contrib/addtiffo/tif_overview.c:836: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFCreateOvrCache`.

contrib/addtiffo/tif_overview.c:827:22: Call
825.         }
826. 
827.         nDirOffset = TIFF_WriteOverview( hTIFF, nOXSize, nOYSize,
                          ^
828.                                          nBitsPerPixel, nPlanarConfig,
829.                                          nSamples, nOBlockXSize, nOBlockYSize,

contrib/addtiffo/tif_overview.c:146:9: Call
  144. /*      Write directory, and return byte offset.                        */
  145. /* -------------------------------------------------------------------- */
  146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
               ^
  147.         return 0;
  148. 

libtiff/tif_write.c:488:1: Parameter `*tif->tif_dir.td_stripoffset`
    486.  * that important information is not changed.
    487.  */
    488. int
         ^
    489. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
    490. {

contrib/addtiffo/tif_overview.c:836:25: Call
834.                                          nHorSubsampling, nVerSubsampling );
835.         
836.         papoRawBIs[i] = TIFFCreateOvrCache( hTIFF, nDirOffset );
                             ^
837.     }
838. 

contrib/addtiffo/tif_ovrcache.c:43:1: Parameter `*hTIFF->tif_dir.td_stripoffset`
  41. /************************************************************************/
  42. 
  43. TIFFOvrCache *TIFFCreateOvrCache( TIFF *hTIFF, toff_t nDirOffset )
      ^
  44. 
  45. {

contrib/addtiffo/tif_ovrcache.c:57:5: Call
  55. /* -------------------------------------------------------------------- */
  56.     nBaseDirOffset = TIFFCurrentDirOffset( psCache->hTIFF );
  57.     TIFFSetSubDirectory( hTIFF, nDirOffset );
          ^
  58.     
  59.     TIFFGetField( hTIFF, TIFFTAG_IMAGEWIDTH, &(psCache->nXSize) );

libtiff/tif_dir.c:1463:1: Parameter `*tif->tif_dir.td_stripoffset`
    1461.  * the SubIFD tag (e.g. thumbnail images).
    1462.  */
    1463. int
          ^
    1464. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
    1465. {

libtiff/tif_dir.c:1472:10: Call
    1470. 	 */
    1471. 	tif->tif_dirnumber = 0;
    1472. 	return (TIFFReadDirectory(tif));
                   ^
    1473. }
    1474. 

libtiff/tif_dirread.c:3996:8: <Offset trace>
3994. 
3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3996:8: Assignment
      3994. 
      3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
      3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
                   ^
      3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
      3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3417:1: <Length trace>
3415.  * format. We read directories sequentially.
3416.  */
3417. int
      ^
3418. TIFFReadDirectory(TIFF* tif)
3419. {

libtiff/tif_dirread.c:3417:1: Parameter `*tif->tif_dir.td_stripoffset`
      3415.  * format. We read directories sequentially.
      3416.  */
      3417. int
            ^
      3418. TIFFReadDirectory(TIFF* tif)
      3419. {

libtiff/tif_dirread.c:3459:2: Call
      3457. 	tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
      3458. 	/* free any old stuff and reinit */
      3459. 	TIFFFreeDirectory(tif);
             ^
      3460. 	TIFFDefaultDirectory(tif);
      3461. 	/*

libtiff/tif_dir.c:1136:1: Parameter `*tif->tif_dir.td_stripoffset`
        1134.  * Release storage associated with a directory.
        1135.  */
        1136. void
              ^
        1137. TIFFFreeDirectory(TIFF* tif)
        1138. {

libtiff/tif_dirread.c:3998:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFCreateOvrCache` 
      3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
      3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
      3998. 			    tif->tif_dir.td_stripoffset[strip]) {
                   ^
      3999. 				tif->tif_dir.td_stripbytecountsorted = 0;
      4000. 				break;
