libtiff/tif_dirwrite.c:197: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec`.

libtiff/tif_dirwrite.c:190:1: Parameter `tif->tif_dir.td_nstrips`
188.  * readable before it is successfully completed/closed.
189.  */
190. int
     ^
191. TIFFCheckpointDirectory(TIFF* tif)
192. {

libtiff/tif_dirwrite.c:197:7: Call
195. 	if (tif->tif_dir.td_stripoffset_p == NULL)
196. 	    (void) TIFFSetupStrips(tif);
197. 	rc = TIFFWriteDirectorySec(tif,TRUE,FALSE,NULL);
           ^
198. 	(void) TIFFSetWriteOffset(tif, TIFFSeekFile(tif, 0, SEEK_END));
199. 	return rc;

libtiff/tif_dirwrite.c:360:1: Parameter `tif->tif_dir.td_nstrips`
  358. }
  359. 
  360. static int
       ^
  361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
  362. {

libtiff/tif_dirwrite.c:555:26: Call
  553.                     */
  554.                     if (tif->tif_dir.td_stripoffset_p != NULL &&
  555.                         !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset_p))
                                ^
  556.                         goto bad;
  557. 				}

libtiff/tif_dirwrite.c:1694:1: Parameter `count`
    1692. /************************************************************************/
    1693. 
    1694. static int
          ^
    1695. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
    1696. {

libtiff/tif_dirwrite.c:1747:21: Call
    1745.         */
    1746. 
    1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                              ^
    1748.         uint32* q;
    1749.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
      310. {
      311.         if (s == 0)
      312.                 return ((void *) NULL);
                           ^
      313. 
      314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1747:9: Assignment
    1745.         */
    1746. 
    1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                  ^
    1748.         uint32* q;
    1749.         uint64* ma;

libtiff/tif_dirwrite.c:1770:11: Call
    1768.         }
    1769. 
    1770.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                    ^
    1771.         _TIFFfree(p);
    1772.     }

libtiff/tif_dirwrite.c:2173:1: Parameter `*value`
      2171. }
      2172. 
      2173. static int
            ^
      2174. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
      2175. {

libtiff/tif_dirwrite.c:2179:3: Call
      2177. 	assert(sizeof(uint32)==4);
      2178. 	if (tif->tif_flags&TIFF_SWAB)
      2179. 		TIFFSwabArrayOfLong(value,count);
              ^
      2180. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
      2181. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
        100. 
        101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
        102. void
             ^
        103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
        104. {

libtiff/tif_swab.c:110:3: Assignment
        108. 	/* XXX unroll loop some */
        109. 	while (n-- > 0) {
        110. 		cp = (unsigned char *)lp;
               ^
        111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
        112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec` 
        109. 	while (n-- > 0) {
        110. 		cp = (unsigned char *)lp;
        111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                   ^
        112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
        113. 		lp++;
