contrib/addtiffo/tif_ovrcache.c:259: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory`.

contrib/addtiffo/tif_ovrcache.c:235:5: Call
233. 				if ((iTileY+1)*psCache->nBlockYSize>psCache->nYSize)
234. 					RowsInStrip=psCache->nYSize-iTileY*psCache->nBlockYSize;
235. 				TIFFWriteEncodedStrip( psCache->hTIFF, nTileID,
         ^
236. 				    pabyData,
237. 				    TIFFVStripSize(psCache->hTIFF,RowsInStrip) );

libtiff/tif_write.c:187:1: Parameter `*tif->tif_dir.td_stripoffset`
  185.  * NB: Image length must be setup before writing.
  186.  */
  187. tmsize_t
       ^
  188. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  189. {

contrib/addtiffo/tif_ovrcache.c:257:5: Call
255. /*      Restore access to original directory.                           */
256. /* -------------------------------------------------------------------- */
257.     TIFFFlush( psCache->hTIFF );
         ^
258.     /* TODO: add checks on error status return of TIFFFlush */
259.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:32:1: Parameter `*tif->tif_dir.td_stripoffset`
  30. #include "tiffiop.h"
  31. 
  32. int
      ^
  33. TIFFFlush(TIFF* tif)
  34. {

contrib/addtiffo/tif_ovrcache.c:259:5: Call
257.     TIFFFlush( psCache->hTIFF );
258.     /* TODO: add checks on error status return of TIFFFlush */
259.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );
         ^
260.     /* TODO: add checks on error status return of TIFFSetSubDirectory */
261. }

libtiff/tif_dir.c:1631:1: Parameter `*tif->tif_dir.td_stripoffset`
  1629.  * the SubIFD tag (e.g. thumbnail images).
  1630.  */
  1631. int
        ^
  1632. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
  1633. {

libtiff/tif_dir.c:1640:10: Call
  1638. 	 */
  1639. 	tif->tif_dirnumber = 0;
  1640. 	return (TIFFReadDirectory(tif));
                 ^
  1641. }
  1642. 

libtiff/tif_dirread.c:4155:8: <Offset trace>
4153. 
4154. 		tif->tif_dir.td_stripbytecountsorted = 1;
4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
4157. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:4155:8: Assignment
    4153. 
    4154. 		tif->tif_dir.td_stripbytecountsorted = 1;
    4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
                 ^
    4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    4157. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3854:10: <Length trace>
3852.                                     goto bad;
3853.                                 }
3854. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
               ^
3855. 					goto bad;
3856. #endif                                

libtiff/tif_dirread.c:3854:10: Call
    3852.                                     goto bad;
    3853.                                 }
    3854. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
                   ^
    3855. 					goto bad;
    3856. #endif                                

libtiff/tif_dirread.c:5537:1: Parameter `**lpp`
      5535.  * While this routine says "strips", in fact it's also used for tiles.
      5536.  */
      5537. static int
            ^
      5538. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
      5539. {

libtiff/tif_dirread.c:4157:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory` 
    4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
    4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    4157. 			    tif->tif_dir.td_stripoffset[strip]) {
                 ^
    4158. 				tif->tif_dir.td_stripbytecountsorted = 0;
    4159. 				break;
