contrib/addtiffo/tif_overview.c:865: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `TIFFCreateOvrCache`.

contrib/addtiffo/tif_overview.c:856:22: Call
854.         }
855. 
856.         nDirOffset = TIFF_WriteOverview( hTIFF, nOXSize, nOYSize,
                          ^
857.                                          nBitsPerPixel, nPlanarConfig,
858.                                          nSamples, nOBlockXSize, nOBlockYSize,

contrib/addtiffo/tif_overview.c:149:9: Call
  147. /*      Write directory, and return byte offset.                        */
  148. /* -------------------------------------------------------------------- */
  149.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
               ^
  150.         return 0;
  151. 

libtiff/tif_write.c:564:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
    562.  * that important information is not changed.
    563.  */
    564. int
         ^
    565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    566. {

contrib/addtiffo/tif_overview.c:865:25: Call
863.                                          nHorSubsampling, nVerSubsampling );
864.         
865.         papoRawBIs[i] = TIFFCreateOvrCache( hTIFF, nDirOffset );
                             ^
866.     }
867. 

contrib/addtiffo/tif_ovrcache.c:41:1: Parameter `*hTIFF->tif_dir.td_stripbytecount_p`
  39. /************************************************************************/
  40. 
  41. TIFFOvrCache *TIFFCreateOvrCache( TIFF *hTIFF, toff_t nDirOffset )
      ^
  42. 
  43. {

contrib/addtiffo/tif_ovrcache.c:55:5: Call
  53. /* -------------------------------------------------------------------- */
  54.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
  55.     TIFFSetSubDirectory( hTIFF, nDirOffset );
          ^
  56.     
  57.     TIFFGetField( hTIFF, TIFFTAG_IMAGEWIDTH, &(psCache->nXSize) );

libtiff/tif_dir.c:1649:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
    1647.  * the SubIFD tag (e.g. thumbnail images).
    1648.  */
    1649. int
          ^
    1650. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
    1651. {

libtiff/tif_dir.c:1658:10: Call
    1656. 	 */
    1657. 	tif->tif_dirnumber = 0;
    1658. 	return (TIFFReadDirectory(tif));
                   ^
    1659. }
    1660. 

libtiff/tif_dirread.c:3578:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
      3576.  * format. We read directories sequentially.
      3577.  */
      3578. int
            ^
      3579. TIFFReadDirectory(TIFF* tif)
      3580. {

libtiff/tif_dirread.c:3631:2: Call
      3629. 
      3630. 	/* free any old stuff and reinit */
      3631. 	TIFFFreeDirectory(tif);
             ^
      3632. 	TIFFDefaultDirectory(tif);
      3633. 	/*

libtiff/tif_dir.c:1266:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
        1264.  * Release storage associated with a directory.
        1265.  */
        1266. void
              ^
        1267. TIFFFreeDirectory(TIFF* tif)
        1268. {

libtiff/tif_dirread.c:4199:10: Call
      4197. 			   && tif->tif_dir.td_nstrips > 2
      4198. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
      4199. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                     ^
      4200. 			   && TIFFGetStrileByteCount(tif, 0) != 0
      4201. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6263:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
        6261. 
        6262. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
        6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
              ^
        6264. {
        6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6265:12: Call
        6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        6264. {
        6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                         ^
        6266. }
        6267. 

libtiff/tif_dirread.c:6269:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
          6267. 
          6268. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
          6269. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
                ^
          6270. {
          6271.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6272:12: Call
          6270. {
          6271.     TIFFDirectory *td = &tif->tif_dir;
          6272.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                           ^
          6273.                                &(td->td_stripbytecount_entry),
          6274.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6204:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
            6202. }
            6203. 
            6204. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                  ^
            6205.                                                    TIFFDirEntry* dirent,
            6206.                                                    uint64** parray,

libtiff/tif_dirread.c:4199:44: Call
      4197. 			   && tif->tif_dir.td_nstrips > 2
      4198. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
      4199. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                       ^
      4200. 			   && TIFFGetStrileByteCount(tif, 0) != 0
      4201. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6263:1: Parameter `strile`
        6261. 
        6262. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
        6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
              ^
        6264. {
        6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6265:12: Call
        6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
        6264. {
        6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                         ^
        6266. }
        6267. 

libtiff/tif_dirread.c:6269:1: Parameter `strile`
          6267. 
          6268. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
          6269. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
                ^
          6270. {
          6271.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6272:12: Call
          6270. {
          6271.     TIFFDirectory *td = &tif->tif_dir;
          6272.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                           ^
          6273.                                &(td->td_stripbytecount_entry),
          6274.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6204:1: Parameter `strile`
            6202. }
            6203. 
            6204. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                  ^
            6205.                                                    TIFFDirEntry* dirent,
            6206.                                                    uint64** parray,

libtiff/tif_dirread.c:6230:19: Call
            6228.         else
            6229.         {
            6230.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                    ^
            6231.              {
            6232.                 if( pbErr )

libtiff/tif_dirread.c:6101:1: <Offset trace>
6099. }
6100. 
6101. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6102.                                  uint32 strile,
6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: Parameter `strile`
              6099. }
              6100. 
              6101. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6102.                                  uint32 strile,
              6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: <Length trace>
6099. }
6100. 
6101. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6102.                                  uint32 strile,
6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: Parameter `**parray`
              6099. }
              6100. 
              6101. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6102.                                  uint32 strile,
              6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6192:10: Array access: Offset: 1 Size: [0, +oo] by call to `TIFFCreateOvrCache` 
              6190.         return 0;
              6191. 
              6192.     if( ~((*parray)[strile]) == 0 )
                             ^
              6193.     {
              6194.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
