contrib/addtiffo/tif_ovrcache.c:256: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory`.

contrib/addtiffo/tif_ovrcache.c:232:5: Call
230. 				if ((iTileY+1)*psCache->nBlockYSize>psCache->nYSize)
231. 					RowsInStrip=psCache->nYSize-iTileY*psCache->nBlockYSize;
232. 				TIFFWriteEncodedStrip( psCache->hTIFF, nTileID,
         ^
233. 				    pabyData,
234. 				    TIFFVStripSize(psCache->hTIFF,RowsInStrip) );

libtiff/tif_write.c:183:1: Parameter `*tif->tif_dir.td_stripoffset`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

contrib/addtiffo/tif_ovrcache.c:254:5: Call
252. /*      Restore access to original directory.                           */
253. /* -------------------------------------------------------------------- */
254.     TIFFFlush( psCache->hTIFF );
         ^
255.     /* TODO: add checks on error status return of TIFFFlush */
256.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:32:1: Parameter `*tif->tif_dir.td_stripoffset`
  30. #include "tiffiop.h"
  31. 
  32. int
      ^
  33. TIFFFlush(TIFF* tif)
  34. {

contrib/addtiffo/tif_ovrcache.c:256:5: Call
254.     TIFFFlush( psCache->hTIFF );
255.     /* TODO: add checks on error status return of TIFFFlush */
256.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );
         ^
257.     /* TODO: add checks on error status return of TIFFSetSubDirectory */
258. }

libtiff/tif_dir.c:1384:1: Parameter `*tif->tif_dir.td_stripoffset`
  1382.  * the SubIFD tag (e.g. thumbnail images).
  1383.  */
  1384. int
        ^
  1385. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
  1386. {

libtiff/tif_dir.c:1393:10: Call
  1391. 	 */
  1392. 	tif->tif_dirnumber = 0;
  1393. 	return (TIFFReadDirectory(tif));
                 ^
  1394. }
  1395. 

libtiff/tif_dirread.c:3418:2: Call
    3416. 	/* free any old stuff and reinit */
    3417. 	TIFFFreeDirectory(tif);
    3418. 	TIFFDefaultDirectory(tif);
           ^
    3419. 	/*
    3420. 	 * Electronic Arts writes gray-scale TIFF files

libtiff/tif_dir.c:1147:2: Assignment
      1145. 	td->td_threshholding = THRESHHOLD_BILEVEL;
      1146. 	td->td_orientation = ORIENTATION_TOPLEFT;
      1147. 	td->td_samplesperpixel = 1;
             ^
      1148. 	td->td_rowsperstrip = (uint32) -1;
      1149. 	td->td_tilewidth = 0;

libtiff/tif_dirread.c:3832:8: Call
    3830. 				"\"%s\" field, calculating from imagelength",
    3831. 				TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
    3832. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
                 ^
    3833. 			    goto bad;
    3834. 		/*

libtiff/tif_dirread.c:4163:1: <Offset trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `tif->tif_dir.td_nstrips`
      4161. }
      4162. 
      4163. static int
            ^
      4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
      4165. {

libtiff/tif_dirread.c:4226:3: Assignment
      4224. 		 * of data in the strip and trim this number back accordingly.
      4225. 		 */
      4226. 		strip--;
              ^
      4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
      4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];

libtiff/tif_dirread.c:4163:1: <Length trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `*tif->tif_dir.td_stripoffset`
      4161. }
      4162. 
      4163. static int
            ^
      4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
      4165. {

libtiff/tif_dirread.c:4227:7: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory` 
      4225. 		 */
      4226. 		strip--;
      4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
                  ^
      4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
      4229. 	} else if (isTiled(tif)) {
