tools/tiffsplit.c:92: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory`.

tools/tiffsplit.c:89:9: Call
87. 			if (out == NULL)
88. 				return (-2);
89. 			if (!tiffcp(in, out))
            ^
90. 				return (-1);
91. 			TIFFClose(out);

tools/tiffsplit.c:157:1: Parameter `out->tif_dir.td_stripoffset`
  155. }
  156. 
  157. static int
       ^
  158. tiffcp(TIFF* in, TIFF* out)
  159. {

tools/tiffsplit.c:225:11: Call
  223. 	CopyField(TIFFTAG_FAXDCS, stringv);
  224. 	if (TIFFIsTiled(in))
  225. 		return (cpTiles(in, out));
                 ^
  226. 	else
  227. 		return (cpStrips(in, out));

tools/tiffsplit.c:264:1: Parameter `out->tif_dir.td_stripoffset`
    262. }
    263. 
    264. static int
         ^
    265. cpTiles(TIFF* in, TIFF* out)
    266. {

tools/tiffsplit.c:92:12: Call
90. 				return (-1);
91. 			TIFFClose(out);
92. 		} while (TIFFReadDirectory(in));
               ^
93. 		(void) TIFFClose(in);
94. 	}

libtiff/tif_dirread.c:4155:8: <Offset trace>
4153. 
4154. 		tif->tif_dir.td_stripbytecountsorted = 1;
4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
4157. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:4155:8: Assignment
  4153. 
  4154. 		tif->tif_dir.td_stripbytecountsorted = 1;
  4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
               ^
  4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
  4157. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3854:10: <Length trace>
3852.                                     goto bad;
3853.                                 }
3854. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
               ^
3855. 					goto bad;
3856. #endif                                

libtiff/tif_dirread.c:3854:10: Call
  3852.                                     goto bad;
  3853.                                 }
  3854. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
                 ^
  3855. 					goto bad;
  3856. #endif                                

libtiff/tif_dirread.c:5537:1: Parameter `**lpp`
    5535.  * While this routine says "strips", in fact it's also used for tiles.
    5536.  */
    5537. static int
          ^
    5538. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
    5539. {

libtiff/tif_dirread.c:4157:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory` 
  4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
  4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
  4157. 			    tif->tif_dir.td_stripoffset[strip]) {
               ^
  4158. 				tif->tif_dir.td_stripbytecountsorted = 0;
  4159. 				break;
