libtiff/tif_dirwrite.c:813: error: Buffer Overrun L3
  Offset: [17, +oo] (⇐ [16, +oo] + 1) Size: [0, +oo] by call to `TIFFSwabShort`.

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_diroff`
343. }
344. 
345. static int
     ^
346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
347. {

libtiff/tif_dirwrite.c:792:9: Call
790. 		}
791. 	}
792. 	dirmem=_TIFFmalloc(dirsize);
             ^
793. 	if (dirmem==NULL)
794. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

libtiff/tif_dirwrite.c:792:2: Assignment
790. 		}
791. 	}
792. 	dirmem=_TIFFmalloc(dirsize);
      ^
793. 	if (dirmem==NULL)
794. 	{

libtiff/tif_dirwrite.c:803:3: Assignment
801. 		uint32 nTmp;
802. 		TIFFDirEntry* o;
803. 		n=dirmem;
       ^
804. 		*(uint16*)n=ndir;
805. 		if (tif->tif_flags&TIFF_SWAB)

libtiff/tif_dirwrite.c:807:3: Assignment
805. 		if (tif->tif_flags&TIFF_SWAB)
806. 			TIFFSwabShort((uint16*)n);
807. 		n+=2;
       ^
808. 		o=dir;
809. 		for (m=0; m<ndir; m++)

libtiff/tif_dirwrite.c:813:5: Call
811. 			*(uint16*)n=o->tdir_tag;
812. 			if (tif->tif_flags&TIFF_SWAB)
813. 				TIFFSwabShort((uint16*)n);
         ^
814. 			n+=2;
815. 			*(uint16*)n=o->tdir_type;

libtiff/tif_swab.c:35:1: <Length trace>
33. 
34. #ifndef TIFFSwabShort
35. void
    ^
36. TIFFSwabShort(uint16* wp)
37. {

libtiff/tif_swab.c:35:1: Parameter `*wp`
  33. 
  34. #ifndef TIFFSwabShort
  35. void
      ^
  36. TIFFSwabShort(uint16* wp)
  37. {

libtiff/tif_swab.c:38:2: Assignment
  36. TIFFSwabShort(uint16* wp)
  37. {
  38. 	register unsigned char* cp = (unsigned char*) wp;
       ^
  39. 	unsigned char t;
  40. 	assert(sizeof(uint16)==2);

libtiff/tif_swab.c:41:6: Array access: Offset: [17, +oo] (⇐ [16, +oo] + 1) Size: [0, +oo] by call to `TIFFSwabShort` 
  39. 	unsigned char t;
  40. 	assert(sizeof(uint16)==2);
  41. 	t = cp[1]; cp[1] = cp[0]; cp[0] = t;
           ^
  42. }
  43. #endif
