libtiff/tif_dirwrite.c:560: error: Buffer Overrun L3
  Offset: [0, 28] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSampleformatPerSample`.

libtiff/tif_dirwrite.c:400:2: Assignment
398. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
399. 	}
400. 	dir=NULL;
      ^
401. 	dirmem=NULL;
402. 	dirsize=0;

libtiff/tif_dirwrite.c:560:10: Call
558. 			if (TIFFFieldSet(tif,FIELD_SMAXSAMPLEVALUE))
559. 			{
560. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMAXSAMPLEVALUE,tif->tif_dir.td_smaxsamplevalue))
              ^
561. 					goto bad;
562. 			}

libtiff/tif_dirwrite.c:897:1: Parameter `*dir`
  895. }
  896. 
  897. static int
       ^
  898. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
  899. {

libtiff/tif_dirwrite.c:904:12: Call
  902. 		case SAMPLEFORMAT_IEEEFP:
  903. 			if (tif->tif_dir.td_bitspersample<=32)
  904. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
                  ^
  905. 			else
  906. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));

libtiff/tif_dirwrite.c:1347:1: Parameter `*dir`
    1345. }
    1346. 
    1347. static int TIFFWriteDirectoryTagFloatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, float value)
          ^
    1348. {
    1349. 	static const char module[] = "TIFFWriteDirectoryTagFloatPerSample";

libtiff/tif_dirwrite.c:1367:4: Call
    1365. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
    1366. 		*na=value;
    1367. 	o=TIFFWriteDirectoryTagCheckedFloatArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
             ^
    1368. 	_TIFFfree(m);
    1369. 	return(o);

libtiff/tif_dirwrite.c:2113:1: Parameter `*dir`
      2111. #endif
      2112. 
      2113. static int
            ^
      2114. TIFFWriteDirectoryTagCheckedFloatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
      2115. {

libtiff/tif_dirwrite.c:2121:9: Call
      2119. 	if (tif->tif_flags&TIFF_SWAB)
      2120. 		TIFFSwabArrayOfFloat(value,count);
      2121. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_FLOAT,count,count*4,value));
                    ^
      2122. }
      2123. 

libtiff/tif_dirwrite.c:2170:1: <Offset trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*ndir`
        2168. }
        2169. 
        2170. static int
              ^
        2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
        2172. {

libtiff/tif_dirwrite.c:2170:1: <Length trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*dir`
        2168. }
        2169. 
        2170. static int
              ^
        2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
        2172. {

libtiff/tif_dirwrite.c:2189:2: Array access: Offset: [0, 28] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSampleformatPerSample` 
        2187. 			dir[n]=dir[n-1];
        2188. 	}
        2189. 	dir[m].tdir_tag=tag;
               ^
        2190. 	dir[m].tdir_type=datatype;
        2191. 	dir[m].tdir_count=count;
