libtiff/tif_dirwrite.c:582: error: Buffer Overrun L3
  Offset: [0, 28] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSampleformatArray`.

libtiff/tif_dirwrite.c:422:2: Assignment
420. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
421. 	}
422. 	dir=NULL;
      ^
423. 	dirmem=NULL;
424. 	dirsize=0;

libtiff/tif_dirwrite.c:582:10: Call
580. 			if (TIFFFieldSet(tif,FIELD_SMAXSAMPLEVALUE))
581. 			{
582. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMAXSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_smaxsamplevalue))
              ^
583. 					goto bad;
584. 			}

libtiff/tif_dirwrite.c:928:1: Parameter `*dir`
  926. }
  927. 
  928. static int
       ^
  929. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
  930. {

libtiff/tif_dirwrite.c:953:10: Call
  951. 			else
  952. 			{
  953. 				ok = TIFFWriteDirectoryTagDoubleArray(tif,ndir,dir,tag,count,value);
                ^
  954. 			}
  955. 			break;

libtiff/tif_dirwrite.c:1505:1: Parameter `*dir`
    1503. #endif
    1504. 
    1505. static int TIFFWriteDirectoryTagDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
          ^
    1506. {
    1507. 	if (dir==NULL)

libtiff/tif_dirwrite.c:1512:9: Call
    1510. 		return(1);
    1511. 	}
    1512. 	return(TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,count,value));
                  ^
    1513. }
    1514. 

libtiff/tif_dirwrite.c:2261:1: Parameter `*dir`
      2259. #endif
      2260. 
      2261. static int
            ^
      2262. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
      2263. {

libtiff/tif_dirwrite.c:2269:9: Call
      2267. 	if (tif->tif_flags&TIFF_SWAB)
      2268. 		TIFFSwabArrayOfDouble(value,count);
      2269. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
                    ^
      2270. }
      2271. 

libtiff/tif_dirwrite.c:2293:1: <Offset trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*ndir`
        2291. }
        2292. 
        2293. static int
              ^
        2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
        2295. {

libtiff/tif_dirwrite.c:2293:1: <Length trace>
2291. }
2292. 
2293. static int
      ^
2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2295. {

libtiff/tif_dirwrite.c:2293:1: Parameter `*dir`
        2291. }
        2292. 
        2293. static int
              ^
        2294. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
        2295. {

libtiff/tif_dirwrite.c:2312:2: Array access: Offset: [0, 28] Size: [0, +oo] by call to `TIFFWriteDirectoryTagSampleformatArray` 
        2310. 			dir[n]=dir[n-1];
        2311. 	}
        2312. 	dir[m].tdir_tag=tag;
               ^
        2313. 	dir[m].tdir_type=datatype;
        2314. 	dir[m].tdir_count=count;
