contrib/addtiffo/tif_overview.c:853: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `TIFFCreateOvrCache`.

contrib/addtiffo/tif_overview.c:844:22: Call
842.         }
843. 
844.         nDirOffset = TIFF_WriteOverview( hTIFF, nOXSize, nOYSize,
                          ^
845.                                          nBitsPerPixel, nPlanarConfig,
846.                                          nSamples, nOBlockXSize, nOBlockYSize,

contrib/addtiffo/tif_overview.c:146:9: Call
  144. /*      Write directory, and return byte offset.                        */
  145. /* -------------------------------------------------------------------- */
  146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
               ^
  147.         return 0;
  148. 

libtiff/tif_write.c:566:1: Parameter `*tif->tif_dir.td_stripbytecount`
    564.  * that important information is not changed.
    565.  */
    566. int
         ^
    567. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    568. {

contrib/addtiffo/tif_overview.c:853:25: Call
851.                                          nHorSubsampling, nVerSubsampling );
852.         
853.         papoRawBIs[i] = TIFFCreateOvrCache( hTIFF, nDirOffset );
                             ^
854.     }
855. 

contrib/addtiffo/tif_ovrcache.c:43:1: Parameter `*hTIFF->tif_dir.td_stripbytecount`
  41. /************************************************************************/
  42. 
  43. TIFFOvrCache *TIFFCreateOvrCache( TIFF *hTIFF, toff_t nDirOffset )
      ^
  44. 
  45. {

contrib/addtiffo/tif_ovrcache.c:57:5: Call
  55. /* -------------------------------------------------------------------- */
  56.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
  57.     TIFFSetSubDirectory( hTIFF, nDirOffset );
          ^
  58.     
  59.     TIFFGetField( hTIFF, TIFFTAG_IMAGEWIDTH, &(psCache->nXSize) );

libtiff/tif_dir.c:1631:1: Parameter `*tif->tif_dir.td_stripbytecount`
    1629.  * the SubIFD tag (e.g. thumbnail images).
    1630.  */
    1631. int
          ^
    1632. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
    1633. {

libtiff/tif_dir.c:1640:10: Call
    1638. 	 */
    1639. 	tif->tif_dirnumber = 0;
    1640. 	return (TIFFReadDirectory(tif));
                   ^
    1641. }
    1642. 

libtiff/tif_dirread.c:3872:38: <Length trace>
3870.                                     goto bad;
3871.                                 }
3872.                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))  
                                           ^
3873. 					goto bad;
3874. #endif                                

libtiff/tif_dirread.c:3872:38: Call
      3870.                                     goto bad;
      3871.                                 }
      3872.                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))  
                                                 ^
      3873. 					goto bad;
      3874. #endif                                

libtiff/tif_dirread.c:5537:1: Parameter `**lpp`
        5535.  * While this routine says "strips", in fact it's also used for tiles.
        5536.  */
        5537. static int
              ^
        5538. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
        5539. {

libtiff/tif_dirread.c:4113:47: Array access: Offset: 1 Size: [0, +oo] by call to `TIFFCreateOvrCache` 
      4111. 			   && tif->tif_dir.td_nstrips > 2
      4112. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
      4113. 			   && tif->tif_dir.td_stripbytecount[0] != tif->tif_dir.td_stripbytecount[1]
                                                          ^
      4114. 			   && tif->tif_dir.td_stripbytecount[0] != 0
      4115. 			   && tif->tif_dir.td_stripbytecount[1] != 0 ) {
