libtiff/tif_open.c:482: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFCleanup`.

libtiff/tif_open.c:482:9: Call
480. bad:
481. 	tif->tif_mode = O_RDONLY;	/* XXX avoid flush */
482.         TIFFCleanup(tif);
             ^
483. bad2:
484. 	return ((TIFF*)0);

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_samplesperpixel`
  44.  */
  45. 
  46. void
      ^
  47. TIFFCleanup(TIFF* tif)
  48. {

libtiff/tif_close.c:53:3: Call
  51.          */
  52. 	if (tif->tif_mode != O_RDONLY)
  53. 		TIFFFlush(tif);
        ^
  54. 	(*tif->tif_cleanup)(tif);
  55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_samplesperpixel`
    30. #include "tiffiop.h"
    31. 
    32. int
        ^
    33. TIFFFlush(TIFF* tif)
    34. {

libtiff/tif_flush.c:83:13: Call
    81. 
    82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
    83.         && !TIFFWriteDirectory(tif))
                    ^
    84.         return (0);
    85. 

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
      161.  * storage that's been changed.
      162.  */
      163. int
           ^
      164. TIFFWriteDirectory(TIFF* tif)
      165. {

libtiff/tif_dirwrite.c:166:9: Call
      164. TIFFWriteDirectory(TIFF* tif)
      165. {
      166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                   ^
      167. }
      168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
        343. }
        344. 
        345. static int
             ^
        346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
        347. {

libtiff/tif_dirwrite.c:555:10: Call
        553. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
        554. 			{
        555. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                      ^
        556. 					goto bad;
        557. 			}

libtiff/tif_dirwrite.c:897:1: Parameter `tif->tif_dir.td_samplesperpixel`
          895. }
          896. 
          897. static int
               ^
          898. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
          899. {

libtiff/tif_dirwrite.c:906:12: Call
          904. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
          905. 			else
          906. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                          ^
          907. 		case SAMPLEFORMAT_INT:
          908. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1394:1: Parameter `tif->tif_dir.td_samplesperpixel`
            1392. }
            1393. 
            1394. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                  ^
            1395. {
            1396. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1406:4: Call
            1404. 		return(1);
            1405. 	}
            1406. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                     ^
            1407. 	if (m==NULL)
            1408. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
              251. #endif
              252. 
              253. void*
                   ^
              254. _TIFFmalloc(tmsize_t s)
              255. {

libtiff/tif_unix.c:256:10: Array declaration
              254. _TIFFmalloc(tmsize_t s)
              255. {
              256. 	return (malloc((size_t) s));
                            ^
              257. }
              258. 

libtiff/tif_unix.c:256:2: Assignment
              254. _TIFFmalloc(tmsize_t s)
              255. {
              256. 	return (malloc((size_t) s));
                    ^
              257. }
              258. 

libtiff/tif_dirwrite.c:1406:2: Assignment
            1404. 		return(1);
            1405. 	}
            1406. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                   ^
            1407. 	if (m==NULL)
            1408. 	{

libtiff/tif_dirwrite.c:1414:4: Call
            1412. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
            1413. 		*na=value;
            1414. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                     ^
            1415. 	_TIFFfree(m);
            1416. 	return(o);

libtiff/tif_dirwrite.c:2138:1: Parameter `*value`
              2136. #endif
              2137. 
              2138. static int
                    ^
              2139. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
              2140. {

libtiff/tif_dirwrite.c:2145:3: Call
              2143. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
              2144. 	if (tif->tif_flags&TIFF_SWAB)
              2145. 		TIFFSwabArrayOfDouble(value,count);
                      ^
              2146. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
              2147. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
                181. 
                182. #ifndef TIFFSwabArrayOfDouble
                183. void
                     ^
                184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
                185. {

libtiff/tif_swab.c:191:3: Assignment
                189. 	/* XXX unroll loop some */
                190. 	while (n-- > 0) {
                191. 		cp = (unsigned char *)dp;
                       ^
                192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFCleanup` 
                190. 	while (n-- > 0) {
                191. 		cp = (unsigned char *)dp;
                192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                           ^
                193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
                194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
