tools/thumbnail.c:616: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/thumbnail.c:563:1: Parameter `out->tif_dir.td_samplesperpixel`
561. }
562. 
563. static int
     ^
564. generateThumbnail(TIFF* in, TIFF* out)
565. {

tools/thumbnail.c:615:13: Call
613.     diroff[0] = 0UL;
614.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
615.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
                 ^
616.             TIFFWriteDirectory(out) != -1);
617. }

libtiff/tif_write.c:183:1: Parameter `tif->tif_dir.td_samplesperpixel`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

tools/thumbnail.c:616:13: Call
614.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
615.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
616.             TIFFWriteDirectory(out) != -1);
                 ^
617. }
618. 

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
  161.  * storage that's been changed.
  162.  */
  163. int
       ^
  164. TIFFWriteDirectory(TIFF* tif)
  165. {

libtiff/tif_dirwrite.c:166:9: Call
  164. TIFFWriteDirectory(TIFF* tif)
  165. {
  166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  167. }
  168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
    343. }
    344. 
    345. static int
         ^
    346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    347. {

libtiff/tif_dirwrite.c:443:10: Call
    441. 			if (TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
    442. 			{
    443. 				if (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_BITSPERSAMPLE,tif->tif_dir.td_bitspersample))
                  ^
    444. 					goto bad;
    445. 			}

libtiff/tif_dirwrite.c:1070:1: Parameter `tif->tif_dir.td_samplesperpixel`
      1068. }
      1069. 
      1070. static int
            ^
      1071. TIFFWriteDirectoryTagShortPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 value)
      1072. {

libtiff/tif_dirwrite.c:1083:4: Call
      1081. 		return(1);
      1082. 	}
      1083. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(uint16));
               ^
      1084. 	if (m==NULL)
      1085. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
        251. #endif
        252. 
        253. void*
             ^
        254. _TIFFmalloc(tmsize_t s)
        255. {

libtiff/tif_unix.c:256:10: Array declaration
        254. _TIFFmalloc(tmsize_t s)
        255. {
        256. 	return (malloc((size_t) s));
                      ^
        257. }
        258. 

libtiff/tif_unix.c:256:2: Assignment
        254. _TIFFmalloc(tmsize_t s)
        255. {
        256. 	return (malloc((size_t) s));
              ^
        257. }
        258. 

libtiff/tif_dirwrite.c:1083:2: Assignment
      1081. 		return(1);
      1082. 	}
      1083. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(uint16));
             ^
      1084. 	if (m==NULL)
      1085. 	{

libtiff/tif_dirwrite.c:1091:4: Call
      1089. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
      1090. 		*na=value;
      1091. 	o=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
               ^
      1092. 	_TIFFfree(m);
      1093. 	return(o);

libtiff/tif_dirwrite.c:1830:1: Parameter `*value`
        1828. }
        1829. 
        1830. static int
              ^
        1831. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
        1832. {

libtiff/tif_dirwrite.c:1836:3: Call
        1834. 	assert(sizeof(uint16)==2);
        1835. 	if (tif->tif_flags&TIFF_SWAB)
        1836. 		TIFFSwabArrayOfShort(value,count);
                ^
        1837. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
        1838. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
          70. 
          71. #ifndef TIFFSwabArrayOfShort
          72. void
              ^
          73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
          74. {

libtiff/tif_swab.c:80:3: Assignment
          78. 	/* XXX unroll loop some */
          79. 	while (n-- > 0) {
          80. 		cp = (unsigned char*) wp;
                ^
          81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
          82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectory` 
          79. 	while (n-- > 0) {
          80. 		cp = (unsigned char*) wp;
          81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
                    ^
          82. 		wp++;
          83. 	}
