libtiff/tif_dirwrite.c:439: error: Buffer Overrun L3
  Offset: [0, 2] Size: [0, +oo] by call to `TIFFWriteDirectoryTagShortLong`.

libtiff/tif_dirwrite.c:422:2: Assignment
420. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
421. 	}
422. 	dir=NULL;
      ^
423. 	dirmem=NULL;
424. 	dirsize=0;

libtiff/tif_dirwrite.c:439:10: Call
437. 			if (TIFFFieldSet(tif,FIELD_TILEDIMENSIONS))
438. 			{
439. 				if (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_TILEWIDTH,tif->tif_dir.td_tilewidth))
              ^
440. 					goto bad;
441. 				if (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_TILELENGTH,tif->tif_dir.td_tilelength))

libtiff/tif_dirwrite.c:1566:1: Parameter `*dir`
  1564. #endif
  1565. 
  1566. static int
        ^
  1567. TIFFWriteDirectoryTagShortLong(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 value)
  1568. {

libtiff/tif_dirwrite.c:1575:10: Call
  1573. 	}
  1574. 	if (value<=0xFFFF)
  1575. 		return(TIFFWriteDirectoryTagCheckedShort(tif,ndir,dir,tag,(uint16)value));
                 ^
  1576. 	else
  1577. 		return(TIFFWriteDirectoryTagCheckedLong(tif,ndir,dir,tag,value));

libtiff/tif_dirwrite.c:1942:1: Parameter `*dir`
    1940. }
    1941. 
    1942. static int
          ^
    1943. TIFFWriteDirectoryTagCheckedShort(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 value)
    1944. {

libtiff/tif_dirwrite.c:1950:9: Call
    1948. 	if (tif->tif_flags&TIFF_SWAB)
    1949. 		TIFFSwabShort(&m);
    1950. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,1,2,&m));
                  ^
    1951. }
    1952. 

libtiff/tif_dirwrite.c:2293:1: <Offset trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*ndir`
      2291. }
      2292. 
      2293. static int
            ^
      2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2295. {

libtiff/tif_dirwrite.c:2293:1: <Length trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*dir`
      2291. }
      2292. 
      2293. static int
            ^
      2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2295. {

libtiff/tif_dirwrite.c:2312:2: Array access: Offset: [0, 2] Size: [0, +oo] by call to `TIFFWriteDirectoryTagShortLong` 
      2310. 			dir[n]=dir[n-1];
      2311. 	}
      2312. 	dir[m].tdir_tag=tag;
             ^
      2313. 	dir[m].tdir_type=datatype;
      2314. 	dir[m].tdir_count=count;
