tools/tiffcrop.c:6633: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `writeCroppedImage`.

tools/tiffcrop.c:6542:1: Parameter `(*out)->tif_dir.td_samplesperpixel`
6540.   } /* end extractImageSection */
6541. 
6542. static int 
      ^
6543. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6544.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6628:16: Call
6626.          for (i = 0; i < crop->selections; i++)
6627.            {
6628.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6629.              return (1);
6630. 

tools/tiffcrop.c:2027:1: Parameter `(*tiffout)->tif_dir.td_samplesperpixel`
  2025.  * so TIFFTAG PAGENUM will be correct in image.
  2026.  */
  2027. static int 
        ^
  2028. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2029.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6633:16: Call
6631.            crop_buff = seg_buffs[i].buffer;
6632.            /* Write the current region to the current file */
6633.            if (writeCroppedImage(in, *out, image, dump,
                     ^
6634.                                  crop->regionlist[i].width, 
6635.                                  crop->regionlist[i].length, 

tools/tiffcrop.c:7381:1: Parameter `out->tif_dir.td_samplesperpixel`
  7379.  * then passed in as an argument.
  7380.  */
  7381. static int  
        ^
  7382. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7383.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7641:11: Call
  7639.     if (config == PLANARCONFIG_CONTIG)
  7640.       {
  7641.       if (writeBufferToContigStrips (out, crop_buff, length))
                  ^
  7642.         TIFFError("","Unable to write contiguous strip data for page %d", pagenum);
  7643.       }

tools/tiffcrop.c:1086:1: Parameter `out->tif_dir.td_samplesperpixel`
    1084.   }
    1085. 
    1086. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
          ^
    1087.   {
    1088.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1092:3: Call
    1090.   tsize_t stripsize;
    1091. 
    1092.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
            ^
    1093.   for (row = 0; row < imagelength; row += rowsperstrip)
    1094.     {

libtiff/tif_aux.c:271:1: Parameter `tif->tif_dir.td_samplesperpixel`
      269.  * value if the tag is not present in the directory.
      270.  */
      271. int
           ^
      272. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
      273. {

libtiff/tif_aux.c:278:8: Call
      276. 
      277. 	va_start(ap, tag);
      278. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                  ^
      279. 	va_end(ap);
      280. 	return (ok);

libtiff/tif_aux.c:142:1: Parameter `tif->tif_dir.td_extrasamples`
        140.  *	place in the library -- in TIFFDefaultDirectory.
        141.  */
        142. int
             ^
        143. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
        144. {

tools/tiffcrop.c:7651:8: Call
  7649.     }
  7650. 
  7651.   if (!TIFFWriteDirectory(out))
               ^
  7652.     {
  7653.     TIFFError("","Failed to write IFD for page number %d", pagenum);

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
    161.  * storage that's been changed.
    162.  */
    163. int
         ^
    164. TIFFWriteDirectory(TIFF* tif)
    165. {

libtiff/tif_dirwrite.c:166:9: Call
    164. TIFFWriteDirectory(TIFF* tif)
    165. {
    166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    167. }
    168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
      343. }
      344. 
      345. static int
           ^
      346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      347. {

libtiff/tif_dirwrite.c:557:10: Call
      555. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
      556. 			{
      557. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                    ^
      558. 					goto bad;
      559. 			}

libtiff/tif_dirwrite.c:903:1: Parameter `tif->tif_dir.td_samplesperpixel`
        901. }
        902. 
        903. static int
             ^
        904. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
        905. {

libtiff/tif_dirwrite.c:912:12: Call
        910. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
        911. 			else
        912. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                        ^
        913. 		case SAMPLEFORMAT_INT:
        914. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1400:1: Parameter `tif->tif_dir.td_samplesperpixel`
          1398. }
          1399. 
          1400. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                ^
          1401. {
          1402. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1412:4: Call
          1410. 		return(1);
          1411. 	}
          1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                   ^
          1413. 	if (m==NULL)
          1414. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
            251. #endif
            252. 
            253. void*
                 ^
            254. _TIFFmalloc(tmsize_t s)
            255. {

libtiff/tif_unix.c:256:10: Array declaration
            254. _TIFFmalloc(tmsize_t s)
            255. {
            256. 	return (malloc((size_t) s));
                          ^
            257. }
            258. 

libtiff/tif_unix.c:256:2: Assignment
            254. _TIFFmalloc(tmsize_t s)
            255. {
            256. 	return (malloc((size_t) s));
                  ^
            257. }
            258. 

libtiff/tif_dirwrite.c:1412:2: Assignment
          1410. 		return(1);
          1411. 	}
          1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                 ^
          1413. 	if (m==NULL)
          1414. 	{

libtiff/tif_dirwrite.c:1420:4: Call
          1418. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
          1419. 		*na=value;
          1420. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                   ^
          1421. 	_TIFFfree(m);
          1422. 	return(o);

libtiff/tif_dirwrite.c:2144:1: Parameter `*value`
            2142. #endif
            2143. 
            2144. static int
                  ^
            2145. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
            2146. {

libtiff/tif_dirwrite.c:2151:3: Call
            2149. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
            2150. 	if (tif->tif_flags&TIFF_SWAB)
            2151. 		TIFFSwabArrayOfDouble(value,count);
                    ^
            2152. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
            2153. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
              181. 
              182. #ifndef TIFFSwabArrayOfDouble
              183. void
                   ^
              184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
              185. {

libtiff/tif_swab.c:191:3: Assignment
              189. 	/* XXX unroll loop some */
              190. 	while (n-- > 0) {
              191. 		cp = (unsigned char *)dp;
                     ^
              192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
              193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `writeCroppedImage` 
              190. 	while (n-- > 0) {
              191. 		cp = (unsigned char *)dp;
              192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                         ^
              193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
              194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
