libtiff/tif_dirread.c:4219: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

libtiff/tif_dirread.c:4217:8: <Offset trace>
4215. 
4216. 		tif->tif_dir.td_stripbytecountsorted = 1;
4217. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
4218. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
4219. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:4217:8: Assignment
4215. 
4216. 		tif->tif_dir.td_stripbytecountsorted = 1;
4217. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
4218. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
4219. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3885:10: <Length trace>
3883.                                     goto bad;
3884.                                 }
3885. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
               ^
3886. 					goto bad;
3887. #endif                                

libtiff/tif_dirread.c:3885:10: Call
3883.                                     goto bad;
3884.                                 }
3885. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
               ^
3886. 					goto bad;
3887. #endif                                

libtiff/tif_dirread.c:5613:1: Parameter `**lpp`
  5611.  * While this routine says "strips", in fact it's also used for tiles.
  5612.  */
  5613. static int
        ^
  5614. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
  5615. {

libtiff/tif_dirread.c:4219:8: Array access: Offset: [1, +oo] Size: [0, +oo]
4217. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
4218. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
4219. 			    tif->tif_dir.td_stripoffset[strip]) {
             ^
4220. 				tif->tif_dir.td_stripbytecountsorted = 0;
4221. 				break;
