tools/tiffsplit.c:90: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory`.

tools/tiffsplit.c:87:9: Call
85. 			if (out == NULL)
86. 				return (-2);
87. 			if (!tiffcp(in, out))
            ^
88. 				return (-1);
89. 			TIFFClose(out);

tools/tiffsplit.c:155:1: Parameter `in->tif_dir.td_stripoffset_p`
  153. }
  154. 
  155. static int
       ^
  156. tiffcp(TIFF* in, TIFF* out)
  157. {

tools/tiffsplit.c:223:11: Call
  221. 	CopyField(TIFFTAG_FAXDCS, stringv);
  222. 	if (TIFFIsTiled(in))
  223. 		return (cpTiles(in, out));
                 ^
  224. 	else
  225. 		return (cpStrips(in, out));

tools/tiffsplit.c:262:1: Parameter `in->tif_dir.td_stripoffset_p`
    260. }
    261. 
    262. static int
         ^
    263. cpTiles(TIFF* in, TIFF* out)
    264. {

tools/tiffsplit.c:90:12: Call
88. 				return (-1);
89. 			TIFFClose(out);
90. 		} while (TIFFReadDirectory(in));
               ^
91. 		(void) TIFFClose(in);
92. 	}

libtiff/tif_dirread.c:3578:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  3576.  * format. We read directories sequentially.
  3577.  */
  3578. int
        ^
  3579. TIFFReadDirectory(TIFF* tif)
  3580. {

libtiff/tif_dirread.c:3631:2: Call
  3629. 
  3630. 	/* free any old stuff and reinit */
  3631. 	TIFFFreeDirectory(tif);
         ^
  3632. 	TIFFDefaultDirectory(tif);
  3633. 	/*

libtiff/tif_dir.c:1266:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    1264.  * Release storage associated with a directory.
    1265.  */
    1266. void
          ^
    1267. TIFFFreeDirectory(TIFF* tif)
    1268. {

libtiff/tif_dirread.c:4281:13: Call
  4279.             TIFFStripSize64(tif) > 0x7FFFFFFFUL )
  4280.         {
  4281.             TryChopUpUncompressedBigTiff(tif);
                    ^
  4282.         }
  4283. 

libtiff/tif_dirread.c:5913:10: Assignment
    5911. 
    5912.     /* Check that the strips are contiguous and of the expected size */
    5913.     for( i = 0; i < td->td_nstrips; i++ )
                   ^
    5914.     {
    5915.         if( i == td->td_nstrips - 1 )

libtiff/tif_dirread.c:5929:26: Call
    5927.                 return;
    5928.             }
    5929.             if( i > 0 && TIFFGetStrileOffset(tif, i) !=
                                   ^
    5930.                     TIFFGetStrileOffset(tif, i-1) + TIFFGetStrileByteCount(tif, i-1) )
    5931.             {

libtiff/tif_dirread.c:6248:1: Parameter `strile`
      6246. 
      6247. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
      6248. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
            ^
      6249. {
      6250.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6250:12: Call
      6248. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
      6249. {
      6250.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
                       ^
      6251. }
      6252. 

libtiff/tif_dirread.c:6254:1: Parameter `strile`
        6252. 
        6253. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
        6254. uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)
              ^
        6255. {
        6256.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6257:12: Call
        6255. {
        6256.     TIFFDirectory *td = &tif->tif_dir;
        6257.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                         ^
        6258.                                &(td->td_stripoffset_entry),
        6259.                                &(td->td_stripoffset_p), pbErr);

libtiff/tif_dirread.c:6204:1: Parameter `strile`
          6202. }
          6203. 
          6204. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                ^
          6205.                                                    TIFFDirEntry* dirent,
          6206.                                                    uint64** parray,

libtiff/tif_dirread.c:6230:19: Call
          6228.         else
          6229.         {
          6230.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                  ^
          6231.              {
          6232.                 if( pbErr )

libtiff/tif_dirread.c:6101:1: <Offset trace>
6099. }
6100. 
6101. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6102.                                  uint32 strile,
6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: Parameter `strile`
            6099. }
            6100. 
            6101. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6102.                                  uint32 strile,
            6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: <Length trace>
6099. }
6100. 
6101. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6102.                                  uint32 strile,
6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: Parameter `**parray`
            6099. }
            6100. 
            6101. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6102.                                  uint32 strile,
            6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6192:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory` 
            6190.         return 0;
            6191. 
            6192.     if( ~((*parray)[strile]) == 0 )
                           ^
            6193.     {
            6194.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
