libtiff/tif_dirwrite.c:600: error: Buffer Overrun L3
  Offset: [0, 36] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSubifd`.

libtiff/tif_dirwrite.c:400:2: Assignment
398. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
399. 	}
400. 	dir=NULL;
      ^
401. 	dirmem=NULL;
402. 	dirsize=0;

libtiff/tif_dirwrite.c:600:10: Call
598. 			if (TIFFFieldSet(tif,FIELD_SUBIFD))
599. 			{
600. 				if (!TIFFWriteDirectoryTagSubifd(tif,&ndir,dir))
              ^
601. 					goto bad;
602. 			}

libtiff/tif_dirwrite.c:1715:1: Parameter `*dir`
  1713. }
  1714. 
  1715. static int
        ^
  1716. TIFFWriteDirectoryTagSubifd(TIFF* tif, uint32* ndir, TIFFDirEntry* dir)
  1717. {

libtiff/tif_dirwrite.c:1749:5: Call
  1747. 			*pb++=(uint32)(*pa++);
  1748. 		}
  1749. 		n=TIFFWriteDirectoryTagCheckedIfdArray(tif,ndir,dir,TIFFTAG_SUBIFD,tif->tif_dir.td_nsubifd,o);
            ^
  1750. 		_TIFFfree(o);
  1751. 	}

libtiff/tif_dirwrite.c:2149:1: Parameter `*dir`
    2147. }
    2148. 
    2149. static int
          ^
    2150. TIFFWriteDirectoryTagCheckedIfdArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
    2151. {

libtiff/tif_dirwrite.c:2156:9: Call
    2154. 	if (tif->tif_flags&TIFF_SWAB)
    2155. 		TIFFSwabArrayOfLong(value,count);
    2156. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_IFD,count,count*4,value));
                  ^
    2157. }
    2158. 

libtiff/tif_dirwrite.c:2170:1: <Offset trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*ndir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2170:1: <Length trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*dir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2189:2: Array access: Offset: [0, 36] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSubifd` 
      2187. 			dir[n]=dir[n-1];
      2188. 	}
      2189. 	dir[m].tdir_tag=tag;
             ^
      2190. 	dir[m].tdir_type=datatype;
      2191. 	dir[m].tdir_count=count;
