tools/tiff2pdf.c:5541: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `t2p_write_advance_directory`.

tools/tiff2pdf.c:5420:1: Parameter `output->tif_dir.td_samplesperpixel`
5418. */
5419. 
5420. tsize_t t2p_write_pdf(T2P* t2p, TIFF* input, TIFF* output){
      ^
5421. 
5422. 	tsize_t written=0;

tools/tiff2pdf.c:5540:16: Call
5538. 				streamlen=written;
5539. 				t2p_read_tiff_size_tile(t2p, input, i2);
5540. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
                     ^
5541. 				t2p_write_advance_directory(t2p, output);
5542. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2766:1: Parameter `output->tif_dir.td_samplesperpixel`
  2764.  */
  2765. 
  2766. tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){
        ^
  2767. 
  2768. 	uint16 edge=0;

tools/tiff2pdf.c:5541:5: Call
5539. 				t2p_read_tiff_size_tile(t2p, input, i2);
5540. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
5541. 				t2p_write_advance_directory(t2p, output);
          ^
5542. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}
5543. 				streamlen=written-streamlen;

tools/tiff2pdf.c:3620:1: Parameter `output->tif_dir.td_samplesperpixel`
  3618.  */
  3619. 
  3620. void
        ^
  3621. t2p_write_advance_directory(T2P* t2p, TIFF* output)
  3622. {

tools/tiff2pdf.c:3624:6: Call
  3622. {
  3623. 	t2p_disable(output);
  3624. 	if(!TIFFWriteDirectory(output)){
             ^
  3625. 		TIFFError(TIFF2PDF_MODULE, 
  3626. 			"Error writing virtual directory to output PDF %s", 

libtiff/tif_dirwrite.c:181:1: Parameter `tif->tif_dir.td_samplesperpixel`
    179.  * storage that's been changed.
    180.  */
    181. int
         ^
    182. TIFFWriteDirectory(TIFF* tif)
    183. {

libtiff/tif_dirwrite.c:184:9: Call
    182. TIFFWriteDirectory(TIFF* tif)
    183. {
    184. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    185. }
    186. 

libtiff/tif_dirwrite.c:363:1: Parameter `tif->tif_dir.td_samplesperpixel`
      361. }
      362. 
      363. static int
           ^
      364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      365. {

libtiff/tif_dirwrite.c:590:10: Call
      588. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
      589. 			{
      590. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                    ^
      591. 					goto bad;
      592. 			}

libtiff/tif_dirwrite.c:1011:1: Parameter `count`
        1009. }
        1010. 
        1011. static int
              ^
        1012. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
        1013. {

libtiff/tif_dirwrite.c:1018:9: Call
        1016. 	uint32 i;
        1017. 	int ok;
        1018. 	conv = _TIFFmalloc(count*sizeof(double));
                      ^
        1019. 	if (conv == NULL)
        1020. 	{

libtiff/tif_unix.c:314:17: Assignment
          312. {
          313.         if (s == 0)
          314.                 return ((void *) NULL);
                               ^
          315. 
          316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1018:2: Assignment
        1016. 	uint32 i;
        1017. 	int ok;
        1018. 	conv = _TIFFmalloc(count*sizeof(double));
               ^
        1019. 	if (conv == NULL)
        1020. 	{

libtiff/tif_dirwrite.c:1056:10: Call
        1054. 				for (i = 0; i < count; ++i)
        1055. 					((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
        1056. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                       ^
        1057. 			}
        1058. 			break;

libtiff/tif_dirwrite.c:1407:1: Parameter `*value`
          1405. #endif
          1406. 
          1407. static int
                ^
          1408. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
          1409. {

libtiff/tif_dirwrite.c:1415:9: Call
          1413. 		return(1);
          1414. 	}
          1415. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                        ^
          1416. }
          1417. 

libtiff/tif_dirwrite.c:2110:1: Parameter `*value`
            2108. #endif
            2109. 
            2110. static int
                  ^
            2111. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
            2112. {

libtiff/tif_dirwrite.c:2116:3: Call
            2114. 	assert(sizeof(int32)==4);
            2115. 	if (tif->tif_flags&TIFF_SWAB)
            2116. 		TIFFSwabArrayOfLong((uint32*)value,count);
                    ^
            2117. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
            2118. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
              102. 
              103. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
              104. void
                   ^
              105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
              106. {

libtiff/tif_swab.c:112:3: Assignment
              110. 	/* XXX unroll loop some */
              111. 	while (n-- > 0) {
              112. 		cp = (unsigned char *)lp;
                     ^
              113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
              114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `t2p_write_advance_directory` 
              111. 	while (n-- > 0) {
              112. 		cp = (unsigned char *)lp;
              113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                         ^
              114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
              115. 		lp++;
