libtiff/tif_dirwrite.c:648: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagAscii`.

libtiff/tif_dirwrite.c:422:2: Assignment
420. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
421. 	}
422. 	dir=NULL;
      ^
423. 	dirmem=NULL;
424. 	dirsize=0;

libtiff/tif_dirwrite.c:648:15: Call
646. 									TIFFGetField(tif,o->field_tag,&pb);
647. 									pa=(uint32)(strlen(pb));
648. 									if (!TIFFWriteDirectoryTagAscii(tif,&ndir,dir,o->field_tag,pa,pb))
                   ^
649. 										goto bad;
650. 								}

libtiff/tif_dirwrite.c:1035:1: Parameter `*dir`
  1033. #endif
  1034. 
  1035. static int
        ^
  1036. TIFFWriteDirectoryTagAscii(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, char* value)
  1037. {

libtiff/tif_dirwrite.c:1043:9: Call
  1041. 		return(1);
  1042. 	}
  1043. 	return(TIFFWriteDirectoryTagCheckedAscii(tif,ndir,dir,tag,count,value));
                ^
  1044. }
  1045. 

libtiff/tif_dirwrite.c:1896:1: Parameter `*dir`
    1894. }
    1895. 
    1896. static int
          ^
    1897. TIFFWriteDirectoryTagCheckedAscii(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, char* value)
    1898. {

libtiff/tif_dirwrite.c:1900:9: Call
    1898. {
    1899. 	assert(sizeof(char)==1);
    1900. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_ASCII,count,count,value));
                  ^
    1901. }
    1902. 

libtiff/tif_dirwrite.c:2293:1: <Offset trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*ndir`
      2291. }
      2292. 
      2293. static int
            ^
      2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2295. {

libtiff/tif_dirwrite.c:2293:1: <Length trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*dir`
      2291. }
      2292. 
      2293. static int
            ^
      2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2295. {

libtiff/tif_dirwrite.c:2310:4: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagAscii` 
      2308. 		uint32 n;
      2309. 		for (n=*ndir; n>m; n--)
      2310. 			dir[n]=dir[n-1];
               ^
      2311. 	}
      2312. 	dir[m].tdir_tag=tag;
