tools/tiffsplit.c:92: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory`.

tools/tiffsplit.c:89:9: Call
87. 			if (out == NULL)
88. 				return (-2);
89. 			if (!tiffcp(in, out))
            ^
90. 				return (-1);
91. 			TIFFClose(out);

tools/tiffsplit.c:157:1: Parameter `out->tif_dir.td_stripoffset`
  155. }
  156. 
  157. static int
       ^
  158. tiffcp(TIFF* in, TIFF* out)
  159. {

tools/tiffsplit.c:225:11: Call
  223. 	CopyField(TIFFTAG_FAXDCS, stringv);
  224. 	if (TIFFIsTiled(in))
  225. 		return (cpTiles(in, out));
                 ^
  226. 	else
  227. 		return (cpStrips(in, out));

tools/tiffsplit.c:260:1: Parameter `out->tif_dir.td_stripoffset`
    258. }
    259. 
    260. static int
         ^
    261. cpTiles(TIFF* in, TIFF* out)
    262. {

tools/tiffsplit.c:92:12: Call
90. 				return (-1);
91. 			TIFFClose(out);
92. 		} while (TIFFReadDirectory(in));
               ^
93. 		(void) TIFFClose(in);
94. 	}

libtiff/tif_dirread.c:3418:2: Call
  3416. 	/* free any old stuff and reinit */
  3417. 	TIFFFreeDirectory(tif);
  3418. 	TIFFDefaultDirectory(tif);
         ^
  3419. 	/*
  3420. 	 * Electronic Arts writes gray-scale TIFF files

libtiff/tif_dir.c:1147:2: Assignment
    1145. 	td->td_threshholding = THRESHHOLD_BILEVEL;
    1146. 	td->td_orientation = ORIENTATION_TOPLEFT;
    1147. 	td->td_samplesperpixel = 1;
           ^
    1148. 	td->td_rowsperstrip = (uint32) -1;
    1149. 	td->td_tilewidth = 0;

libtiff/tif_dirread.c:3832:8: Call
  3830. 				"\"%s\" field, calculating from imagelength",
  3831. 				TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
  3832. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
               ^
  3833. 			    goto bad;
  3834. 		/*

libtiff/tif_dirread.c:4163:1: <Offset trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `tif->tif_dir.td_nstrips`
    4161. }
    4162. 
    4163. static int
          ^
    4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
    4165. {

libtiff/tif_dirread.c:4226:3: Assignment
    4224. 		 * of data in the strip and trim this number back accordingly.
    4225. 		 */
    4226. 		strip--;
            ^
    4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
    4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];

libtiff/tif_dirread.c:4163:1: <Length trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `*tif->tif_dir.td_stripoffset`
    4161. }
    4162. 
    4163. static int
          ^
    4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
    4165. {

libtiff/tif_dirread.c:4227:7: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory` 
    4225. 		 */
    4226. 		strip--;
    4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
                ^
    4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
    4229. 	} else if (isTiled(tif)) {
