contrib/addtiffo/tif_ovrcache.c:257: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory`.

contrib/addtiffo/tif_ovrcache.c:168:12: Call
166. /* -------------------------------------------------------------------- */
167.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
168.     nRet = TIFFSetSubDirectory( psCache->hTIFF, psCache->nDirOffset );
                ^
169.     assert( nRet == 1 );
170. 

libtiff/tif_dir.c:1649:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  1647.  * the SubIFD tag (e.g. thumbnail images).
  1648.  */
  1649. int
        ^
  1650. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
  1651. {

libtiff/tif_dir.c:1658:10: Call
  1656. 	 */
  1657. 	tif->tif_dirnumber = 0;
  1658. 	return (TIFFReadDirectory(tif));
                 ^
  1659. }
  1660. 

libtiff/tif_dirread.c:3573:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    3571.  * format. We read directories sequentially.
    3572.  */
    3573. int
          ^
    3574. TIFFReadDirectory(TIFF* tif)
    3575. {

contrib/addtiffo/tif_ovrcache.c:255:5: Call
253. /*      Restore access to original directory.                           */
254. /* -------------------------------------------------------------------- */
255.     TIFFFlush( psCache->hTIFF );
         ^
256.     /* TODO: add checks on error status return of TIFFFlush */
257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:30:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  28. #include "tiffiop.h"
  29. 
  30. int
      ^
  31. TIFFFlush(TIFF* tif)
  32. {

contrib/addtiffo/tif_ovrcache.c:257:5: Call
255.     TIFFFlush( psCache->hTIFF );
256.     /* TODO: add checks on error status return of TIFFFlush */
257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );
         ^
258.     /* TODO: add checks on error status return of TIFFSetSubDirectory */
259. }

libtiff/tif_dir.c:1649:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  1647.  * the SubIFD tag (e.g. thumbnail images).
  1648.  */
  1649. int
        ^
  1650. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
  1651. {

libtiff/tif_dir.c:1658:10: Call
  1656. 	 */
  1657. 	tif->tif_dirnumber = 0;
  1658. 	return (TIFFReadDirectory(tif));
                 ^
  1659. }
  1660. 

libtiff/tif_dirread.c:3573:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    3571.  * format. We read directories sequentially.
    3572.  */
    3573. int
          ^
    3574. TIFFReadDirectory(TIFF* tif)
    3575. {

libtiff/tif_dirread.c:3627:2: Call
    3625. 
    3626. 	/* free any old stuff and reinit */
    3627. 	TIFFFreeDirectory(tif);
           ^
    3628. 	TIFFDefaultDirectory(tif);
    3629. 	/*

libtiff/tif_dir.c:1266:1: Parameter `*tif->tif_dir.td_stripoffset_p`
      1264.  * Release storage associated with a directory.
      1265.  */
      1266. void
            ^
      1267. TIFFFreeDirectory(TIFF* tif)
      1268. {

libtiff/tif_dirread.c:4277:13: Call
    4275.             TIFFStripSize64(tif) > 0x7FFFFFFFUL )
    4276.         {
    4277.             TryChopUpUncompressedBigTiff(tif);
                      ^
    4278.         }
    4279. 

libtiff/tif_dirread.c:5936:10: Assignment
      5934. 
      5935.     /* Check that the strips are contiguous and of the expected size */
      5936.     for( i = 0; i < td->td_nstrips; i++ )
                     ^
      5937.     {
      5938.         if( i == td->td_nstrips - 1 )

libtiff/tif_dirread.c:5952:26: Call
      5950.                 return;
      5951.             }
      5952.             if( i > 0 && TIFFGetStrileOffset(tif, i) !=
                                     ^
      5953.                     TIFFGetStrileOffset(tif, i-1) + TIFFGetStrileByteCount(tif, i-1) )
      5954.             {

libtiff/tif_dirread.c:6290:1: Parameter `strile`
        6288. 
        6289. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
        6290. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
              ^
        6291. {
        6292.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6292:12: Call
        6290. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
        6291. {
        6292.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
                         ^
        6293. }
        6294. 

libtiff/tif_dirread.c:6296:1: Parameter `strile`
          6294. 
          6295. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
          6296. uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)
                ^
          6297. {
          6298.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6299:12: Call
          6297. {
          6298.     TIFFDirectory *td = &tif->tif_dir;
          6299.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                           ^
          6300.                                &(td->td_stripoffset_entry),
          6301.                                &(td->td_stripoffset_p), pbErr);

libtiff/tif_dirread.c:6246:1: Parameter `strile`
            6244. }
            6245. 
            6246. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                  ^
            6247.                                                    TIFFDirEntry* dirent,
            6248.                                                    uint64** parray,

libtiff/tif_dirread.c:6272:19: Call
            6270.         else
            6271.         {
            6272.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                    ^
            6273.              {
            6274.                 if( pbErr )

libtiff/tif_dirread.c:6143:1: <Offset trace>
6141. }
6142. 
6143. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6144.                                  uint32 strile,
6145.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6143:1: Parameter `strile`
              6141. }
              6142. 
              6143. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6144.                                  uint32 strile,
              6145.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6143:1: <Length trace>
6141. }
6142. 
6143. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6144.                                  uint32 strile,
6145.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6143:1: Parameter `**parray`
              6141. }
              6142. 
              6143. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6144.                                  uint32 strile,
              6145.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6234:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory` 
              6232.         return 0;
              6233. 
              6234.     if( ~((*parray)[strile]) == 0 )
                             ^
              6235.     {
              6236.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
