tools/thumbnail.c:616: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/thumbnail.c:563:1: Parameter `out->tif_dir.td_samplesperpixel`
561. }
562. 
563. static int
     ^
564. generateThumbnail(TIFF* in, TIFF* out)
565. {

tools/thumbnail.c:615:13: Call
613.     diroff[0] = 0UL;
614.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
615.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
                 ^
616.             TIFFWriteDirectory(out) != -1);
617. }

libtiff/tif_write.c:183:1: Parameter `tif->tif_dir.td_samplesperpixel`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

tools/thumbnail.c:616:13: Call
614.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
615.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
616.             TIFFWriteDirectory(out) != -1);
                 ^
617. }
618. 

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
  161.  * storage that's been changed.
  162.  */
  163. int
       ^
  164. TIFFWriteDirectory(TIFF* tif)
  165. {

libtiff/tif_dirwrite.c:166:9: Call
  164. TIFFWriteDirectory(TIFF* tif)
  165. {
  166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  167. }
  168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
    343. }
    344. 
    345. static int
         ^
    346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    347. {

libtiff/tif_dirwrite.c:555:10: Call
    553. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
    554. 			{
    555. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                  ^
    556. 					goto bad;
    557. 			}

libtiff/tif_dirwrite.c:897:1: Parameter `tif->tif_dir.td_samplesperpixel`
      895. }
      896. 
      897. static int
           ^
      898. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
      899. {

libtiff/tif_dirwrite.c:906:12: Call
      904. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
      905. 			else
      906. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                      ^
      907. 		case SAMPLEFORMAT_INT:
      908. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1394:1: Parameter `tif->tif_dir.td_samplesperpixel`
        1392. }
        1393. 
        1394. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
              ^
        1395. {
        1396. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1406:4: Call
        1404. 		return(1);
        1405. 	}
        1406. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                 ^
        1407. 	if (m==NULL)
        1408. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
          251. #endif
          252. 
          253. void*
               ^
          254. _TIFFmalloc(tmsize_t s)
          255. {

libtiff/tif_unix.c:256:10: Array declaration
          254. _TIFFmalloc(tmsize_t s)
          255. {
          256. 	return (malloc((size_t) s));
                        ^
          257. }
          258. 

libtiff/tif_unix.c:256:2: Assignment
          254. _TIFFmalloc(tmsize_t s)
          255. {
          256. 	return (malloc((size_t) s));
                ^
          257. }
          258. 

libtiff/tif_dirwrite.c:1406:2: Assignment
        1404. 		return(1);
        1405. 	}
        1406. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
               ^
        1407. 	if (m==NULL)
        1408. 	{

libtiff/tif_dirwrite.c:1414:4: Call
        1412. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
        1413. 		*na=value;
        1414. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                 ^
        1415. 	_TIFFfree(m);
        1416. 	return(o);

libtiff/tif_dirwrite.c:2138:1: Parameter `*value`
          2136. #endif
          2137. 
          2138. static int
                ^
          2139. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
          2140. {

libtiff/tif_dirwrite.c:2145:3: Call
          2143. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
          2144. 	if (tif->tif_flags&TIFF_SWAB)
          2145. 		TIFFSwabArrayOfDouble(value,count);
                  ^
          2146. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
          2147. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
            181. 
            182. #ifndef TIFFSwabArrayOfDouble
            183. void
                 ^
            184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
            185. {

libtiff/tif_swab.c:191:3: Assignment
            189. 	/* XXX unroll loop some */
            190. 	while (n-- > 0) {
            191. 		cp = (unsigned char *)dp;
                   ^
            192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
            193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory` 
            190. 	while (n-- > 0) {
            191. 		cp = (unsigned char *)dp;
            192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                       ^
            193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
            194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
