libtiff/tif_dirwrite.c:627: error: Buffer Overrun L3
  Offset: [0, 37] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSubifd`.

libtiff/tif_dirwrite.c:422:2: Assignment
420. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
421. 	}
422. 	dir=NULL;
      ^
423. 	dirmem=NULL;
424. 	dirsize=0;

libtiff/tif_dirwrite.c:627:10: Call
625. 			if (TIFFFieldSet(tif,FIELD_SUBIFD))
626. 			{
627. 				if (!TIFFWriteDirectoryTagSubifd(tif,&ndir,dir))
              ^
628. 					goto bad;
629. 			}

libtiff/tif_dirwrite.c:1838:1: Parameter `*dir`
  1836. }
  1837. 
  1838. static int
        ^
  1839. TIFFWriteDirectoryTagSubifd(TIFF* tif, uint32* ndir, TIFFDirEntry* dir)
  1840. {

libtiff/tif_dirwrite.c:1872:5: Call
  1870. 			*pb++=(uint32)(*pa++);
  1871. 		}
  1872. 		n=TIFFWriteDirectoryTagCheckedIfdArray(tif,ndir,dir,TIFFTAG_SUBIFD,tif->tif_dir.td_nsubifd,o);
            ^
  1873. 		_TIFFfree(o);
  1874. 	}

libtiff/tif_dirwrite.c:2272:1: Parameter `*dir`
    2270. }
    2271. 
    2272. static int
          ^
    2273. TIFFWriteDirectoryTagCheckedIfdArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
    2274. {

libtiff/tif_dirwrite.c:2279:9: Call
    2277. 	if (tif->tif_flags&TIFF_SWAB)
    2278. 		TIFFSwabArrayOfLong(value,count);
    2279. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_IFD,count,count*4,value));
                  ^
    2280. }
    2281. 

libtiff/tif_dirwrite.c:2293:1: <Offset trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*ndir`
      2291. }
      2292. 
      2293. static int
            ^
      2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2295. {

libtiff/tif_dirwrite.c:2293:1: <Length trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*dir`
      2291. }
      2292. 
      2293. static int
            ^
      2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2295. {

libtiff/tif_dirwrite.c:2312:2: Array access: Offset: [0, 37] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSubifd` 
      2310. 			dir[n]=dir[n-1];
      2311. 	}
      2312. 	dir[m].tdir_tag=tag;
             ^
      2313. 	dir[m].tdir_type=datatype;
      2314. 	dir[m].tdir_count=count;
