libtiff/tif_dirwrite.c:1865: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray`.

libtiff/tif_dirwrite.c:1843:1: Parameter `tif->tif_dir.td_bitspersample`
1841. }
1842. #endif
1843. static int
      ^
1844. TIFFWriteDirectoryTagColormap(TIFF* tif, uint32* ndir, TIFFDirEntry* dir)
1845. {

libtiff/tif_dirwrite.c:1855:2: Assignment
1853. 		return(1);
1854. 	}
1855. 	m=(1<<tif->tif_dir.td_bitspersample);
       ^
1856. 	n=_TIFFmalloc(3*m*sizeof(uint16));
1857. 	if (n==NULL)

libtiff/tif_dirwrite.c:1856:4: Call
1854. 	}
1855. 	m=(1<<tif->tif_dir.td_bitspersample);
1856. 	n=_TIFFmalloc(3*m*sizeof(uint16));
         ^
1857. 	if (n==NULL)
1858. 	{

libtiff/tif_unix.c:314:17: Assignment
  312. {
  313.         if (s == 0)
  314.                 return ((void *) NULL);
                       ^
  315. 
  316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1856:2: Assignment
1854. 	}
1855. 	m=(1<<tif->tif_dir.td_bitspersample);
1856. 	n=_TIFFmalloc(3*m*sizeof(uint16));
       ^
1857. 	if (n==NULL)
1858. 	{

libtiff/tif_dirwrite.c:1865:4: Call
1863. 	_TIFFmemcpy(&n[m],tif->tif_dir.td_colormap[1],m*sizeof(uint16));
1864. 	_TIFFmemcpy(&n[2*m],tif->tif_dir.td_colormap[2],m*sizeof(uint16));
1865. 	o=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,TIFFTAG_COLORMAP,3*m,n);
         ^
1866. 	_TIFFfree(n);
1867. 	return(o);

libtiff/tif_dirwrite.c:2043:1: Parameter `*value`
  2041. }
  2042. 
  2043. static int
        ^
  2044. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
  2045. {

libtiff/tif_dirwrite.c:2049:3: Call
  2047. 	assert(sizeof(uint16)==2);
  2048. 	if (tif->tif_flags&TIFF_SWAB)
  2049. 		TIFFSwabArrayOfShort(value,count);
          ^
  2050. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
  2051. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfShort)
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
    70. 
    71. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfShort)
    72. void
        ^
    73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
    74. {

libtiff/tif_swab.c:80:3: Assignment
    78. 	/* XXX unroll loop some */
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
          ^
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
    82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray` 
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
              ^
    82. 		wp++;
    83. 	}
