\t\treturn(1);\n\t}\n\treturn(TIFFWriteDirectoryTagCheckedRationalDoubleArray(tif,ndir,dir,tag,count,value));\n}', 'static int\nTIFFWriteDirectoryTagCheckedRationalDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)\n{\n\tstatic const char module[] = "TIFFWriteDirectoryTagCheckedRationalDoubleArray";\n\tuint32* m;\n\tdouble* na;\n\tuint32* nb;\n\tuint32 nc;\n\tint o;\n\tassert(sizeof(uint32)==4);\n\tm=_TIFFmalloc(count*2*sizeof(uint32));\n\tif (m==NULL)\n\t{\n\t\tTIFFErrorExt(tif->tif_clientdata,module,"Out of memory");\n\t\treturn(0);\n\t}\n\tfor (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)\n\t{\n\t\tDoubleToRational(*na, &nb[0], &nb[1]);\n\t}\n\tif (tif->tif_flags&TIFF_SWAB)\n\t\tTIFFSwabArrayOfLong(m,count*2);\n\to=TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_RATIONAL,count,count*8,&m[0]);\n\t_TIFFfree(m);\n\treturn(o);\n}', 'void*\n_TIFFmalloc(tmsize_t s)\n{\n        if (s == 0)\n                return ((void *) NULL);\n\treturn (malloc((size_t) s));\n}', 'static\nvoid DoubleToRational(double value, uint32 *num, uint32 *denom)\n{\n\tdouble dblDiff, dblDiff2;\n\tunsigned long long ullNum, ullDenom, ullNum2, ullDenom2;\n\tif (value < 0) {\n\t\t*num = *denom = 0;\n\t\tTIFFErrorExt(0, "TIFFLib: DoubeToRational()", " Negative Value for Unsigned Rational given.");\n\t\treturn;\n\t}\n\tif (value > 0xFFFFFFFFUL) {\n\t\t*num = 0xFFFFFFFFU;\n\t\t*denom = 0;\n\t\treturn;\n\t}\n\tif (value == (uint32)(value)) {\n\t\t*num = (uint32)value;\n\t\t*denom = 1;\n\t\treturn;\n\t}\n\tif (value < 1.0 / (double)0xFFFFFFFFUL) {\n\t\t*num = 0;\n\t\t*denom = 0xFFFFFFFFU;\n\t\treturn;\n\t}\n\tToRationalEuclideanGCD(value, FALSE, FALSE, &ullNum, &ullDenom);\n\tToRationalEuclideanGCD(value, FALSE, TRUE, &ullNum2, &ullDenom2);\n\tif (ullNum > 0xFFFFFFFFUL || ullDenom > 0xFFFFFFFFUL || ullNum2 > 0xFFFFFFFFUL || ullDenom2 > 0xFFFFFFFFUL) {\n#if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))\n\t\tTIFFErrorExt(0, "TIFFLib: DoubeToRational()", " Num or Denom exceeds ULONG: val=%14.6f, num=%I64u, denom=%I64u | num2=%I64u, denom2=%I64u", value, ullNum, ullDenom, ullNum2, ullDenom2);\n#else\n\t\tTIFFErrorExt(0, "TIFFLib: DoubeToRational()", " Num or Denom exceeds ULONG: val=%14.6f, num=%12llu, denom=%12llu | num2=%12llu, denom2=%12llu", value, ullNum, ullDenom, ullNum2, ullDenom2);\n#endif\n\t\tassert(0);\n\t}\n\tdblDiff = fabs(value - ((double)ullNum / (double)ullDenom));\n\tdblDiff2 = fabs(value - ((double)ullNum2 / (double)ullDenom2));\n\tif (dblDiff < dblDiff2) {\n\t\t*num = (uint32)ullNum;\n\t\t*denom = (uint32)ullDenom;\n\t}\n\telse {\n\t\t*num = (uint32)ullNum2;\n\t\t*denom = (uint32)ullDenom2;\n\t}\n}']