contrib/addtiffo/tif_ovrcache.c:257: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory`.

contrib/addtiffo/tif_ovrcache.c:233:5: Call
231. 				if ((iTileY+1)*psCache->nBlockYSize>psCache->nYSize)
232. 					RowsInStrip=psCache->nYSize-iTileY*psCache->nBlockYSize;
233. 				TIFFWriteEncodedStrip( psCache->hTIFF, nTileID,
         ^
234. 				    pabyData,
235. 				    TIFFVStripSize(psCache->hTIFF,RowsInStrip) );

libtiff/tif_write.c:211:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  209.  * NB: Image length must be setup before writing.
  210.  */
  211. tmsize_t
       ^
  212. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  213. {

contrib/addtiffo/tif_ovrcache.c:255:5: Call
253. /*      Restore access to original directory.                           */
254. /* -------------------------------------------------------------------- */
255.     TIFFFlush( psCache->hTIFF );
         ^
256.     /* TODO: add checks on error status return of TIFFFlush */
257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:30:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  28. #include "tiffiop.h"
  29. 
  30. int
      ^
  31. TIFFFlush(TIFF* tif)
  32. {

contrib/addtiffo/tif_ovrcache.c:257:5: Call
255.     TIFFFlush( psCache->hTIFF );
256.     /* TODO: add checks on error status return of TIFFFlush */
257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );
         ^
258.     /* TODO: add checks on error status return of TIFFSetSubDirectory */
259. }

libtiff/tif_dir.c:1649:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  1647.  * the SubIFD tag (e.g. thumbnail images).
  1648.  */
  1649. int
        ^
  1650. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
  1651. {

libtiff/tif_dir.c:1658:10: Call
  1656. 	 */
  1657. 	tif->tif_dirnumber = 0;
  1658. 	return (TIFFReadDirectory(tif));
                 ^
  1659. }
  1660. 

libtiff/tif_dirread.c:3920:42: Call
    3918.                                         goto bad;
    3919.                                     }
    3920.                                     if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset_p))  
                                                   ^
    3921.                                             goto bad;
    3922.                                 }

libtiff/tif_dirread.c:5621:1: Parameter `**lpp`
      5619.  * While this routine says "strips", in fact it's also used for tiles.
      5620.  */
      5621. static int
            ^
      5622. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
      5623. {

libtiff/tif_dirread.c:4269:13: Call
    4267.             TIFFStripSize64(tif) > 0x7FFFFFFFUL )
    4268.         {
    4269.             TryChopUpUncompressedBigTiff(tif);
                      ^
    4270.         }
    4271. 

libtiff/tif_dirread.c:5900:10: Assignment
      5898. 
      5899.     /* Check that the strips are contiguous and of the expected size */
      5900.     for( i = 0; i < td->td_nstrips; i++ )
                     ^
      5901.     {
      5902.         if( i == td->td_nstrips - 1 )

libtiff/tif_dirread.c:5916:26: Call
      5914.                 return;
      5915.             }
      5916.             if( i > 0 && TIFFGetStrileOffset(tif, i) !=
                                     ^
      5917.                     TIFFGetStrileOffset(tif, i-1) + TIFFGetStrileByteCount(tif, i-1) )
      5918.             {

libtiff/tif_dirread.c:6233:1: Parameter `strile`
        6231. 
        6232. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
        6233. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
              ^
        6234. {
        6235.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6235:12: Call
        6233. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
        6234. {
        6235.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
                         ^
        6236. }
        6237. 

libtiff/tif_dirread.c:6239:1: Parameter `strile`
          6237. 
          6238. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
          6239. uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)
                ^
          6240. {
          6241.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6242:12: Call
          6240. {
          6241.     TIFFDirectory *td = &tif->tif_dir;
          6242.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                           ^
          6243.                                &(td->td_stripoffset_entry),
          6244.                                &(td->td_stripoffset_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `strile`
            6189. }
            6190. 
            6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                  ^
            6192.                                                    TIFFDirEntry* dirent,
            6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6215:19: Call
            6213.         else
            6214.         {
            6215.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                    ^
            6216.              {
            6217.                 if( pbErr )

libtiff/tif_dirread.c:6088:1: <Offset trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `strile`
              6086. }
              6087. 
              6088. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6089.                                  uint32 strile,
              6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: <Length trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `**parray`
              6086. }
              6087. 
              6088. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6089.                                  uint32 strile,
              6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6179:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory` 
              6177.         return 0;
              6178. 
              6179.     if( ~((*parray)[strile]) == 0 )
                             ^
              6180.     {
              6181.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
