contrib/addtiffo/tif_overview.c:162: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:149:9: Call
147. /*      Write directory, and return byte offset.                        */
148. /* -------------------------------------------------------------------- */
149.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
150.         return 0;
151. 

libtiff/tif_write.c:564:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
  562.  * that important information is not changed.
  563.  */
  564. int
       ^
  565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  566. {

contrib/addtiffo/tif_overview.c:152:5: Call
150.         return 0;
151. 
152.     TIFFWriteDirectory( hTIFF );
         ^
153.     iNumDir = TIFFNumberOfDirectories(hTIFF);
154.     if( iNumDir > TIFF_DIR_MAX )

libtiff/tif_dirwrite.c:178:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
  176.  * storage that's been changed.
  177.  */
  178. int
       ^
  179. TIFFWriteDirectory(TIFF* tif)
  180. {

libtiff/tif_dirwrite.c:181:9: Call
  179. TIFFWriteDirectory(TIFF* tif)
  180. {
  181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  182. }
  183. 

libtiff/tif_dirwrite.c:360:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
    358. }
    359. 
    360. static int
         ^
    361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    362. {

contrib/addtiffo/tif_overview.c:162:5: Call
160.         exit(-1);
161.     }
162.     TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) );
         ^
163. 
164.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1615:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
  1613.  * NB: Directories are numbered starting at 0.
  1614.  */
  1615. int
        ^
  1616. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1617. {

libtiff/tif_dir.c:1640:10: Call
  1638. 	 */
  1639. 	tif->tif_dirnumber = 0;
  1640. 	return (TIFFReadDirectory(tif));
                 ^
  1641. }
  1642. 

libtiff/tif_dirread.c:3938:42: Call
    3936.                                         goto bad;
    3937.                                     }
    3938.                                     if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount_p))  
                                                   ^
    3939.                                             goto bad;
    3940.                                 }

libtiff/tif_dirread.c:5621:1: Parameter `**lpp`
      5619.  * While this routine says "strips", in fact it's also used for tiles.
      5620.  */
      5621. static int
            ^
      5622. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
      5623. {

libtiff/tif_dirread.c:4187:10: Call
    4185. 			   && tif->tif_dir.td_nstrips > 2
    4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
    4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                   ^
    4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
    4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6248:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
      6246. 
      6247. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
      6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
            ^
      6249. {
      6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6250:12: Call
      6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
      6249. {
      6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                       ^
      6251. }
      6252. 

libtiff/tif_dirread.c:6254:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
        6252. 
        6253. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
        6254. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
              ^
        6255. {
        6256.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6257:12: Call
        6255. {
        6256.     TIFFDirectory *td = &tif->tif_dir;
        6257.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                         ^
        6258.                                &(td->td_stripbytecount_entry),
        6259.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
          6189. }
          6190. 
          6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                ^
          6192.                                                    TIFFDirEntry* dirent,
          6193.                                                    uint64** parray,

libtiff/tif_dirread.c:4187:44: Call
    4185. 			   && tif->tif_dir.td_nstrips > 2
    4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
    4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                     ^
    4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
    4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6248:1: Parameter `strile`
      6246. 
      6247. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
      6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
            ^
      6249. {
      6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6250:12: Call
      6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
      6249. {
      6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                       ^
      6251. }
      6252. 

libtiff/tif_dirread.c:6254:1: Parameter `strile`
        6252. 
        6253. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
        6254. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
              ^
        6255. {
        6256.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6257:12: Call
        6255. {
        6256.     TIFFDirectory *td = &tif->tif_dir;
        6257.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                         ^
        6258.                                &(td->td_stripbytecount_entry),
        6259.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `strile`
          6189. }
          6190. 
          6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                ^
          6192.                                                    TIFFDirEntry* dirent,
          6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6215:19: Call
          6213.         else
          6214.         {
          6215.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                  ^
          6216.              {
          6217.                 if( pbErr )

libtiff/tif_dirread.c:6088:1: <Offset trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `strile`
            6086. }
            6087. 
            6088. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6089.                                  uint32 strile,
            6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: <Length trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `**parray`
            6086. }
            6087. 
            6088. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6089.                                  uint32 strile,
            6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6179:10: Array access: Offset: 1 Size: [0, +oo] by call to `TIFFSetDirectory` 
            6177.         return 0;
            6178. 
            6179.     if( ~((*parray)[strile]) == 0 )
                           ^
            6180.     {
            6181.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
