tools/tiffdump.c:490: error: Buffer Overrun L3
  Offset: [17, +oo] (⇐ [16, +oo] + 1) Size: [0, +oo] by call to `PrintData`.

tools/tiffdump.c:283:3: Assignment
281. 		if (swabflag)
282. 			TIFFSwabShort(&dircount);
283. 		direntrysize = 12;
       ^
284. 	} else {
285. 		uint64 dircount64;

tools/tiffdump.c:299:11: Call
297. 		direntrysize = 20;
298. 	}
299. 	dirmem = _TIFFmalloc(dircount * direntrysize);
               ^
300. 	if (dirmem == NULL) {
301. 		Fatal("No space for TIFF directory");

libtiff/tif_unix.c:253:1: Parameter `s`
  251. #endif
  252. 
  253. void*
       ^
  254. _TIFFmalloc(tmsize_t s)
  255. {

libtiff/tif_unix.c:256:10: Array declaration
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
                ^
  257. }
  258. 

libtiff/tif_unix.c:256:2: Assignment
  254. _TIFFmalloc(tmsize_t s)
  255. {
  256. 	return (malloc((size_t) s));
        ^
  257. }
  258. 

tools/tiffdump.c:299:2: Assignment
297. 		direntrysize = 20;
298. 	}
299. 	dirmem = _TIFFmalloc(dircount * direntrysize);
      ^
300. 	if (dirmem == NULL) {
301. 		Fatal("No space for TIFF directory");

tools/tiffdump.c:341:7: Assignment
339. 	    (unsigned long long)nextdiroff, (unsigned long long)nextdiroff);
340. #endif
341. 	for (dp = (uint8*)dirmem, n = dircount; n > 0; n--) {
           ^
342. 		uint16 tag;
343. 		uint16 type;

tools/tiffdump.c:354:3: Assignment
352. 		if (swabflag)
353. 			TIFFSwabShort(&tag);
354. 		dp += sizeof(uint16);
       ^
355. 		type = *(uint16*)dp;
356. 		dp += sizeof(uint16);

tools/tiffdump.c:356:3: Assignment
354. 		dp += sizeof(uint16);
355. 		type = *(uint16*)dp;
356. 		dp += sizeof(uint16);
       ^
357. 		if (swabflag)
358. 			TIFFSwabShort(&type);

tools/tiffdump.c:369:4: Assignment
367. 			if (swabflag)
368. 				TIFFSwabLong(&count32);
369. 			dp += sizeof(uint32);
        ^
370. 			count = count32;
371. 		}

tools/tiffdump.c:390:3: Assignment
388. 		datasize = count*typewidth;
389. 		datafits = 1;
390. 		datamem = dp;
       ^
391. 		dataoffset = 0;
392. 		datatruncated = 0;

tools/tiffdump.c:490:4: Call
488. 				}
489. 			}
490. 			PrintData(stdout,type,(uint32)count,datamem);
        ^
491. 			if (datatruncated)
492. 				printf(" ...");

tools/tiffdump.c:672:1: <Length trace>
670. }
671. 
672. static void
     ^
673. PrintData(FILE* fd, uint16 type, uint32 count, unsigned char* data)
674. {

tools/tiffdump.c:672:1: Parameter `*data`
  670. }
  671. 
  672. static void
       ^
  673. PrintData(FILE* fd, uint16 type, uint32 count, unsigned char* data)
  674. {

tools/tiffdump.c:742:3: Assignment
  740. 	}
  741. 	case TIFF_RATIONAL: {
  742. 		uint32 *lp = (uint32*)data;
         ^
  743. 		while (count-- > 0) {
  744. 			if (lp[1] == 0)

tools/tiffdump.c:744:8: Array access: Offset: [17, +oo] (⇐ [16, +oo] + 1) Size: [0, +oo] by call to `PrintData` 
  742. 		uint32 *lp = (uint32*)data;
  743. 		while (count-- > 0) {
  744. 			if (lp[1] == 0)
              ^
  745. 				fprintf(fd, "%sNan (%lu/%lu)", sep,
  746. 				    (unsigned long) lp[0],
