libtiff/tif_dirwrite.c:182: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec`.

libtiff/tif_dirwrite.c:175:1: Parameter `tif->tif_dir.td_nstrips`
173.  * readable before it is successfully completed/closed.
174.  */
175. int
     ^
176. TIFFCheckpointDirectory(TIFF* tif)
177. {

libtiff/tif_dirwrite.c:182:7: Call
180. 	if (tif->tif_dir.td_stripoffset == NULL)
181. 	    (void) TIFFSetupStrips(tif);
182. 	rc = TIFFWriteDirectorySec(tif,TRUE,FALSE,NULL);
           ^
183. 	(void) TIFFSetWriteOffset(tif, TIFFSeekFile(tif, 0, SEEK_END));
184. 	return rc;

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_nstrips`
  343. }
  344. 
  345. static int
       ^
  346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
  347. {

libtiff/tif_dirwrite.c:510:11: Call
  508. 				if (!isTiled(tif))
  509. 				{
  510. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                 ^
  511. 						goto bad;
  512. 				}

libtiff/tif_dirwrite.c:1464:1: Parameter `count`
    1462. /************************************************************************/
    1463. 
    1464. static int
          ^
    1465. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
    1466. {

libtiff/tif_dirwrite.c:1491:9: Call
    1489.     */
    1490. 
    1491.     p = _TIFFmalloc(count*sizeof(uint32));
                  ^
    1492.     if (p==NULL)
    1493.     {

libtiff/tif_unix.c:253:1: Parameter `s`
      251. #endif
      252. 
      253. void*
           ^
      254. _TIFFmalloc(tmsize_t s)
      255. {

libtiff/tif_unix.c:256:10: Array declaration
      254. _TIFFmalloc(tmsize_t s)
      255. {
      256. 	return (malloc((size_t) s));
                    ^
      257. }
      258. 

libtiff/tif_unix.c:256:2: Assignment
      254. _TIFFmalloc(tmsize_t s)
      255. {
      256. 	return (malloc((size_t) s));
            ^
      257. }
      258. 

libtiff/tif_dirwrite.c:1491:5: Assignment
    1489.     */
    1490. 
    1491.     p = _TIFFmalloc(count*sizeof(uint32));
              ^
    1492.     if (p==NULL)
    1493.     {

libtiff/tif_dirwrite.c:1510:7: Call
    1508.     }
    1509. 
    1510.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                ^
    1511.     _TIFFfree(p);
    1512. 

libtiff/tif_dirwrite.c:1874:1: Parameter `*value`
      1872. }
      1873. 
      1874. static int
            ^
      1875. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
      1876. {

libtiff/tif_dirwrite.c:1880:3: Call
      1878. 	assert(sizeof(uint32)==4);
      1879. 	if (tif->tif_flags&TIFF_SWAB)
      1880. 		TIFFSwabArrayOfLong(value,count);
              ^
      1881. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
      1882. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
        102. 
        103. #ifndef TIFFSwabArrayOfLong
        104. void
             ^
        105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
        106. {

libtiff/tif_swab.c:112:3: Assignment
        110. 	/* XXX unroll loop some */
        111. 	while (n-- > 0) {
        112. 		cp = (unsigned char *)lp;
               ^
        113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
        114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec` 
        111. 	while (n-- > 0) {
        112. 		cp = (unsigned char *)lp;
        113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                   ^
        114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
        115. 		lp++;
