tools/tiff2pdf.c:5645: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `t2p_write_advance_directory`.

tools/tiff2pdf.c:5644:15: Call
5642. 				return (0);
5643. 			}
5644. 			written += t2p_readwrite_pdf_image(t2p, input, output);
                    ^
5645. 			t2p_write_advance_directory(t2p, output);
5646. 			if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2233:1: Parameter `output->tif_dir.td_nstrips`
  2231. */
  2232. 
  2233. tsize_t t2p_readwrite_pdf_image(T2P* t2p, TIFF* input, TIFF* output){
        ^
  2234. 
  2235. 	tsize_t written=0;

tools/tiff2pdf.c:5645:4: Call
5643. 			}
5644. 			written += t2p_readwrite_pdf_image(t2p, input, output);
5645. 			t2p_write_advance_directory(t2p, output);
         ^
5646. 			if(t2p->t2p_error!=T2P_ERR_OK){return(0);}
5647. 			streamlen=written-streamlen;

tools/tiff2pdf.c:3693:1: Parameter `output->tif_dir.td_nstrips`
  3691.  */
  3692. 
  3693. void
        ^
  3694. t2p_write_advance_directory(T2P* t2p, TIFF* output)
  3695. {

tools/tiff2pdf.c:3697:6: Call
  3695. {
  3696. 	t2p_disable(output);
  3697. 	if(!TIFFWriteDirectory(output)){
             ^
  3698. 		TIFFError(TIFF2PDF_MODULE, 
  3699. 			"Error writing virtual directory to output PDF %s", 

libtiff/tif_dirwrite.c:193:1: Parameter `tif->tif_dir.td_nstrips`
    191.  * storage that's been changed.
    192.  */
    193. int
         ^
    194. TIFFWriteDirectory(TIFF* tif)
    195. {

libtiff/tif_dirwrite.c:196:9: Call
    194. TIFFWriteDirectory(TIFF* tif)
    195. {
    196. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    197. }
    198. 

libtiff/tif_dirwrite.c:420:1: Parameter `tif->tif_dir.td_nstrips`
      418. }
      419. 
      420. static int
           ^
      421. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      422. {

libtiff/tif_dirwrite.c:590:11: Call
      588. 				if (!isTiled(tif))
      589. 				{
      590. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))
                     ^
      591. 						goto bad;
      592. 				}

libtiff/tif_dirwrite.c:1807:1: Parameter `count`
        1805. /************************************************************************/
        1806. 
        1807. static int
              ^
        1808. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
        1809. {

libtiff/tif_dirwrite.c:1865:21: Call
        1863.         */
        1864. 
        1865.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                                  ^
        1866.         uint32* q;
        1867.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
          310. {
          311.         if (s == 0)
          312.                 return ((void *) NULL);
                               ^
          313. 
          314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1865:9: Assignment
        1863.         */
        1864. 
        1865.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                      ^
        1866.         uint32* q;
        1867.         uint64* ma;

libtiff/tif_dirwrite.c:1888:11: Call
        1886.         }
        1887. 
        1888.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                        ^
        1889.         _TIFFfree(p);
        1890.     }

libtiff/tif_dirwrite.c:2291:1: Parameter `*value`
          2289. }
          2290. 
          2291. static int
                ^
          2292. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
          2293. {

libtiff/tif_dirwrite.c:2297:3: Call
          2295. 	assert(sizeof(uint32)==4);
          2296. 	if (tif->tif_flags&TIFF_SWAB)
          2297. 		TIFFSwabArrayOfLong(value,count);
                  ^
          2298. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
          2299. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
            100. 
            101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
            102. void
                 ^
            103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
            104. {

libtiff/tif_swab.c:110:3: Assignment
            108. 	/* XXX unroll loop some */
            109. 	while (n-- > 0) {
            110. 		cp = (unsigned char *)lp;
                   ^
            111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
            112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `t2p_write_advance_directory` 
            109. 	while (n-- > 0) {
            110. 		cp = (unsigned char *)lp;
            111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                       ^
            112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
            113. 		lp++;
