contrib/iptcutil/iptcutil.c:312: error: Buffer Overrun L3
  Offset: [1, 1048576] Size: [2, 1048577].

contrib/iptcutil/iptcutil.c:302:12: <Offset trace>
300.           return 0;
301.         }
302.       for (tagindx=0; tagindx<taglen; tagindx++)
                ^
303.         {
304.           c = getc(ifile);

contrib/iptcutil/iptcutil.c:302:12: Assignment
300.           return 0;
301.         }
302.       for (tagindx=0; tagindx<taglen; tagindx++)
                ^
303.         {
304.           c = getc(ifile);

contrib/iptcutil/iptcutil.c:268:19: <Length trace>
266.           for (i=0; i<4; i++)
267.             {
268.               c = getc(ifile);
                       ^
269.               if (c == EOF)
270.                 return -1;

contrib/iptcutil/iptcutil.c:268:19: Unknown value from: _IO_getc
266.           for (i=0; i<4; i++)
267.             {
268.               c = getc(ifile);
                       ^
269.               if (c == EOF)
270.                 return -1;

contrib/iptcutil/iptcutil.c:268:15: Assignment
266.           for (i=0; i<4; i++)
267.             {
268.               c = getc(ifile);
                   ^
269.               if (c == EOF)
270.                 return -1;

contrib/iptcutil/iptcutil.c:271:15: Assignment
269.               if (c == EOF)
270.                 return -1;
271.               buffer[i] = c;
                   ^
272.             }
273.           taglen = (((long) buffer[ 0 ]) << 24) |

contrib/iptcutil/iptcutil.c:273:11: Assignment
271.               buffer[i] = c;
272.             }
273.           taglen = (((long) buffer[ 0 ]) << 24) |
               ^
274.             (((long) buffer[ 1 ]) << 16) | 
275.             (((long) buffer[ 2 ]) <<  8) |

contrib/iptcutil/iptcutil.c:296:22: Array declaration
294.         }
295.       /* make a buffer to hold the tag data and snag it from the input stream */
296.       str = (char *) malloc((unsigned int) (taglen+1));
                          ^
297.       if (str == (char *) NULL)
298.         {

contrib/iptcutil/iptcutil.c:296:7: Assignment
294.         }
295.       /* make a buffer to hold the tag data and snag it from the input stream */
296.       str = (char *) malloc((unsigned int) (taglen+1));
           ^
297.       if (str == (char *) NULL)
298.         {

contrib/iptcutil/iptcutil.c:312:7: Array access: Offset: [1, 1048576] Size: [2, 1048577]
310.           str[tagindx] = c;
311.         }
312.       str[ taglen ] = 0;
           ^
313. 
314.       /* now finish up by formatting this binary data into ASCII equivalent */
