tools/tiffsplit.c:91: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFClose`.

tools/tiffsplit.c:89:9: Call
87. 			if (out == NULL)
88. 				return (-2);
89. 			if (!tiffcp(in, out))
            ^
90. 				return (-1);
91. 			TIFFClose(out);

tools/tiffsplit.c:157:1: Parameter `out->tif_dir.td_stripbytecount`
  155. }
  156. 
  157. static int
       ^
  158. tiffcp(TIFF* in, TIFF* out)
  159. {

tools/tiffsplit.c:225:11: Call
  223. 	CopyField(TIFFTAG_FAXDCS, stringv);
  224. 	if (TIFFIsTiled(in))
  225. 		return (cpTiles(in, out));
                 ^
  226. 	else
  227. 		return (cpStrips(in, out));

tools/tiffsplit.c:264:1: Parameter `out->tif_dir.td_stripbytecount`
    262. }
    263. 
    264. static int
         ^
    265. cpTiles(TIFF* in, TIFF* out)
    266. {

tools/tiffsplit.c:91:4: Call
89. 			if (!tiffcp(in, out))
90. 				return (-1);
91. 			TIFFClose(out);
       ^
92. 		} while (TIFFReadDirectory(in));
93. 		(void) TIFFClose(in);

libtiff/tif_close.c:122:1: Parameter `*tif->tif_dir.td_stripbytecount`
  120.  */
  121. 
  122. void
       ^
  123. TIFFClose(TIFF* tif)
  124. {

libtiff/tif_close.c:128:2: Call
  126. 	thandle_t fd = tif->tif_clientdata;
  127. 
  128. 	TIFFCleanup(tif);
        ^
  129. 	(void) (*closeproc)(fd);
  130. }

libtiff/tif_close.c:46:1: Parameter `*tif->tif_dir.td_stripbytecount`
    44.  */
    45. 
    46. void
        ^
    47. TIFFCleanup(TIFF* tif)
    48. {

libtiff/tif_close.c:53:3: Call
    51.          */
    52. 	if (tif->tif_mode != O_RDONLY)
    53. 		TIFFFlush(tif);
          ^
    54. 	(*tif->tif_cleanup)(tif);
    55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `*tif->tif_dir.td_stripbytecount`
      30. #include "tiffiop.h"
      31. 
      32. int
          ^
      33. TIFFFlush(TIFF* tif)
      34. {

libtiff/tif_flush.c:83:13: Call
      81. 
      82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      83.         && !TIFFRewriteDirectory(tif))
                      ^
      84.         return (0);
      85. 

libtiff/tif_dirwrite.c:217:1: Parameter `*tif->tif_dir.td_stripbytecount`
        215.  * previously used directory space. 
        216.  */ 
        217. int
             ^
        218. TIFFRewriteDirectory( TIFF *tif )
        219. {

libtiff/tif_dirwrite.c:224:10: Call
        222. 	/* We don't need to do anything special if it hasn't been written. */
        223. 	if( tif->tif_diroff == 0 )
        224. 		return TIFFWriteDirectory( tif );
                      ^
        225. 
        226. 	/*

libtiff/tif_dirwrite.c:181:1: Parameter `*tif->tif_dir.td_stripbytecount`
          179.  * storage that's been changed.
          180.  */
          181. int
               ^
          182. TIFFWriteDirectory(TIFF* tif)
          183. {

libtiff/tif_dirwrite.c:184:9: Call
          182. TIFFWriteDirectory(TIFF* tif)
          183. {
          184. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          185. }
          186. 

libtiff/tif_dirwrite.c:363:1: Parameter `*tif->tif_dir.td_stripbytecount`
            361. }
            362. 
            363. static int
                 ^
            364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            365. {

libtiff/tif_dirwrite.c:533:11: Call
            531. 				if (!isTiled(tif))
            532. 				{
            533. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                           ^
            534. 						goto bad;
            535. 				}

libtiff/tif_dirwrite.c:1670:1: Parameter `*value`
              1668. /************************************************************************/
              1669. 
              1670. static int
                    ^
              1671. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
              1672. {

libtiff/tif_dirwrite.c:1689:16: Call
              1687.     /* We always write LONG8 for BigTIFF, no checking needed. */
              1688.     if( tif->tif_flags&TIFF_BIGTIFF )
              1689.         return TIFFWriteDirectoryTagCheckedLong8Array(tif,ndir,dir,
                                   ^
              1690.                                                       tag,count,value);
              1691. 

libtiff/tif_dirwrite.c:2137:1: Parameter `*value`
                2135. #endif
                2136. 
                2137. static int
                      ^
                2138. TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
                2139. {

libtiff/tif_dirwrite.c:2147:3: Call
                2145. 	}
                2146. 	if (tif->tif_flags&TIFF_SWAB)
                2147. 		TIFFSwabArrayOfLong8(value,count);
                        ^
                2148. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
                2149. }

libtiff/tif_swab.c:121:1: <Length trace>
119. 
120. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
121. void
     ^
122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
123. {

libtiff/tif_swab.c:121:1: Parameter `*lp`
                  119. 
                  120. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
                  121. void
                       ^
                  122. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
                  123. {

libtiff/tif_swab.c:129:3: Assignment
                  127. 	/* XXX unroll loop some */
                  128. 	while (n-- > 0) {
                  129. 		cp = (unsigned char *)lp;
                         ^
                  130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                  131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:130:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFClose` 
                  128. 	while (n-- > 0) {
                  129. 		cp = (unsigned char *)lp;
                  130. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                             ^
                  131. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
                  132. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
