contrib/addtiffo/tif_ovrcache.c:257: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFFlush`.

contrib/addtiffo/tif_ovrcache.c:235:5: Call
233. 				if ((iTileY+1)*psCache->nBlockYSize>psCache->nYSize)
234. 					RowsInStrip=psCache->nYSize-iTileY*psCache->nBlockYSize;
235. 				TIFFWriteEncodedStrip( psCache->hTIFF, nTileID,
         ^
236. 				    pabyData,
237. 				    TIFFVStripSize(psCache->hTIFF,RowsInStrip) );

libtiff/tif_write.c:187:1: Parameter `*tif->tif_dir.td_stripbytecount`
  185.  * NB: Image length must be setup before writing.
  186.  */
  187. tmsize_t
       ^
  188. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  189. {

contrib/addtiffo/tif_ovrcache.c:257:5: Call
255. /*      Restore access to original directory.                           */
256. /* -------------------------------------------------------------------- */
257.     TIFFFlush( psCache->hTIFF );
         ^
258.     /* TODO: add checks on error status return of TIFFFlush */
259.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:32:1: Parameter `*tif->tif_dir.td_stripbytecount`
  30. #include "tiffiop.h"
  31. 
  32. int
      ^
  33. TIFFFlush(TIFF* tif)
  34. {

libtiff/tif_flush.c:83:13: Call
  81. 
  82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
  83.         && !TIFFRewriteDirectory(tif))
                  ^
  84.         return (0);
  85. 

libtiff/tif_dirwrite.c:217:1: Parameter `*tif->tif_dir.td_stripbytecount`
    215.  * previously used directory space. 
    216.  */ 
    217. int
         ^
    218. TIFFRewriteDirectory( TIFF *tif )
    219. {

libtiff/tif_dirwrite.c:224:10: Call
    222. 	/* We don't need to do anything special if it hasn't been written. */
    223. 	if( tif->tif_diroff == 0 )
    224. 		return TIFFWriteDirectory( tif );
                  ^
    225. 
    226. 	/*

libtiff/tif_dirwrite.c:181:1: Parameter `*tif->tif_dir.td_stripbytecount`
      179.  * storage that's been changed.
      180.  */
      181. int
           ^
      182. TIFFWriteDirectory(TIFF* tif)
      183. {

libtiff/tif_dirwrite.c:184:9: Call
      182. TIFFWriteDirectory(TIFF* tif)
      183. {
      184. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                   ^
      185. }
      186. 

libtiff/tif_dirwrite.c:363:1: Parameter `*tif->tif_dir.td_stripbytecount`
        361. }
        362. 
        363. static int
             ^
        364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
        365. {

libtiff/tif_dirwrite.c:533:11: Call
        531. 				if (!isTiled(tif))
        532. 				{
        533. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                       ^
        534. 						goto bad;
        535. 				}

libtiff/tif_dirwrite.c:1670:1: Parameter `*value`
          1668. /************************************************************************/
          1669. 
          1670. static int
                ^
          1671. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
          1672. {

libtiff/tif_dirwrite.c:1689:16: Call
          1687.     /* We always write LONG8 for BigTIFF, no checking needed. */
          1688.     if( tif->tif_flags&TIFF_BIGTIFF )
          1689.         return TIFFWriteDirectoryTagCheckedLong8Array(tif,ndir,dir,
                               ^
          1690.                                                       tag,count,value);
          1691. 

libtiff/tif_dirwrite.c:2137:1: Parameter `*value`
            2135. #endif
            2136. 
            2137. static int
                  ^
            2138. TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
            2139. {

libtiff/tif_dirwrite.c:2147:3: Call
            2145. 	}
            2146. 	if (tif->tif_flags&TIFF_SWAB)
            2147. 		TIFFSwabArrayOfLong8(value,count);
                    ^
            2148. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
            2149. }

libtiff/tif_swab.c:121:1: <Length trace>
119. 
120. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
121. void
     ^
122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
123. {

libtiff/tif_swab.c:121:1: Parameter `*lp`
              119. 
              120. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
              121. void
                   ^
              122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
              123. {

libtiff/tif_swab.c:129:3: Assignment
              127. 	/* XXX unroll loop some */
              128. 	while (n-- > 0) {
              129. 		cp = (unsigned char *)lp;
                     ^
              130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
              131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:130:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFFlush` 
              128. 	while (n-- > 0) {
              129. 		cp = (unsigned char *)lp;
              130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                         ^
              131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
              132. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
