contrib/addtiffo/tif_ovrcache.c:254: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFFlush`.

contrib/addtiffo/tif_ovrcache.c:232:5: Call
230. 				if ((iTileY+1)*psCache->nBlockYSize>psCache->nYSize)
231. 					RowsInStrip=psCache->nYSize-iTileY*psCache->nBlockYSize;
232. 				TIFFWriteEncodedStrip( psCache->hTIFF, nTileID,
         ^
233. 				    pabyData,
234. 				    TIFFVStripSize(psCache->hTIFF,RowsInStrip) );

libtiff/tif_write.c:183:1: Parameter `*tif->tif_dir.td_stripbytecount`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

contrib/addtiffo/tif_ovrcache.c:254:5: Call
252. /*      Restore access to original directory.                           */
253. /* -------------------------------------------------------------------- */
254.     TIFFFlush( psCache->hTIFF );
         ^
255.     /* TODO: add checks on error status return of TIFFFlush */
256.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:32:1: Parameter `*tif->tif_dir.td_stripbytecount`
  30. #include "tiffiop.h"
  31. 
  32. int
      ^
  33. TIFFFlush(TIFF* tif)
  34. {

libtiff/tif_flush.c:83:13: Call
  81. 
  82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
  83.         && !TIFFWriteDirectory(tif))
                  ^
  84.         return (0);
  85. 

libtiff/tif_dirwrite.c:163:1: Parameter `*tif->tif_dir.td_stripbytecount`
    161.  * storage that's been changed.
    162.  */
    163. int
         ^
    164. TIFFWriteDirectory(TIFF* tif)
    165. {

libtiff/tif_dirwrite.c:166:9: Call
    164. TIFFWriteDirectory(TIFF* tif)
    165. {
    166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    167. }
    168. 

libtiff/tif_dirwrite.c:345:1: Parameter `*tif->tif_dir.td_stripbytecount`
      343. }
      344. 
      345. static int
           ^
      346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      347. {

libtiff/tif_dirwrite.c:510:11: Call
      508. 				if (!isTiled(tif))
      509. 				{
      510. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                     ^
      511. 						goto bad;
      512. 				}

libtiff/tif_dirwrite.c:1464:1: Parameter `*value`
        1462. /************************************************************************/
        1463. 
        1464. static int
              ^
        1465. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
        1466. {

libtiff/tif_dirwrite.c:1483:16: Call
        1481.     /* We always write LONG8 for BigTIFF, no checking needed. */
        1482.     if( tif->tif_flags&TIFF_BIGTIFF )
        1483.         return TIFFWriteDirectoryTagCheckedLong8Array(tif,ndir,dir,
                             ^
        1484.                                                       tag,count,value);
        1485. 

libtiff/tif_dirwrite.c:1921:1: Parameter `*value`
          1919. #endif
          1920. 
          1921. static int
                ^
          1922. TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
          1923. {

libtiff/tif_dirwrite.c:1928:3: Call
          1926. 	assert(tif->tif_flags&TIFF_BIGTIFF);
          1927. 	if (tif->tif_flags&TIFF_SWAB)
          1928. 		TIFFSwabArrayOfLong8(value,count);
                  ^
          1929. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
          1930. }

libtiff/tif_swab.c:121:1: <Length trace>
119. 
120. #ifndef TIFFSwabArrayOfLong8
121. void
     ^
122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
123. {

libtiff/tif_swab.c:121:1: Parameter `*lp`
            119. 
            120. #ifndef TIFFSwabArrayOfLong8
            121. void
                 ^
            122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
            123. {

libtiff/tif_swab.c:129:3: Assignment
            127. 	/* XXX unroll loop some */
            128. 	while (n-- > 0) {
            129. 		cp = (unsigned char *)lp;
                   ^
            130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
            131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:130:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFFlush` 
            128. 	while (n-- > 0) {
            129. 		cp = (unsigned char *)lp;
            130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                       ^
            131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
            132. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
