libtiff/tif_dirwrite.c:860: error: Buffer Overrun L3
  Offset: [17, +oo] (⇐ [16, +oo] + 1) Size: [0, +oo] by call to `TIFFSwabShort`.

libtiff/tif_dirwrite.c:363:1: Parameter `tif->tif_diroff`
361. }
362. 
363. static int
     ^
364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
365. {

libtiff/tif_dirwrite.c:839:9: Call
837. 		}
838. 	}
839. 	dirmem=_TIFFmalloc(dirsize);
             ^
840. 	if (dirmem==NULL)
841. 	{

libtiff/tif_unix.c:314:17: Assignment
  312. {
  313.         if (s == 0)
  314.                 return ((void *) NULL);
                       ^
  315. 
  316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:839:2: Assignment
837. 		}
838. 	}
839. 	dirmem=_TIFFmalloc(dirsize);
      ^
840. 	if (dirmem==NULL)
841. 	{

libtiff/tif_dirwrite.c:850:3: Assignment
848. 		uint32 nTmp;
849. 		TIFFDirEntry* o;
850. 		n=dirmem;
       ^
851. 		*(uint16*)n=(uint16)ndir;
852. 		if (tif->tif_flags&TIFF_SWAB)

libtiff/tif_dirwrite.c:854:3: Assignment
852. 		if (tif->tif_flags&TIFF_SWAB)
853. 			TIFFSwabShort((uint16*)n);
854. 		n+=2;
       ^
855. 		o=dir;
856. 		for (m=0; m<ndir; m++)

libtiff/tif_dirwrite.c:860:5: Call
858. 			*(uint16*)n=o->tdir_tag;
859. 			if (tif->tif_flags&TIFF_SWAB)
860. 				TIFFSwabShort((uint16*)n);
         ^
861. 			n+=2;
862. 			*(uint16*)n=o->tdir_type;

libtiff/tif_swab.c:35:1: <Length trace>
33. 
34. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabShort)
35. void
    ^
36. TIFFSwabShort(uint16* wp)
37. {

libtiff/tif_swab.c:35:1: Parameter `*wp`
  33. 
  34. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabShort)
  35. void
      ^
  36. TIFFSwabShort(uint16* wp)
  37. {

libtiff/tif_swab.c:38:2: Assignment
  36. TIFFSwabShort(uint16* wp)
  37. {
  38. 	register unsigned char* cp = (unsigned char*) wp;
       ^
  39. 	unsigned char t;
  40. 	assert(sizeof(uint16)==2);

libtiff/tif_swab.c:41:6: Array access: Offset: [17, +oo] (⇐ [16, +oo] + 1) Size: [0, +oo] by call to `TIFFSwabShort` 
  39. 	unsigned char t;
  40. 	assert(sizeof(uint16)==2);
  41. 	t = cp[1]; cp[1] = cp[0]; cp[0] = t;
           ^
  42. }
  43. #endif
