tools/tiff2pdf.c:5248: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `t2p_write_advance_directory`.

tools/tiff2pdf.c:5128:1: Parameter `output->tif_dir.td_samplesperpixel`
5126. */
5127. 
5128. tsize_t t2p_write_pdf(T2P* t2p, TIFF* input, TIFF* output){
      ^
5129. 
5130. 	tsize_t written=0;

tools/tiff2pdf.c:5247:16: Call
5245. 				streamlen=written;
5246. 				t2p_read_tiff_size_tile(t2p, input, i2);
5247. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
                     ^
5248. 				t2p_write_advance_directory(t2p, output);
5249. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2567:1: Parameter `output->tif_dir.td_samplesperpixel`
  2565.  */
  2566. 
  2567. tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){
        ^
  2568. 
  2569. 	uint16 edge=0;

tools/tiff2pdf.c:5248:5: Call
5246. 				t2p_read_tiff_size_tile(t2p, input, i2);
5247. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
5248. 				t2p_write_advance_directory(t2p, output);
          ^
5249. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}
5250. 				streamlen=written-streamlen;

tools/tiff2pdf.c:3372:1: Parameter `output->tif_dir.td_samplesperpixel`
  3370.  */
  3371. 
  3372. void
        ^
  3373. t2p_write_advance_directory(T2P* t2p, TIFF* output)
  3374. {

tools/tiff2pdf.c:3376:6: Call
  3374. {
  3375. 	t2p_disable(output);
  3376. 	if(!TIFFWriteDirectory(output)){
             ^
  3377. 		TIFFError(TIFF2PDF_MODULE, 
  3378. 			"Error writing virtual directory to output PDF %s", 

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
    161.  * storage that's been changed.
    162.  */
    163. int
         ^
    164. TIFFWriteDirectory(TIFF* tif)
    165. {

libtiff/tif_dirwrite.c:166:9: Call
    164. TIFFWriteDirectory(TIFF* tif)
    165. {
    166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    167. }
    168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
      343. }
      344. 
      345. static int
           ^
      346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      347. {

libtiff/tif_dirwrite.c:557:10: Call
      555. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
      556. 			{
      557. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                    ^
      558. 					goto bad;
      559. 			}

libtiff/tif_dirwrite.c:903:1: Parameter `tif->tif_dir.td_samplesperpixel`
        901. }
        902. 
        903. static int
             ^
        904. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
        905. {

libtiff/tif_dirwrite.c:917:12: Call
        915. 				return(TIFFWriteDirectoryTagSbytePerSample(tif,ndir,dir,tag,(int8)value));
        916. 			else if (tif->tif_dir.td_bitspersample<=16)
        917. 				return(TIFFWriteDirectoryTagSshortPerSample(tif,ndir,dir,tag,(int16)value));
                        ^
        918. 			else
        919. 				return(TIFFWriteDirectoryTagSlongPerSample(tif,ndir,dir,tag,(int32)value));

libtiff/tif_dirwrite.c:1126:1: Parameter `tif->tif_dir.td_samplesperpixel`
          1124. }
          1125. 
          1126. static int
                ^
          1127. TIFFWriteDirectoryTagSshortPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, int16 value)
          1128. {

libtiff/tif_dirwrite.c:1139:4: Call
          1137. 		return(1);
          1138. 	}
          1139. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(int16));
                   ^
          1140. 	if (m==NULL)
          1141. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
            251. #endif
            252. 
            253. void*
                 ^
            254. _TIFFmalloc(tmsize_t s)
            255. {

libtiff/tif_unix.c:256:10: Array declaration
            254. _TIFFmalloc(tmsize_t s)
            255. {
            256. 	return (malloc((size_t) s));
                          ^
            257. }
            258. 

libtiff/tif_unix.c:256:2: Assignment
            254. _TIFFmalloc(tmsize_t s)
            255. {
            256. 	return (malloc((size_t) s));
                  ^
            257. }
            258. 

libtiff/tif_dirwrite.c:1139:2: Assignment
          1137. 		return(1);
          1138. 	}
          1139. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(int16));
                 ^
          1140. 	if (m==NULL)
          1141. 	{

libtiff/tif_dirwrite.c:1147:4: Call
          1145. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
          1146. 		*na=value;
          1147. 	o=TIFFWriteDirectoryTagCheckedSshortArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                   ^
          1148. 	_TIFFfree(m);
          1149. 	return(o);

libtiff/tif_dirwrite.c:1859:1: Parameter `*value`
            1857. #endif
            1858. 
            1859. static int
                  ^
            1860. TIFFWriteDirectoryTagCheckedSshortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int16* value)
            1861. {

libtiff/tif_dirwrite.c:1865:3: Call
            1863. 	assert(sizeof(int16)==2);
            1864. 	if (tif->tif_flags&TIFF_SWAB)
            1865. 		TIFFSwabArrayOfShort((uint16*)value,count);
                    ^
            1866. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SSHORT,count,count*2,value));
            1867. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
              70. 
              71. #ifndef TIFFSwabArrayOfShort
              72. void
                  ^
              73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
              74. {

libtiff/tif_swab.c:80:3: Assignment
              78. 	/* XXX unroll loop some */
              79. 	while (n-- > 0) {
              80. 		cp = (unsigned char*) wp;
                    ^
              81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
              82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `t2p_write_advance_directory` 
              79. 	while (n-- > 0) {
              80. 		cp = (unsigned char*) wp;
              81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
                        ^
              82. 		wp++;
              83. 	}
