tools/gif2tiff.c:510: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFClose`.

tools/gif2tiff.c:504:17: Call
502.     TIFFSetField(tif, TIFFTAG_ORIENTATION, ORIENTATION_TOPLEFT);
503.     strip = 0;
504.     stripsize = TIFFStripSize(tif);
                     ^
505.     for (row=0; row<height; row += rowsperstrip) {
506. 	if (TIFFWriteEncodedStrip(tif, strip, newras+row*width, stripsize) < 0)

libtiff/tif_strip.c:235:1: Parameter `tif->tif_dir.td_samplesperpixel`
  233. 	return (TIFFVStripSize64(tif, rps));
  234. }
  235. tmsize_t
       ^
  236. TIFFStripSize(TIFF* tif)
  237. {

libtiff/tif_strip.c:241:4: Call
  239. 	uint64 m;
  240. 	tmsize_t n;
  241. 	m=TIFFStripSize64(tif);
          ^
  242. 	n=(tmsize_t)m;
  243. 	if ((uint64)n!=m)

libtiff/tif_strip.c:226:1: Parameter `tif->tif_dir.td_samplesperpixel`
    224.  * to hold the strip.
    225.  */
    226. uint64
         ^
    227. TIFFStripSize64(TIFF* tif)
    228. {

libtiff/tif_strip.c:233:10: Call
    231. 	if (rps > td->td_imagelength)
    232. 		rps = td->td_imagelength;
    233. 	return (TIFFVStripSize64(tif, rps));
                  ^
    234. }
    235. tmsize_t

libtiff/tif_strip.c:103:1: Parameter `tif->tif_dir.td_samplesperpixel`
      101.  * Compute the # bytes in a variable height, row-aligned strip.
      102.  */
      103. uint64
           ^
      104. TIFFVStripSize64(TIFF* tif, uint32 nrows)
      105. {

tools/gif2tiff.c:510:5: Call
508. 	strip++;
509.     }
510.     TIFFClose(tif);
         ^
511. 
512.     _TIFFfree(newras);

libtiff/tif_close.c:122:1: Parameter `tif->tif_dir.td_samplesperpixel`
  120.  */
  121. 
  122. void
       ^
  123. TIFFClose(TIFF* tif)
  124. {

libtiff/tif_close.c:128:2: Call
  126. 	thandle_t fd = tif->tif_clientdata;
  127. 
  128. 	TIFFCleanup(tif);
        ^
  129. 	(void) (*closeproc)(fd);
  130. }

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_samplesperpixel`
    44.  */
    45. 
    46. void
        ^
    47. TIFFCleanup(TIFF* tif)
    48. {

libtiff/tif_close.c:53:3: Call
    51.          */
    52. 	if (tif->tif_mode != O_RDONLY)
    53. 		TIFFFlush(tif);
          ^
    54. 	(*tif->tif_cleanup)(tif);
    55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_samplesperpixel`
      30. #include "tiffiop.h"
      31. 
      32. int
          ^
      33. TIFFFlush(TIFF* tif)
      34. {

libtiff/tif_flush.c:83:13: Call
      81. 
      82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      83.         && !TIFFWriteDirectory(tif))
                      ^
      84.         return (0);
      85. 

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
        161.  * storage that's been changed.
        162.  */
        163. int
             ^
        164. TIFFWriteDirectory(TIFF* tif)
        165. {

libtiff/tif_dirwrite.c:166:9: Call
        164. TIFFWriteDirectory(TIFF* tif)
        165. {
        166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                     ^
        167. }
        168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
          343. }
          344. 
          345. static int
               ^
          346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
          347. {

libtiff/tif_dirwrite.c:555:10: Call
          553. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
          554. 			{
          555. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                        ^
          556. 					goto bad;
          557. 			}

libtiff/tif_dirwrite.c:897:1: Parameter `tif->tif_dir.td_samplesperpixel`
            895. }
            896. 
            897. static int
                 ^
            898. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
            899. {

libtiff/tif_dirwrite.c:906:12: Call
            904. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
            905. 			else
            906. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                            ^
            907. 		case SAMPLEFORMAT_INT:
            908. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1394:1: Parameter `tif->tif_dir.td_samplesperpixel`
              1392. }
              1393. 
              1394. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                    ^
              1395. {
              1396. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1406:4: Call
              1404. 		return(1);
              1405. 	}
              1406. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                       ^
              1407. 	if (m==NULL)
              1408. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
                251. #endif
                252. 
                253. void*
                     ^
                254. _TIFFmalloc(tmsize_t s)
                255. {

libtiff/tif_unix.c:256:10: Array declaration
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                              ^
                257. }
                258. 

libtiff/tif_unix.c:256:2: Assignment
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                      ^
                257. }
                258. 

libtiff/tif_dirwrite.c:1406:2: Assignment
              1404. 		return(1);
              1405. 	}
              1406. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                     ^
              1407. 	if (m==NULL)
              1408. 	{

libtiff/tif_dirwrite.c:1414:4: Call
              1412. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
              1413. 		*na=value;
              1414. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                       ^
              1415. 	_TIFFfree(m);
              1416. 	return(o);

libtiff/tif_dirwrite.c:2138:1: Parameter `*value`
                2136. #endif
                2137. 
                2138. static int
                      ^
                2139. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
                2140. {

libtiff/tif_dirwrite.c:2145:3: Call
                2143. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
                2144. 	if (tif->tif_flags&TIFF_SWAB)
                2145. 		TIFFSwabArrayOfDouble(value,count);
                        ^
                2146. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
                2147. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
                  181. 
                  182. #ifndef TIFFSwabArrayOfDouble
                  183. void
                       ^
                  184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
                  185. {

libtiff/tif_swab.c:191:3: Assignment
                  189. 	/* XXX unroll loop some */
                  190. 	while (n-- > 0) {
                  191. 		cp = (unsigned char *)dp;
                         ^
                  192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                  193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFClose` 
                  190. 	while (n-- > 0) {
                  191. 		cp = (unsigned char *)dp;
                  192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                             ^
                  193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
                  194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
