libtiff/tif_dirwrite.c:799: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray`.

libtiff/tif_dirwrite.c:755:25: Assignment
753. 		{
754.                         uint16 tag = (uint16)tif->tif_dir.td_customValues[m].info->field_tag;
755.                         uint32 count = tif->tif_dir.td_customValues[m].count;
                             ^
756. 			switch (tif->tif_dir.td_customValues[m].info->field_type)
757. 			{

libtiff/tif_dirwrite.c:799:11: Call
797. 					break;
798. 				case TIFF_RATIONAL:
799. 					if (!TIFFWriteDirectoryTagRationalArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))
               ^
800. 						goto bad;
801. 					break;

libtiff/tif_dirwrite.c:1541:1: Parameter `count`
  1539. }
  1540. 
  1541. static int
        ^
  1542. TIFFWriteDirectoryTagRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
  1543. {

libtiff/tif_dirwrite.c:1549:9: Call
  1547. 		return(1);
  1548. 	}
  1549. 	return(TIFFWriteDirectoryTagCheckedRationalArray(tif,ndir,dir,tag,count,value));
                ^
  1550. }
  1551. 

libtiff/tif_dirwrite.c:2362:1: Parameter `count`
    2360. }
    2361. 
    2362. static int
          ^
    2363. TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
    2364. {

libtiff/tif_dirwrite.c:2372:4: Call
    2370. 	int o;
    2371. 	assert(sizeof(uint32)==4);
    2372. 	m=_TIFFmalloc(count*2*sizeof(uint32));
             ^
    2373. 	if (m==NULL)
    2374. 	{

libtiff/tif_unix.c:312:17: Assignment
      310. {
      311.         if (s == 0)
      312.                 return ((void *) NULL);
                           ^
      313. 
      314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:2372:2: Assignment
    2370. 	int o;
    2371. 	assert(sizeof(uint32)==4);
    2372. 	m=_TIFFmalloc(count*2*sizeof(uint32));
           ^
    2373. 	if (m==NULL)
    2374. 	{

libtiff/tif_dirwrite.c:2403:3: Call
    2401. 	}
    2402. 	if (tif->tif_flags&TIFF_SWAB)
    2403. 		TIFFSwabArrayOfLong(m,count*2);
            ^
    2404. 	o=TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_RATIONAL,count,count*8,&m[0]);
    2405. 	_TIFFfree(m);

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
      100. 
      101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
      102. void
           ^
      103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
      104. {

libtiff/tif_swab.c:110:3: Assignment
      108. 	/* XXX unroll loop some */
      109. 	while (n-- > 0) {
      110. 		cp = (unsigned char *)lp;
             ^
      111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
      112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray` 
      109. 	while (n-- > 0) {
      110. 		cp = (unsigned char *)lp;
      111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                 ^
      112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
      113. 		lp++;
