libtiff/tif_dirinfo.c:837: error: Buffer Overrun S2
  Offset: `tif->tif_nfieldscompat` Size: [0, +oo].

libtiff/tif_dirinfo.c:811:1: <Offset trace>
809. }
810. 
811. int
     ^
812. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
813. {

libtiff/tif_dirinfo.c:811:1: Parameter `tif->tif_nfieldscompat`
809. }
810. 
811. int
     ^
812. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
813. {

libtiff/tif_dirinfo.c:835:2: Assignment
833. 		return -1;
834. 	}
835. 	nfields = tif->tif_nfieldscompat++;
      ^
836. 
837. 	tif->tif_fieldscompat[nfields].type = tfiatOther;

libtiff/tif_dirinfo.c:811:1: <Length trace>
809. }
810. 
811. int
     ^
812. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
813. {

libtiff/tif_dirinfo.c:811:1: Parameter `*tif->tif_fieldscompat`
809. }
810. 
811. int
     ^
812. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
813. {

libtiff/tif_dirinfo.c:822:4: Call
820. 	if (tif->tif_nfieldscompat > 0) {
821. 		tif->tif_fieldscompat = (TIFFFieldArray *)
822. 			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
        ^
823. 					  tif->tif_nfieldscompat + 1,
824. 					  sizeof(TIFFFieldArray), reason);

libtiff/tif_aux.c:40:2: Assignment
  38. 		  tmsize_t nmemb, tmsize_t elem_size, const char* what)
  39. {
  40. 	void* cp = NULL;
       ^
  41. 	tmsize_t bytes = nmemb * elem_size;
  42. 

libtiff/tif_aux.c:53:2: Assignment
  51. 			     "No space %s", what);
  52. 
  53. 	return cp;
       ^
  54. }
  55. 

libtiff/tif_dirinfo.c:821:3: Assignment
819. 
820. 	if (tif->tif_nfieldscompat > 0) {
821. 		tif->tif_fieldscompat = (TIFFFieldArray *)
       ^
822. 			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
823. 					  tif->tif_nfieldscompat + 1,

libtiff/tif_dirinfo.c:837:2: Array access: Offset: tif->tif_nfieldscompat Size: [0, +oo]
835. 	nfields = tif->tif_nfieldscompat++;
836. 
837. 	tif->tif_fieldscompat[nfields].type = tfiatOther;
      ^
838. 	tif->tif_fieldscompat[nfields].allocated_size = n;
839. 	tif->tif_fieldscompat[nfields].count = n;
