tools/tiffcrop.c:7316: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/tiffcrop.c:7304:7: Call
7302.     {
7303.     if (config == PLANARCONFIG_CONTIG)
7304.       writeBufferToContigTiles (out, sect_buff, length, width, spp, dump);
            ^
7305.     else
7306.       writeBufferToSeparateTiles (out, sect_buff, length, width, spp, dump);

tools/tiffcrop.c:1227:1: Parameter `out->tif_dir.td_nstrips`
  1225.  * to be written out as a tile.
  1226.  */
  1227. static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
        ^
  1228. 				       uint32 imagewidth, tsample_t spp, 
  1229.                                        struct dump_opts* dump)

tools/tiffcrop.c:7316:8: Call
7314.     }
7315. 
7316.   if (!TIFFWriteDirectory(out))
             ^
7317.     {
7318.     TIFFClose(out);

libtiff/tif_dirwrite.c:178:1: Parameter `tif->tif_dir.td_nstrips`
  176.  * storage that's been changed.
  177.  */
  178. int
       ^
  179. TIFFWriteDirectory(TIFF* tif)
  180. {

libtiff/tif_dirwrite.c:181:9: Call
  179. TIFFWriteDirectory(TIFF* tif)
  180. {
  181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  182. }
  183. 

libtiff/tif_dirwrite.c:360:1: Parameter `tif->tif_dir.td_nstrips`
    358. }
    359. 
    360. static int
         ^
    361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    362. {

libtiff/tif_dirwrite.c:555:26: Call
    553.                     */
    554.                     if (tif->tif_dir.td_stripoffset_p != NULL &&
    555.                         !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset_p))
                                  ^
    556.                         goto bad;
    557. 				}

libtiff/tif_dirwrite.c:1694:1: Parameter `count`
      1692. /************************************************************************/
      1693. 
      1694. static int
            ^
      1695. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
      1696. {

libtiff/tif_dirwrite.c:1747:21: Call
      1745.         */
      1746. 
      1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                                ^
      1748.         uint32* q;
      1749.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
        310. {
        311.         if (s == 0)
        312.                 return ((void *) NULL);
                             ^
        313. 
        314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1747:9: Assignment
      1745.         */
      1746. 
      1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                    ^
      1748.         uint32* q;
      1749.         uint64* ma;

libtiff/tif_dirwrite.c:1770:11: Call
      1768.         }
      1769. 
      1770.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                      ^
      1771.         _TIFFfree(p);
      1772.     }

libtiff/tif_dirwrite.c:2173:1: Parameter `*value`
        2171. }
        2172. 
        2173. static int
              ^
        2174. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
        2175. {

libtiff/tif_dirwrite.c:2179:3: Call
        2177. 	assert(sizeof(uint32)==4);
        2178. 	if (tif->tif_flags&TIFF_SWAB)
        2179. 		TIFFSwabArrayOfLong(value,count);
                ^
        2180. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
        2181. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
          100. 
          101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
          102. void
               ^
          103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
          104. {

libtiff/tif_swab.c:110:3: Assignment
          108. 	/* XXX unroll loop some */
          109. 	while (n-- > 0) {
          110. 		cp = (unsigned char *)lp;
                 ^
          111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
          112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory` 
          109. 	while (n-- > 0) {
          110. 		cp = (unsigned char *)lp;
          111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                     ^
          112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
          113. 		lp++;
