libtiff/tif_dirwrite.c:621: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagAscii`.

libtiff/tif_dirwrite.c:400:2: Assignment
398. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
399. 	}
400. 	dir=NULL;
      ^
401. 	dirmem=NULL;
402. 	dirsize=0;

libtiff/tif_dirwrite.c:621:15: Call
619. 									TIFFGetField(tif,o->field_tag,&pb);
620. 									pa=(uint32)(strlen(pb));
621. 									if (!TIFFWriteDirectoryTagAscii(tif,&ndir,dir,o->field_tag,pa,pb))
                   ^
622. 										goto bad;
623. 								}

libtiff/tif_dirwrite.c:926:1: Parameter `*dir`
  924. }
  925. 
  926. static int
       ^
  927. TIFFWriteDirectoryTagAscii(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, char* value)
  928. {

libtiff/tif_dirwrite.c:934:9: Call
  932. 		return(1);
  933. 	}
  934. 	return(TIFFWriteDirectoryTagCheckedAscii(tif,ndir,dir,tag,count,value));
               ^
  935. }
  936. 

libtiff/tif_dirwrite.c:1773:1: Parameter `*dir`
    1771. }
    1772. 
    1773. static int
          ^
    1774. TIFFWriteDirectoryTagCheckedAscii(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, char* value)
    1775. {

libtiff/tif_dirwrite.c:1777:9: Call
    1775. {
    1776. 	assert(sizeof(char)==1);
    1777. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_ASCII,count,count,value));
                  ^
    1778. }
    1779. 

libtiff/tif_dirwrite.c:2170:1: <Offset trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*ndir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2170:1: <Length trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*dir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2187:4: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagAscii` 
      2185. 		uint32 n;
      2186. 		for (n=*ndir; n>m; n--)
      2187. 			dir[n]=dir[n-1];
               ^
      2188. 	}
      2189. 	dir[m].tdir_tag=tag;
