libtiff/tif_dirwrite.c:712: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray`.

libtiff/tif_dirwrite.c:712:11: Call
710. 					break;
711. 				case TIFF_RATIONAL:
712. 					if (!TIFFWriteDirectoryTagRationalArray(tif,&ndir,dir,tif->tif_dir.td_customValues[m].info->field_tag,tif->tif_dir.td_customValues[m].count,tif->tif_dir.td_customValues[m].value))
               ^
713. 						goto bad;
714. 					break;

libtiff/tif_dirwrite.c:1303:1: Parameter `count`
  1301. }
  1302. 
  1303. static int
        ^
  1304. TIFFWriteDirectoryTagRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
  1305. {

libtiff/tif_dirwrite.c:1311:9: Call
  1309. 		return(1);
  1310. 	}
  1311. 	return(TIFFWriteDirectoryTagCheckedRationalArray(tif,ndir,dir,tag,count,value));
                ^
  1312. }
  1313. 

libtiff/tif_dirwrite.c:1991:1: Parameter `count`
    1989. }
    1990. 
    1991. static int
          ^
    1992. TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
    1993. {

libtiff/tif_dirwrite.c:2001:4: Call
    1999. 	int o;
    2000. 	assert(sizeof(uint32)==4);
    2001. 	m=_TIFFmalloc(count*2*sizeof(uint32));
             ^
    2002. 	if (m==NULL)
    2003. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
      251. #endif
      252. 
      253. void*
           ^
      254. _TIFFmalloc(tmsize_t s)
      255. {

libtiff/tif_unix.c:256:10: Array declaration
      254. _TIFFmalloc(tmsize_t s)
      255. {
      256. 	return (malloc((size_t) s));
                    ^
      257. }
      258. 

libtiff/tif_unix.c:256:2: Assignment
      254. _TIFFmalloc(tmsize_t s)
      255. {
      256. 	return (malloc((size_t) s));
            ^
      257. }
      258. 

libtiff/tif_dirwrite.c:2001:2: Assignment
    1999. 	int o;
    2000. 	assert(sizeof(uint32)==4);
    2001. 	m=_TIFFmalloc(count*2*sizeof(uint32));
           ^
    2002. 	if (m==NULL)
    2003. 	{

libtiff/tif_dirwrite.c:2031:3: Call
    2029. 	}
    2030. 	if (tif->tif_flags&TIFF_SWAB)
    2031. 		TIFFSwabArrayOfLong(m,count*2);
            ^
    2032. 	o=TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_RATIONAL,count,count*8,&m[0]);
    2033. 	_TIFFfree(m);

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
      102. 
      103. #ifndef TIFFSwabArrayOfLong
      104. void
           ^
      105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
      106. {

libtiff/tif_swab.c:112:3: Assignment
      110. 	/* XXX unroll loop some */
      111. 	while (n-- > 0) {
      112. 		cp = (unsigned char *)lp;
             ^
      113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
      114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray` 
      111. 	while (n-- > 0) {
      112. 		cp = (unsigned char *)lp;
      113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                 ^
      114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
      115. 		lp++;
