libtiff/tif_dirwrite.c:739: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray`.

libtiff/tif_dirwrite.c:739:11: Call
737. 					break;
738. 				case TIFF_RATIONAL:
739. 					if (!TIFFWriteDirectoryTagRationalArray(tif,&ndir,dir,tif->tif_dir.td_customValues[m].info->field_tag,tif->tif_dir.td_customValues[m].count,tif->tif_dir.td_customValues[m].value))
               ^
740. 						goto bad;
741. 					break;

libtiff/tif_dirwrite.c:1422:1: Parameter `count`
  1420. }
  1421. 
  1422. static int
        ^
  1423. TIFFWriteDirectoryTagRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
  1424. {

libtiff/tif_dirwrite.c:1430:9: Call
  1428. 		return(1);
  1429. 	}
  1430. 	return(TIFFWriteDirectoryTagCheckedRationalArray(tif,ndir,dir,tag,count,value));
                ^
  1431. }
  1432. 

libtiff/tif_dirwrite.c:2114:1: Parameter `count`
    2112. }
    2113. 
    2114. static int
          ^
    2115. TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
    2116. {

libtiff/tif_dirwrite.c:2124:4: Call
    2122. 	int o;
    2123. 	assert(sizeof(uint32)==4);
    2124. 	m=_TIFFmalloc(count*2*sizeof(uint32));
             ^
    2125. 	if (m==NULL)
    2126. 	{

libtiff/tif_unix.c:261:17: Assignment
      259. {
      260.         if (s == 0)
      261.                 return ((void *) NULL);
                           ^
      262. 
      263. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:2124:2: Assignment
    2122. 	int o;
    2123. 	assert(sizeof(uint32)==4);
    2124. 	m=_TIFFmalloc(count*2*sizeof(uint32));
           ^
    2125. 	if (m==NULL)
    2126. 	{

libtiff/tif_dirwrite.c:2154:3: Call
    2152. 	}
    2153. 	if (tif->tif_flags&TIFF_SWAB)
    2154. 		TIFFSwabArrayOfLong(m,count*2);
            ^
    2155. 	o=TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_RATIONAL,count,count*8,&m[0]);
    2156. 	_TIFFfree(m);

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
      102. 
      103. #ifndef TIFFSwabArrayOfLong
      104. void
           ^
      105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
      106. {

libtiff/tif_swab.c:112:3: Assignment
      110. 	/* XXX unroll loop some */
      111. 	while (n-- > 0) {
      112. 		cp = (unsigned char *)lp;
             ^
      113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
      114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray` 
      111. 	while (n-- > 0) {
      112. 		cp = (unsigned char *)lp;
      113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                 ^
      114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
      115. 		lp++;
