libtiff/tif_dirwrite.c:200: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec`.

libtiff/tif_dirwrite.c:193:1: Parameter `tif->tif_dir.td_nstrips`
191.  * readable before it is successfully completed/closed.
192.  */
193. int
     ^
194. TIFFCheckpointDirectory(TIFF* tif)
195. {

libtiff/tif_dirwrite.c:200:7: Call
198. 	if (tif->tif_dir.td_stripoffset == NULL)
199. 	    (void) TIFFSetupStrips(tif);
200. 	rc = TIFFWriteDirectorySec(tif,TRUE,FALSE,NULL);
           ^
201. 	(void) TIFFSetWriteOffset(tif, TIFFSeekFile(tif, 0, SEEK_END));
202. 	return rc;

libtiff/tif_dirwrite.c:363:1: Parameter `tif->tif_dir.td_nstrips`
  361. }
  362. 
  363. static int
       ^
  364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
  365. {

libtiff/tif_dirwrite.c:533:11: Call
  531. 				if (!isTiled(tif))
  532. 				{
  533. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                 ^
  534. 						goto bad;
  535. 				}

libtiff/tif_dirwrite.c:1670:1: Parameter `count`
    1668. /************************************************************************/
    1669. 
    1670. static int
          ^
    1671. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
    1672. {

libtiff/tif_dirwrite.c:1697:9: Call
    1695.     */
    1696. 
    1697.     p = _TIFFmalloc(count*sizeof(uint32));
                  ^
    1698.     if (p==NULL)
    1699.     {

libtiff/tif_unix.c:314:17: Assignment
      312. {
      313.         if (s == 0)
      314.                 return ((void *) NULL);
                           ^
      315. 
      316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1697:5: Assignment
    1695.     */
    1696. 
    1697.     p = _TIFFmalloc(count*sizeof(uint32));
              ^
    1698.     if (p==NULL)
    1699.     {

libtiff/tif_dirwrite.c:1716:7: Call
    1714.     }
    1715. 
    1716.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                ^
    1717.     _TIFFfree(p);
    1718. 

libtiff/tif_dirwrite.c:2087:1: Parameter `*value`
      2085. }
      2086. 
      2087. static int
            ^
      2088. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
      2089. {

libtiff/tif_dirwrite.c:2093:3: Call
      2091. 	assert(sizeof(uint32)==4);
      2092. 	if (tif->tif_flags&TIFF_SWAB)
      2093. 		TIFFSwabArrayOfLong(value,count);
              ^
      2094. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
      2095. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
        102. 
        103. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
        104. void
             ^
        105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
        106. {

libtiff/tif_swab.c:112:3: Assignment
        110. 	/* XXX unroll loop some */
        111. 	while (n-- > 0) {
        112. 		cp = (unsigned char *)lp;
               ^
        113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
        114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec` 
        111. 	while (n-- > 0) {
        112. 		cp = (unsigned char *)lp;
        113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                   ^
        114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
        115. 		lp++;
