libtiff/tif_dirwrite.c:1659: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray`.

libtiff/tif_dirwrite.c:1637:1: Parameter `tif->tif_dir.td_bitspersample`
1635. }
1636. #endif
1637. static int
      ^
1638. TIFFWriteDirectoryTagColormap(TIFF* tif, uint32* ndir, TIFFDirEntry* dir)
1639. {

libtiff/tif_dirwrite.c:1649:2: Assignment
1647. 		return(1);
1648. 	}
1649. 	m=(1<<tif->tif_dir.td_bitspersample);
       ^
1650. 	n=_TIFFmalloc(3*m*sizeof(uint16));
1651. 	if (n==NULL)

libtiff/tif_dirwrite.c:1650:4: Call
1648. 	}
1649. 	m=(1<<tif->tif_dir.td_bitspersample);
1650. 	n=_TIFFmalloc(3*m*sizeof(uint16));
         ^
1651. 	if (n==NULL)
1652. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

libtiff/tif_dirwrite.c:1650:2: Assignment
1648. 	}
1649. 	m=(1<<tif->tif_dir.td_bitspersample);
1650. 	n=_TIFFmalloc(3*m*sizeof(uint16));
       ^
1651. 	if (n==NULL)
1652. 	{

libtiff/tif_dirwrite.c:1659:4: Call
1657. 	_TIFFmemcpy(&n[m],tif->tif_dir.td_colormap[1],m*sizeof(uint16));
1658. 	_TIFFmemcpy(&n[2*m],tif->tif_dir.td_colormap[2],m*sizeof(uint16));
1659. 	o=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,TIFFTAG_COLORMAP,3*m,n);
         ^
1660. 	_TIFFfree(n);
1661. 	return(o);

libtiff/tif_dirwrite.c:1830:1: Parameter `*value`
  1828. }
  1829. 
  1830. static int
        ^
  1831. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
  1832. {

libtiff/tif_dirwrite.c:1836:3: Call
  1834. 	assert(sizeof(uint16)==2);
  1835. 	if (tif->tif_flags&TIFF_SWAB)
  1836. 		TIFFSwabArrayOfShort(value,count);
          ^
  1837. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
  1838. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
    70. 
    71. #ifndef TIFFSwabArrayOfShort
    72. void
        ^
    73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
    74. {

libtiff/tif_swab.c:80:3: Assignment
    78. 	/* XXX unroll loop some */
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
          ^
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
    82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray` 
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
              ^
    82. 		wp++;
    83. 	}
