tools/thumbnail.c:620: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/thumbnail.c:619:13: Call
617.     diroff[0] = 0UL;
618.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
619.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
                 ^
620.             TIFFWriteDirectory(out) != -1);
621. }

libtiff/tif_write.c:183:1: Parameter `*tif->tif_rawdata`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

tools/thumbnail.c:620:13: Call
618.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
619.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
620.             TIFFWriteDirectory(out) != -1);
                 ^
621. }
622. 

libtiff/tif_dirwrite.c:180:1: Parameter `*tif->tif_rawdata`
  178.  * storage that's been changed.
  179.  */
  180. int
       ^
  181. TIFFWriteDirectory(TIFF* tif)
  182. {

libtiff/tif_dirwrite.c:183:9: Call
  181. TIFFWriteDirectory(TIFF* tif)
  182. {
  183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  184. }
  185. 

libtiff/tif_dirwrite.c:362:1: Parameter `*tif->tif_rawdata`
    360. }
    361. 
    362. static int
         ^
    363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    364. {

libtiff/tif_dirwrite.c:404:12: Call
    402. 		    && (tif->tif_flags & TIFF_BEENWRITING) != 0 )
    403. 		{
    404. 		    if( !TIFFFlushData1(tif) )
                    ^
    405.                     {
    406. 			TIFFErrorExt(tif->tif_clientdata, module,

libtiff/tif_write.c:712:1: Parameter `*tif->tif_rawdata`
      710.  * for infinite recursion.
      711.  */
      712. int
           ^
      713. TIFFFlushData1(TIFF* tif)
      714. {

libtiff/tif_write.c:718:4: Call
      716. 		if (!isFillOrder(tif, tif->tif_dir.td_fillorder) &&
      717. 		    (tif->tif_flags & TIFF_NOBITREV) == 0)
      718. 			TIFFReverseBits((uint8*)tif->tif_rawdata,
              ^
      719. 			    tif->tif_rawcc);
      720. 		if (!TIFFAppendToStrip(tif,

libtiff/tif_swab.c:285:1: <Length trace>
283. }
284. 
285. void
     ^
286. TIFFReverseBits(uint8* cp, tmsize_t n)  
287. {

libtiff/tif_swab.c:285:1: Parameter `*cp`
        283. }
        284. 
        285. void
             ^
        286. TIFFReverseBits(uint8* cp, tmsize_t n)  
        287. {

libtiff/tif_swab.c:296:3: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory` 
        294. 		cp[5] = TIFFBitRevTable[cp[5]];
        295. 		cp[6] = TIFFBitRevTable[cp[6]];
        296. 		cp[7] = TIFFBitRevTable[cp[7]];
               ^
        297. 		cp += 8;
        298. 	}
