contrib/addtiffo/tif_overview.c:912: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFDestroyOvrCache`.

contrib/addtiffo/tif_overview.c:714:1: Parameter `hTIFF->tif_rawdata`
712. /************************************************************************/
713. 
714. void TIFFBuildOverviews( TIFF *hTIFF, int nOverviews, int * panOvList,
     ^
715.                          int bUseSubIFDs, const char *pszResampleMethod,
716.                          int (*pfnProgress)( double, void * ),

contrib/addtiffo/tif_overview.c:912:9: Call
910.     for( i = 0; i < nOverviews; i++ )
911.     {
912.         TIFFDestroyOvrCache( papoRawBIs[i] );
             ^
913.     }
914. 

contrib/addtiffo/tif_ovrcache.c:326:1: Parameter `*psCache->hTIFF->tif_rawdata`
  324. /************************************************************************/
  325. 
  326. void TIFFDestroyOvrCache( TIFFOvrCache * psCache )
       ^
  327. 
  328. {

contrib/addtiffo/tif_ovrcache.c:330:9: Call
  328. {
  329.     while( psCache->nBlockOffset < psCache->nBlocksPerColumn )
  330.         TIFFWriteOvrRow( psCache );
               ^
  331. 
  332.     _TIFFfree( psCache->pabyRow1Blocks );

contrib/addtiffo/tif_ovrcache.c:135:1: Parameter `*psCache->hTIFF->tif_rawdata`
    133. /************************************************************************/
    134. 
    135. static void TIFFWriteOvrRow( TIFFOvrCache * psCache )
         ^
    136. 
    137. {

contrib/addtiffo/tif_ovrcache.c:255:5: Call
    253. /*      Restore access to original directory.                           */
    254. /* -------------------------------------------------------------------- */
    255.     TIFFFlush( psCache->hTIFF );
             ^
    256.     /* TODO: add checks on error status return of TIFFFlush */
    257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:30:1: Parameter `*tif->tif_rawdata`
      28. #include "tiffiop.h"
      29. 
      30. int
          ^
      31. TIFFFlush(TIFF* tif)
      32. {

libtiff/tif_flush.c:81:13: Call
      79. 
      80.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      81.         && !TIFFRewriteDirectory(tif))
                      ^
      82.         return (0);
      83. 

libtiff/tif_dirwrite.c:214:1: Parameter `*tif->tif_rawdata`
        212.  * previously used directory space. 
        213.  */ 
        214. int
             ^
        215. TIFFRewriteDirectory( TIFF *tif )
        216. {

libtiff/tif_dirwrite.c:221:10: Call
        219. 	/* We don't need to do anything special if it hasn't been written. */
        220. 	if( tif->tif_diroff == 0 )
        221. 		return TIFFWriteDirectory( tif );
                      ^
        222. 
        223. 	/*

libtiff/tif_dirwrite.c:178:1: Parameter `*tif->tif_rawdata`
          176.  * storage that's been changed.
          177.  */
          178. int
               ^
          179. TIFFWriteDirectory(TIFF* tif)
          180. {

libtiff/tif_dirwrite.c:181:9: Call
          179. TIFFWriteDirectory(TIFF* tif)
          180. {
          181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          182. }
          183. 

libtiff/tif_dirwrite.c:360:1: Parameter `*tif->tif_rawdata`
            358. }
            359. 
            360. static int
                 ^
            361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            362. {

libtiff/tif_dirwrite.c:402:12: Call
            400. 		    && (tif->tif_flags & TIFF_BEENWRITING) != 0 )
            401. 		{
            402. 		    if( !TIFFFlushData1(tif) )
                            ^
            403.                     {
            404. 			TIFFErrorExt(tif->tif_clientdata, module,

libtiff/tif_write.c:788:1: Parameter `*tif->tif_rawdata`
              786.  * for infinite recursion.
              787.  */
              788. int
                   ^
              789. TIFFFlushData1(TIFF* tif)
              790. {

libtiff/tif_write.c:794:4: Call
              792. 		if (!isFillOrder(tif, tif->tif_dir.td_fillorder) &&
              793. 		    (tif->tif_flags & TIFF_NOBITREV) == 0)
              794. 			TIFFReverseBits((uint8*)tif->tif_rawdata,
                      ^
              795. 			    tif->tif_rawcc);
              796. 		if (!TIFFAppendToStrip(tif,

libtiff/tif_swab.c:283:1: <Length trace>
281. }
282. 
283. void
     ^
284. TIFFReverseBits(uint8* cp, tmsize_t n)  
285. {

libtiff/tif_swab.c:283:1: Parameter `*cp`
                281. }
                282. 
                283. void
                     ^
                284. TIFFReverseBits(uint8* cp, tmsize_t n)  
                285. {

libtiff/tif_swab.c:294:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFDestroyOvrCache` 
                292. 		cp[5] = TIFFBitRevTable[cp[5]];
                293. 		cp[6] = TIFFBitRevTable[cp[6]];
                294. 		cp[7] = TIFFBitRevTable[cp[7]];
                       ^
                295. 		cp += 8;
                296. 	}
