contrib/addtiffo/tif_overview.c:150: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:146:9: Call
144. /*      Write directory, and return byte offset.                        */
145. /* -------------------------------------------------------------------- */
146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
147.         return 0;
148. 

libtiff/tif_write.c:488:1: Parameter `*tif->tif_dir.td_stripoffset`
  486.  * that important information is not changed.
  487.  */
  488. int
       ^
  489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  490. {

contrib/addtiffo/tif_overview.c:149:5: Call
147.         return 0;
148. 
149.     TIFFWriteDirectory( hTIFF );
         ^
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
151. 

libtiff/tif_dirwrite.c:180:1: Parameter `*tif->tif_dir.td_stripoffset`
  178.  * storage that's been changed.
  179.  */
  180. int
       ^
  181. TIFFWriteDirectory(TIFF* tif)
  182. {

libtiff/tif_dirwrite.c:183:9: Call
  181. TIFFWriteDirectory(TIFF* tif)
  182. {
  183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  184. }
  185. 

libtiff/tif_dirwrite.c:362:1: Parameter `*tif->tif_dir.td_stripoffset`
    360. }
    361. 
    362. static int
         ^
    363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    364. {

contrib/addtiffo/tif_overview.c:150:5: Call
148. 
149.     TIFFWriteDirectory( hTIFF );
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
         ^
151. 
152.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1429:1: Parameter `*tif->tif_dir.td_stripoffset`
  1427.  * NB: Directories are numbered starting at 0.
  1428.  */
  1429. int
        ^
  1430. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1431. {

libtiff/tif_dir.c:1454:10: Call
  1452. 	 */
  1453. 	tif->tif_dirnumber = 0;
  1454. 	return (TIFFReadDirectory(tif));
                 ^
  1455. }
  1456. 

libtiff/tif_dirread.c:3996:8: <Offset trace>
3994. 
3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3996:8: Assignment
    3994. 
    3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
    3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
                 ^
    3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3417:1: <Length trace>
3415.  * format. We read directories sequentially.
3416.  */
3417. int
      ^
3418. TIFFReadDirectory(TIFF* tif)
3419. {

libtiff/tif_dirread.c:3417:1: Parameter `*tif->tif_dir.td_stripoffset`
    3415.  * format. We read directories sequentially.
    3416.  */
    3417. int
          ^
    3418. TIFFReadDirectory(TIFF* tif)
    3419. {

libtiff/tif_dirread.c:3459:2: Call
    3457. 	tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
    3458. 	/* free any old stuff and reinit */
    3459. 	TIFFFreeDirectory(tif);
           ^
    3460. 	TIFFDefaultDirectory(tif);
    3461. 	/*

libtiff/tif_dir.c:1136:1: Parameter `*tif->tif_dir.td_stripoffset`
      1134.  * Release storage associated with a directory.
      1135.  */
      1136. void
            ^
      1137. TIFFFreeDirectory(TIFF* tif)
      1138. {

libtiff/tif_dirread.c:3998:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory` 
    3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
    3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    3998. 			    tif->tif_dir.td_stripoffset[strip]) {
                 ^
    3999. 				tif->tif_dir.td_stripbytecountsorted = 0;
    4000. 				break;
