tools/tiffcrop.c:6691: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `writeSingleSection`.

tools/tiffcrop.c:6649:1: Parameter `out->tif_dir.td_samplesperpixel`
6647.   } /* end writeRegions */
6648. 
6649. static int
      ^
6650. writeImageSections(TIFF *in, TIFF *out, struct image_data *image,
6651. 		   struct pagedef *page, struct pageseg *sections,

tools/tiffcrop.c:6691:9: Call
6689. 
6690.   /* call the write routine here instead of outside the loop */
6691.     if (writeSingleSection(in, out, image, dump, width, length, hres, vres, sect_buff))
              ^
6692.       {
6693.       TIFFError("writeImageSections", "Unable to write image section");

tools/tiffcrop.c:6707:1: Parameter `out->tif_dir.td_samplesperpixel`
  6705.  * original code assumes we are always copying all samples.
  6706.  */
  6707. static int  
        ^
  6708. writeSingleSection(TIFF *in, TIFF *out, struct image_data *image,
  6709.                    struct dump_opts *dump, uint32 width, uint32 length,

tools/tiffcrop.c:6958:7: Call
  6956.     {
  6957.     if (config == PLANARCONFIG_CONTIG)
  6958.       writeBufferToContigStrips (out, sect_buff, length);
              ^
  6959.     else
  6960.       writeBufferToSeparateStrips(out, sect_buff, length, width, spp, dump);

tools/tiffcrop.c:1086:1: Parameter `out->tif_dir.td_samplesperpixel`
    1084.   }
    1085. 
    1086. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
          ^
    1087.   {
    1088.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1092:3: Call
    1090.   tsize_t stripsize;
    1091. 
    1092.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
            ^
    1093.   for (row = 0; row < imagelength; row += rowsperstrip)
    1094.     {

libtiff/tif_aux.c:271:1: Parameter `tif->tif_dir.td_samplesperpixel`
      269.  * value if the tag is not present in the directory.
      270.  */
      271. int
           ^
      272. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
      273. {

libtiff/tif_aux.c:278:8: Call
      276. 
      277. 	va_start(ap, tag);
      278. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                  ^
      279. 	va_end(ap);
      280. 	return (ok);

libtiff/tif_aux.c:142:1: Parameter `tif->tif_dir.td_extrasamples`
        140.  *	place in the library -- in TIFFDefaultDirectory.
        141.  */
        142. int
             ^
        143. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
        144. {

tools/tiffcrop.c:6963:8: Call
  6961.     }
  6962. 
  6963.   if (!TIFFWriteDirectory(out))
               ^
  6964.     {
  6965.     TIFFClose(out);

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
    161.  * storage that's been changed.
    162.  */
    163. int
         ^
    164. TIFFWriteDirectory(TIFF* tif)
    165. {

libtiff/tif_dirwrite.c:166:9: Call
    164. TIFFWriteDirectory(TIFF* tif)
    165. {
    166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    167. }
    168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
      343. }
      344. 
      345. static int
           ^
      346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      347. {

libtiff/tif_dirwrite.c:445:10: Call
      443. 			if (TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
      444. 			{
      445. 				if (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_BITSPERSAMPLE,tif->tif_dir.td_bitspersample))
                    ^
      446. 					goto bad;
      447. 			}

libtiff/tif_dirwrite.c:1076:1: Parameter `tif->tif_dir.td_samplesperpixel`
        1074. }
        1075. 
        1076. static int
              ^
        1077. TIFFWriteDirectoryTagShortPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 value)
        1078. {

libtiff/tif_dirwrite.c:1089:4: Call
        1087. 		return(1);
        1088. 	}
        1089. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(uint16));
                 ^
        1090. 	if (m==NULL)
        1091. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
          251. #endif
          252. 
          253. void*
               ^
          254. _TIFFmalloc(tmsize_t s)
          255. {

libtiff/tif_unix.c:256:10: Array declaration
          254. _TIFFmalloc(tmsize_t s)
          255. {
          256. 	return (malloc((size_t) s));
                        ^
          257. }
          258. 

libtiff/tif_unix.c:256:2: Assignment
          254. _TIFFmalloc(tmsize_t s)
          255. {
          256. 	return (malloc((size_t) s));
                ^
          257. }
          258. 

libtiff/tif_dirwrite.c:1089:2: Assignment
        1087. 		return(1);
        1088. 	}
        1089. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(uint16));
               ^
        1090. 	if (m==NULL)
        1091. 	{

libtiff/tif_dirwrite.c:1097:4: Call
        1095. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
        1096. 		*na=value;
        1097. 	o=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                 ^
        1098. 	_TIFFfree(m);
        1099. 	return(o);

libtiff/tif_dirwrite.c:1836:1: Parameter `*value`
          1834. }
          1835. 
          1836. static int
                ^
          1837. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
          1838. {

libtiff/tif_dirwrite.c:1842:3: Call
          1840. 	assert(sizeof(uint16)==2);
          1841. 	if (tif->tif_flags&TIFF_SWAB)
          1842. 		TIFFSwabArrayOfShort(value,count);
                  ^
          1843. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
          1844. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
            70. 
            71. #ifndef TIFFSwabArrayOfShort
            72. void
                ^
            73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
            74. {

libtiff/tif_swab.c:80:3: Assignment
            78. 	/* XXX unroll loop some */
            79. 	while (n-- > 0) {
            80. 		cp = (unsigned char*) wp;
                  ^
            81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
            82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `writeSingleSection` 
            79. 	while (n-- > 0) {
            80. 		cp = (unsigned char*) wp;
            81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
                      ^
            82. 		wp++;
            83. 	}
