contrib/addtiffo/tif_overview.c:150: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:146:9: Call
144. /*      Write directory, and return byte offset.                        */
145. /* -------------------------------------------------------------------- */
146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
147.         return 0;
148. 

libtiff/tif_write.c:488:1: Parameter `*tif->tif_dir.td_stripoffset`
  486.  * that important information is not changed.
  487.  */
  488. int
       ^
  489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  490. {

contrib/addtiffo/tif_overview.c:149:5: Call
147.         return 0;
148. 
149.     TIFFWriteDirectory( hTIFF );
         ^
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
151. 

libtiff/tif_dirwrite.c:163:1: Parameter `*tif->tif_dir.td_stripoffset`
  161.  * storage that's been changed.
  162.  */
  163. int
       ^
  164. TIFFWriteDirectory(TIFF* tif)
  165. {

libtiff/tif_dirwrite.c:166:9: Call
  164. TIFFWriteDirectory(TIFF* tif)
  165. {
  166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  167. }
  168. 

libtiff/tif_dirwrite.c:345:1: Parameter `*tif->tif_dir.td_stripoffset`
    343. }
    344. 
    345. static int
         ^
    346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    347. {

contrib/addtiffo/tif_overview.c:150:5: Call
148. 
149.     TIFFWriteDirectory( hTIFF );
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
         ^
151. 
152.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1350:1: Parameter `*tif->tif_dir.td_stripoffset`
  1348.  * NB: Directories are numbered starting at 0.
  1349.  */
  1350. int
        ^
  1351. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1352. {

libtiff/tif_dir.c:1375:10: Call
  1373. 	 */
  1374. 	tif->tif_dirnumber = 0;
  1375. 	return (TIFFReadDirectory(tif));
                 ^
  1376. }
  1377. 

libtiff/tif_dirread.c:3418:2: Call
    3416. 	/* free any old stuff and reinit */
    3417. 	TIFFFreeDirectory(tif);
    3418. 	TIFFDefaultDirectory(tif);
           ^
    3419. 	/*
    3420. 	 * Electronic Arts writes gray-scale TIFF files

libtiff/tif_dir.c:1147:2: Assignment
      1145. 	td->td_threshholding = THRESHHOLD_BILEVEL;
      1146. 	td->td_orientation = ORIENTATION_TOPLEFT;
      1147. 	td->td_samplesperpixel = 1;
             ^
      1148. 	td->td_rowsperstrip = (uint32) -1;
      1149. 	td->td_tilewidth = 0;

libtiff/tif_dirread.c:3832:8: Call
    3830. 				"\"%s\" field, calculating from imagelength",
    3831. 				TIFFFieldWithTag(tif,TIFFTAG_STRIPBYTECOUNTS)->field_name);
    3832. 			if (EstimateStripByteCounts(tif, dir, dircount) < 0)
                 ^
    3833. 			    goto bad;
    3834. 		/*

libtiff/tif_dirread.c:4163:1: <Offset trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `tif->tif_dir.td_nstrips`
      4161. }
      4162. 
      4163. static int
            ^
      4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
      4165. {

libtiff/tif_dirread.c:4226:3: Assignment
      4224. 		 * of data in the strip and trim this number back accordingly.
      4225. 		 */
      4226. 		strip--;
              ^
      4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
      4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];

libtiff/tif_dirread.c:4163:1: <Length trace>
4161. }
4162. 
4163. static int
      ^
4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
4165. {

libtiff/tif_dirread.c:4163:1: Parameter `*tif->tif_dir.td_stripoffset`
      4161. }
      4162. 
      4163. static int
            ^
      4164. EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
      4165. {

libtiff/tif_dirread.c:4227:7: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory` 
      4225. 		 */
      4226. 		strip--;
      4227. 		if (td->td_stripoffset[strip]+td->td_stripbytecount[strip] > filesize)
                  ^
      4228. 			td->td_stripbytecount[strip] = filesize - td->td_stripoffset[strip];
      4229. 	} else if (isTiled(tif)) {
