libtiff/tif_dirwrite.c:1710: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray`.

libtiff/tif_dirwrite.c:1686:3: Assignment
1684. 	 */
1685. 	if (n>3)
1686. 		n=3;
        ^
1687. 	if (n==3)
1688. 	{

libtiff/tif_dirwrite.c:1699:4: Call
1697. 	if (n==0)
1698. 		n=1;
1699. 	o=_TIFFmalloc(n*m*sizeof(uint16));
         ^
1700. 	if (o==NULL)
1701. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

libtiff/tif_dirwrite.c:1699:2: Assignment
1697. 	if (n==0)
1698. 		n=1;
1699. 	o=_TIFFmalloc(n*m*sizeof(uint16));
       ^
1700. 	if (o==NULL)
1701. 	{

libtiff/tif_dirwrite.c:1710:4: Call
1708. 	if (n>2)
1709. 		_TIFFmemcpy(&o[2*m],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16));
1710. 	p=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,TIFFTAG_TRANSFERFUNCTION,n*m,o);
         ^
1711. 	_TIFFfree(o);
1712. 	return(p);

libtiff/tif_dirwrite.c:1830:1: Parameter `*value`
  1828. }
  1829. 
  1830. static int
        ^
  1831. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
  1832. {

libtiff/tif_dirwrite.c:1836:3: Call
  1834. 	assert(sizeof(uint16)==2);
  1835. 	if (tif->tif_flags&TIFF_SWAB)
  1836. 		TIFFSwabArrayOfShort(value,count);
          ^
  1837. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
  1838. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
    70. 
    71. #ifndef TIFFSwabArrayOfShort
    72. void
        ^
    73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
    74. {

libtiff/tif_swab.c:80:3: Assignment
    78. 	/* XXX unroll loop some */
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
          ^
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
    82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray` 
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
              ^
    82. 		wp++;
    83. 	}
