contrib/addtiffo/tif_overview.c:149: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory`.

contrib/addtiffo/tif_overview.c:146:9: Call
144. /*      Write directory, and return byte offset.                        */
145. /* -------------------------------------------------------------------- */
146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
147.         return 0;
148. 

libtiff/tif_write.c:566:1: Parameter `*tif->tif_dir.td_stripbytecount`
  564.  * that important information is not changed.
  565.  */
  566. int
       ^
  567. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  568. {

contrib/addtiffo/tif_overview.c:149:5: Call
147.         return 0;
148. 
149.     TIFFWriteDirectory( hTIFF );
         ^
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
151. 

libtiff/tif_dirwrite.c:181:1: Parameter `*tif->tif_dir.td_stripbytecount`
  179.  * storage that's been changed.
  180.  */
  181. int
       ^
  182. TIFFWriteDirectory(TIFF* tif)
  183. {

libtiff/tif_dirwrite.c:184:9: Call
  182. TIFFWriteDirectory(TIFF* tif)
  183. {
  184. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  185. }
  186. 

libtiff/tif_dirwrite.c:363:1: Parameter `*tif->tif_dir.td_stripbytecount`
    361. }
    362. 
    363. static int
         ^
    364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    365. {

libtiff/tif_dirwrite.c:533:11: Call
    531. 				if (!isTiled(tif))
    532. 				{
    533. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                   ^
    534. 						goto bad;
    535. 				}

libtiff/tif_dirwrite.c:1670:1: Parameter `*value`
      1668. /************************************************************************/
      1669. 
      1670. static int
            ^
      1671. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
      1672. {

libtiff/tif_dirwrite.c:1689:16: Call
      1687.     /* We always write LONG8 for BigTIFF, no checking needed. */
      1688.     if( tif->tif_flags&TIFF_BIGTIFF )
      1689.         return TIFFWriteDirectoryTagCheckedLong8Array(tif,ndir,dir,
                           ^
      1690.                                                       tag,count,value);
      1691. 

libtiff/tif_dirwrite.c:2137:1: Parameter `*value`
        2135. #endif
        2136. 
        2137. static int
              ^
        2138. TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
        2139. {

libtiff/tif_dirwrite.c:2147:3: Call
        2145. 	}
        2146. 	if (tif->tif_flags&TIFF_SWAB)
        2147. 		TIFFSwabArrayOfLong8(value,count);
                ^
        2148. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
        2149. }

libtiff/tif_swab.c:121:1: <Length trace>
119. 
120. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
121. void
     ^
122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
123. {

libtiff/tif_swab.c:121:1: Parameter `*lp`
          119. 
          120. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
          121. void
               ^
          122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
          123. {

libtiff/tif_swab.c:129:3: Assignment
          127. 	/* XXX unroll loop some */
          128. 	while (n-- > 0) {
          129. 		cp = (unsigned char *)lp;
                 ^
          130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
          131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:130:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory` 
          128. 	while (n-- > 0) {
          129. 		cp = (unsigned char *)lp;
          130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                     ^
          131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
          132. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
