tools/thumbnail.c:620: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/thumbnail.c:567:1: Parameter `out->tif_dir.td_samplesperpixel`
565. }
566. 
567. static int
     ^
568. generateThumbnail(TIFF* in, TIFF* out)
569. {

tools/thumbnail.c:619:13: Call
617.     diroff[0] = 0UL;
618.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
619.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
                 ^
620.             TIFFWriteDirectory(out) != -1);
621. }

libtiff/tif_write.c:183:1: Parameter `tif->tif_dir.td_samplesperpixel`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

tools/thumbnail.c:620:13: Call
618.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
619.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
620.             TIFFWriteDirectory(out) != -1);
                 ^
621. }
622. 

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_samplesperpixel`
  178.  * storage that's been changed.
  179.  */
  180. int
       ^
  181. TIFFWriteDirectory(TIFF* tif)
  182. {

libtiff/tif_dirwrite.c:183:9: Call
  181. TIFFWriteDirectory(TIFF* tif)
  182. {
  183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  184. }
  185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_samplesperpixel`
    360. }
    361. 
    362. static int
         ^
    363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    364. {

libtiff/tif_dirwrite.c:577:10: Call
    575. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
    576. 			{
    577. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                  ^
    578. 					goto bad;
    579. 			}

libtiff/tif_dirwrite.c:928:1: Parameter `count`
      926. }
      927. 
      928. static int
           ^
      929. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
      930. {

libtiff/tif_dirwrite.c:935:9: Call
      933. 	uint32 i;
      934. 	int ok;
      935. 	conv = _TIFFmalloc(count*sizeof(double));
                   ^
      936. 	if (conv == NULL)
      937. 	{

libtiff/tif_unix.c:261:17: Assignment
        259. {
        260.         if (s == 0)
        261.                 return ((void *) NULL);
                             ^
        262. 
        263. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:935:2: Assignment
      933. 	uint32 i;
      934. 	int ok;
      935. 	conv = _TIFFmalloc(count*sizeof(double));
            ^
      936. 	if (conv == NULL)
      937. 	{

libtiff/tif_dirwrite.c:973:10: Call
      971. 				for (i = 0; i < count; ++i)
      972. 					((int32*)conv)[i] = (int32)value[i];
      973. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                    ^
      974. 			}
      975. 			break;

libtiff/tif_dirwrite.c:1324:1: Parameter `*value`
        1322. #endif
        1323. 
        1324. static int
              ^
        1325. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
        1326. {

libtiff/tif_dirwrite.c:1332:9: Call
        1330. 		return(1);
        1331. 	}
        1332. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                      ^
        1333. }
        1334. 

libtiff/tif_dirwrite.c:2020:1: Parameter `*value`
          2018. #endif
          2019. 
          2020. static int
                ^
          2021. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
          2022. {

libtiff/tif_dirwrite.c:2026:3: Call
          2024. 	assert(sizeof(int32)==4);
          2025. 	if (tif->tif_flags&TIFF_SWAB)
          2026. 		TIFFSwabArrayOfLong((uint32*)value,count);
                  ^
          2027. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
          2028. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
            102. 
            103. #ifndef TIFFSwabArrayOfLong
            104. void
                 ^
            105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
            106. {

libtiff/tif_swab.c:112:3: Assignment
            110. 	/* XXX unroll loop some */
            111. 	while (n-- > 0) {
            112. 		cp = (unsigned char *)lp;
                   ^
            113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
            114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory` 
            111. 	while (n-- > 0) {
            112. 		cp = (unsigned char *)lp;
            113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                       ^
            114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
            115. 		lp++;
