tools/tiffgt.c:194: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose`.

tools/tiffgt.c:194:17: Call
192.                 _TIFFfree(raster);
193.         if (tif != NULL)
194.                 TIFFClose(tif);
                     ^
195.         exit(0);
196. }

libtiff/tif_close.c:122:1: Parameter `tif->tif_dir.td_nstrips`
  120.  */
  121. 
  122. void
       ^
  123. TIFFClose(TIFF* tif)
  124. {

libtiff/tif_close.c:128:2: Call
  126. 	thandle_t fd = tif->tif_clientdata;
  127. 
  128. 	TIFFCleanup(tif);
        ^
  129. 	(void) (*closeproc)(fd);
  130. }

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_nstrips`
    44.  */
    45. 
    46. void
        ^
    47. TIFFCleanup(TIFF* tif)
    48. {

libtiff/tif_close.c:53:3: Call
    51.          */
    52. 	if (tif->tif_mode != O_RDONLY)
    53. 		TIFFFlush(tif);
          ^
    54. 	(*tif->tif_cleanup)(tif);
    55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_nstrips`
      30. #include "tiffiop.h"
      31. 
      32. int
          ^
      33. TIFFFlush(TIFF* tif)
      34. {

libtiff/tif_flush.c:38:10: Call
      36.         return 1;
      37. 
      38.     if (!TIFFFlushData(tif))
                   ^
      39.         return (0);
      40.                 

libtiff/tif_flush.c:98:1: Parameter `tif->tif_dir.td_nstrips`
         96.  * problems for other people. 
         97.  */
         98. int
             ^
         99. TIFFFlushData(TIFF* tif)
        100. {

libtiff/tif_flush.c:83:13: Call
      81. 
      82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      83.         && !TIFFRewriteDirectory(tif))
                      ^
      84.         return (0);
      85. 

libtiff/tif_dirwrite.c:216:1: Parameter `tif->tif_dir.td_nstrips`
        214.  * previously used directory space. 
        215.  */ 
        216. int
             ^
        217. TIFFRewriteDirectory( TIFF *tif )
        218. {

libtiff/tif_dirwrite.c:223:10: Call
        221. 	/* We don't need to do anything special if it hasn't been written. */
        222. 	if( tif->tif_diroff == 0 )
        223. 		return TIFFWriteDirectory( tif );
                      ^
        224. 
        225. 	/*

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_nstrips`
          178.  * storage that's been changed.
          179.  */
          180. int
               ^
          181. TIFFWriteDirectory(TIFF* tif)
          182. {

libtiff/tif_dirwrite.c:183:9: Call
          181. TIFFWriteDirectory(TIFF* tif)
          182. {
          183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          184. }
          185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_nstrips`
            360. }
            361. 
            362. static int
                 ^
            363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            364. {

libtiff/tif_dirwrite.c:532:11: Call
            530. 				if (!isTiled(tif))
            531. 				{
            532. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                           ^
            533. 						goto bad;
            534. 				}

libtiff/tif_dirwrite.c:1587:1: Parameter `count`
              1585. /************************************************************************/
              1586. 
              1587. static int
                    ^
              1588. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
              1589. {

libtiff/tif_dirwrite.c:1614:9: Call
              1612.     */
              1613. 
              1614.     p = _TIFFmalloc(count*sizeof(uint32));
                            ^
              1615.     if (p==NULL)
              1616.     {

libtiff/tif_unix.c:253:1: Parameter `s`
                251. #endif
                252. 
                253. void*
                     ^
                254. _TIFFmalloc(tmsize_t s)
                255. {

libtiff/tif_unix.c:256:10: Array declaration
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                              ^
                257. }
                258. 

libtiff/tif_unix.c:256:2: Assignment
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                      ^
                257. }
                258. 

libtiff/tif_dirwrite.c:1614:5: Assignment
              1612.     */
              1613. 
              1614.     p = _TIFFmalloc(count*sizeof(uint32));
                        ^
              1615.     if (p==NULL)
              1616.     {

libtiff/tif_dirwrite.c:1633:7: Call
              1631.     }
              1632. 
              1633.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                          ^
              1634.     _TIFFfree(p);
              1635. 

libtiff/tif_dirwrite.c:1997:1: Parameter `*value`
                1995. }
                1996. 
                1997. static int
                      ^
                1998. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
                1999. {

libtiff/tif_dirwrite.c:2003:3: Call
                2001. 	assert(sizeof(uint32)==4);
                2002. 	if (tif->tif_flags&TIFF_SWAB)
                2003. 		TIFFSwabArrayOfLong(value,count);
                        ^
                2004. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
                2005. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
                  102. 
                  103. #ifndef TIFFSwabArrayOfLong
                  104. void
                       ^
                  105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                  106. {

libtiff/tif_swab.c:112:3: Assignment
                  110. 	/* XXX unroll loop some */
                  111. 	while (n-- > 0) {
                  112. 		cp = (unsigned char *)lp;
                         ^
                  113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                  114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose` 
                  111. 	while (n-- > 0) {
                  112. 		cp = (unsigned char *)lp;
                  113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                             ^
                  114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                  115. 		lp++;
