libtiff/tif_open.c:484: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFCleanup`.

libtiff/tif_open.c:484:9: Call
482. bad:
483. 	tif->tif_mode = O_RDONLY;	/* XXX avoid flush */
484.         TIFFCleanup(tif);
             ^
485. bad2:
486. 	return ((TIFF*)0);

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_samplesperpixel`
  44.  */
  45. 
  46. void
      ^
  47. TIFFCleanup(TIFF* tif)
  48. {

libtiff/tif_close.c:53:3: Call
  51.          */
  52. 	if (tif->tif_mode != O_RDONLY)
  53. 		TIFFFlush(tif);
        ^
  54. 	(*tif->tif_cleanup)(tif);
  55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_samplesperpixel`
    30. #include "tiffiop.h"
    31. 
    32. int
        ^
    33. TIFFFlush(TIFF* tif)
    34. {

libtiff/tif_flush.c:83:13: Call
    81. 
    82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
    83.         && !TIFFRewriteDirectory(tif))
                    ^
    84.         return (0);
    85. 

libtiff/tif_dirwrite.c:199:1: Parameter `tif->tif_dir.td_samplesperpixel`
      197.  * previously used directory space. 
      198.  */ 
      199. int
           ^
      200. TIFFRewriteDirectory( TIFF *tif )
      201. {

libtiff/tif_dirwrite.c:206:10: Call
      204. 	/* We don't need to do anything special if it hasn't been written. */
      205. 	if( tif->tif_diroff == 0 )
      206. 		return TIFFWriteDirectory( tif );
                    ^
      207. 
      208. 	/*

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
        161.  * storage that's been changed.
        162.  */
        163. int
             ^
        164. TIFFWriteDirectory(TIFF* tif)
        165. {

libtiff/tif_dirwrite.c:166:9: Call
        164. TIFFWriteDirectory(TIFF* tif)
        165. {
        166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                     ^
        167. }
        168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
          343. }
          344. 
          345. static int
               ^
          346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
          347. {

libtiff/tif_dirwrite.c:557:10: Call
          555. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
          556. 			{
          557. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                        ^
          558. 					goto bad;
          559. 			}

libtiff/tif_dirwrite.c:903:1: Parameter `tif->tif_dir.td_samplesperpixel`
            901. }
            902. 
            903. static int
                 ^
            904. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
            905. {

libtiff/tif_dirwrite.c:912:12: Call
            910. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
            911. 			else
            912. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                            ^
            913. 		case SAMPLEFORMAT_INT:
            914. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1400:1: Parameter `tif->tif_dir.td_samplesperpixel`
              1398. }
              1399. 
              1400. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                    ^
              1401. {
              1402. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1412:4: Call
              1410. 		return(1);
              1411. 	}
              1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                       ^
              1413. 	if (m==NULL)
              1414. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
                251. #endif
                252. 
                253. void*
                     ^
                254. _TIFFmalloc(tmsize_t s)
                255. {

libtiff/tif_unix.c:256:10: Array declaration
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                              ^
                257. }
                258. 

libtiff/tif_unix.c:256:2: Assignment
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                      ^
                257. }
                258. 

libtiff/tif_dirwrite.c:1412:2: Assignment
              1410. 		return(1);
              1411. 	}
              1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                     ^
              1413. 	if (m==NULL)
              1414. 	{

libtiff/tif_dirwrite.c:1420:4: Call
              1418. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
              1419. 		*na=value;
              1420. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                       ^
              1421. 	_TIFFfree(m);
              1422. 	return(o);

libtiff/tif_dirwrite.c:2144:1: Parameter `*value`
                2142. #endif
                2143. 
                2144. static int
                      ^
                2145. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
                2146. {

libtiff/tif_dirwrite.c:2151:3: Call
                2149. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
                2150. 	if (tif->tif_flags&TIFF_SWAB)
                2151. 		TIFFSwabArrayOfDouble(value,count);
                        ^
                2152. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
                2153. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
                  181. 
                  182. #ifndef TIFFSwabArrayOfDouble
                  183. void
                       ^
                  184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
                  185. {

libtiff/tif_swab.c:191:3: Assignment
                  189. 	/* XXX unroll loop some */
                  190. 	while (n-- > 0) {
                  191. 		cp = (unsigned char *)dp;
                         ^
                  192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                  193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFCleanup` 
                  190. 	while (n-- > 0) {
                  191. 		cp = (unsigned char *)dp;
                  192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                             ^
                  193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
                  194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
