tools/tiffcrop.c:7996: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/tiffcrop.c:7973:11: Call
7971.     if (config == PLANARCONFIG_CONTIG)
7972.       {
7973.       if (writeBufferToContigTiles (out, crop_buff, length, width, spp, dump))
                ^
7974.         TIFFError("","Unable to write contiguous tile data for page %d", pagenum);
7975.       }

tools/tiffcrop.c:1232:1: Parameter `out->tif_dir.td_nstrips`
  1230.  * to be written out as a tile.
  1231.  */
  1232. static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
        ^
  1233. 				       uint32 imagewidth, tsample_t spp, 
  1234.                                        struct dump_opts* dump)

tools/tiffcrop.c:7996:8: Call
7994.     }
7995. 
7996.   if (!TIFFWriteDirectory(out))
             ^
7997.     {
7998.     TIFFError("","Failed to write IFD for page number %d", pagenum);

libtiff/tif_dirwrite.c:181:1: Parameter `tif->tif_dir.td_nstrips`
  179.  * storage that's been changed.
  180.  */
  181. int
       ^
  182. TIFFWriteDirectory(TIFF* tif)
  183. {

libtiff/tif_dirwrite.c:184:9: Call
  182. TIFFWriteDirectory(TIFF* tif)
  183. {
  184. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  185. }
  186. 

libtiff/tif_dirwrite.c:363:1: Parameter `tif->tif_dir.td_nstrips`
    361. }
    362. 
    363. static int
         ^
    364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    365. {

libtiff/tif_dirwrite.c:558:26: Call
    556.                     */
    557.                     if (tif->tif_dir.td_stripoffset != NULL &&
    558.                         !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
                                  ^
    559.                         goto bad;
    560. 				}

libtiff/tif_dirwrite.c:1670:1: Parameter `count`
      1668. /************************************************************************/
      1669. 
      1670. static int
            ^
      1671. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
      1672. {

libtiff/tif_dirwrite.c:1697:9: Call
      1695.     */
      1696. 
      1697.     p = _TIFFmalloc(count*sizeof(uint32));
                    ^
      1698.     if (p==NULL)
      1699.     {

libtiff/tif_unix.c:314:17: Assignment
        312. {
        313.         if (s == 0)
        314.                 return ((void *) NULL);
                             ^
        315. 
        316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1697:5: Assignment
      1695.     */
      1696. 
      1697.     p = _TIFFmalloc(count*sizeof(uint32));
                ^
      1698.     if (p==NULL)
      1699.     {

libtiff/tif_dirwrite.c:1716:7: Call
      1714.     }
      1715. 
      1716.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                  ^
      1717.     _TIFFfree(p);
      1718. 

libtiff/tif_dirwrite.c:2087:1: Parameter `*value`
        2085. }
        2086. 
        2087. static int
              ^
        2088. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
        2089. {

libtiff/tif_dirwrite.c:2093:3: Call
        2091. 	assert(sizeof(uint32)==4);
        2092. 	if (tif->tif_flags&TIFF_SWAB)
        2093. 		TIFFSwabArrayOfLong(value,count);
                ^
        2094. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
        2095. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
          102. 
          103. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
          104. void
               ^
          105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
          106. {

libtiff/tif_swab.c:112:3: Assignment
          110. 	/* XXX unroll loop some */
          111. 	while (n-- > 0) {
          112. 		cp = (unsigned char *)lp;
                 ^
          113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
          114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory` 
          111. 	while (n-- > 0) {
          112. 		cp = (unsigned char *)lp;
          113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                     ^
          114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
          115. 		lp++;
