contrib/addtiffo/tif_overview.c:836: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFCreateOvrCache`.

contrib/addtiffo/tif_overview.c:827:22: Call
825.         }
826. 
827.         nDirOffset = TIFF_WriteOverview( hTIFF, nOXSize, nOYSize,
                          ^
828.                                          nBitsPerPixel, nPlanarConfig,
829.                                          nSamples, nOBlockXSize, nOBlockYSize,

contrib/addtiffo/tif_overview.c:146:9: Call
  144. /*      Write directory, and return byte offset.                        */
  145. /* -------------------------------------------------------------------- */
  146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
               ^
  147.         return 0;
  148. 

libtiff/tif_write.c:488:1: Parameter `*tif->tif_dir.td_stripoffset`
    486.  * that important information is not changed.
    487.  */
    488. int
         ^
    489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    490. {

contrib/addtiffo/tif_overview.c:836:25: Call
834.                                          nHorSubsampling, nVerSubsampling );
835.         
836.         papoRawBIs[i] = TIFFCreateOvrCache( hTIFF, nDirOffset );
                             ^
837.     }
838. 

contrib/addtiffo/tif_ovrcache.c:43:1: Parameter `*hTIFF->tif_dir.td_stripoffset`
  41. /************************************************************************/
  42. 
  43. TIFFOvrCache *TIFFCreateOvrCache( TIFF *hTIFF, toff_t nDirOffset )
      ^
  44. 
  45. {

contrib/addtiffo/tif_ovrcache.c:57:5: Call
  55. /* -------------------------------------------------------------------- */
  56.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
  57.     TIFFSetSubDirectory( hTIFF, nDirOffset );
          ^
  58.     
  59.     TIFFGetField( hTIFF, TIFFTAG_IMAGEWIDTH, &(psCache->nXSize) );

libtiff/tif_dir.c:1384:1: Parameter `*tif->tif_dir.td_stripoffset`
    1382.  * the SubIFD tag (e.g. thumbnail images).
    1383.  */
    1384. int
          ^
    1385. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
    1386. {

libtiff/tif_dir.c:1393:10: Call
    1391. 	 */
    1392. 	tif->tif_dirnumber = 0;
    1393. 	return (TIFFReadDirectory(tif));
                   ^
    1394. }
    1395. 

libtiff/tif_dirread.c:3418:2: Call
      3416. 	/* free any old stuff and reinit */
      3417. 	TIFFFreeDirectory(tif);
      3418. 	TIFFDefaultDirectory(tif);
             ^
      3419. 	/*
      3420. 	 * Electronic Arts writes gray-scale TIFF files

libtiff/tif_dir.c:1147:2: Assignment
        1145. 	td->td_threshholding = THRESHHOLD_BILEVEL;
        1146. 	td->td_orientation = ORIENTATION_TOPLEFT;
        1147. 	td->td_samplesperpixel = 1;
               ^
        1148. 	td->td_rowsperstrip = (uint32) -1;
        1149. 	td->td_tilewidth = 0;

libtiff/tif_dirread.c:3832:8: Call
      3830. 				"\"%s\" field, calculating from imagelength",
      3831. 				TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
      3832. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
                   ^
      3833. 			    goto bad;
      3834. 		/*

libtiff/tif_dirread.c:4163:1: <Offset trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `tif->tif_dir.td_nstrips`
        4161. }
        4162. 
        4163. static int
              ^
        4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
        4165. {

libtiff/tif_dirread.c:4226:3: Assignment
        4224. 		 * of data in the strip and trim this number back accordingly.
        4225. 		 */
        4226. 		strip--;
                ^
        4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
        4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];

libtiff/tif_dirread.c:4163:1: <Length trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `*tif->tif_dir.td_stripoffset`
        4161. }
        4162. 
        4163. static int
              ^
        4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
        4165. {

libtiff/tif_dirread.c:4227:7: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFCreateOvrCache` 
        4225. 		 */
        4226. 		strip--;
        4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
                    ^
        4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
        4229. 	} else if (isTiled(tif)) {
