contrib/addtiffo/tif_overview.c:162: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:149:9: Call
147. /*      Write directory, and return byte offset.                        */
148. /* -------------------------------------------------------------------- */
149.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
150.         return 0;
151. 

libtiff/tif_write.c:564:1: Parameter `*tif->tif_dir.td_stripbytecount`
  562.  * that important information is not changed.
  563.  */
  564. int
       ^
  565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  566. {

contrib/addtiffo/tif_overview.c:152:5: Call
150.         return 0;
151. 
152.     TIFFWriteDirectory( hTIFF );
         ^
153.     iNumDir = TIFFNumberOfDirectories(hTIFF);
154.     if( iNumDir > TIFF_DIR_MAX )

libtiff/tif_dirwrite.c:179:1: Parameter `*tif->tif_dir.td_stripbytecount`
  177.  * storage that's been changed.
  178.  */
  179. int
       ^
  180. TIFFWriteDirectory(TIFF* tif)
  181. {

libtiff/tif_dirwrite.c:182:9: Call
  180. TIFFWriteDirectory(TIFF* tif)
  181. {
  182. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  183. }
  184. 

libtiff/tif_dirwrite.c:361:1: Parameter `*tif->tif_dir.td_stripbytecount`
    359. }
    360. 
    361. static int
         ^
    362. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    363. {

contrib/addtiffo/tif_overview.c:162:5: Call
160.         exit(-1);
161.     }
162.     TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) );
         ^
163. 
164.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1598:1: Parameter `*tif->tif_dir.td_stripbytecount`
  1596.  * NB: Directories are numbered starting at 0.
  1597.  */
  1598. int
        ^
  1599. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1600. {

libtiff/tif_dir.c:1623:10: Call
  1621. 	 */
  1622. 	tif->tif_dirnumber = 0;
  1623. 	return (TIFFReadDirectory(tif));
                 ^
  1624. }
  1625. 

libtiff/tif_dirread.c:3870:38: <Length trace>
3868.                                     goto bad;
3869.                                 }
3870.                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))  
                                           ^
3871. 					goto bad;
3872. #endif                                

libtiff/tif_dirread.c:3870:38: Call
    3868.                                     goto bad;
    3869.                                 }
    3870.                                 if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount))  
                                               ^
    3871. 					goto bad;
    3872. #endif                                

libtiff/tif_dirread.c:5535:1: Parameter `**lpp`
      5533.  * While this routine says "strips", in fact it's also used for tiles.
      5534.  */
      5535. static int
            ^
      5536. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
      5537. {

libtiff/tif_dirread.c:4111:47: Array access: Offset: 1 Size: [0, +oo] by call to `TIFFSetDirectory` 
    4109. 			   && tif->tif_dir.td_nstrips > 2
    4110. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
    4111. 			   && tif->tif_dir.td_stripbytecount[0] != tif->tif_dir.td_stripbytecount[1]
                                                        ^
    4112. 			   && tif->tif_dir.td_stripbytecount[0] != 0
    4113. 			   && tif->tif_dir.td_stripbytecount[1] != 0 ) {
