tools/tiffcrop.c:6746: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `writeCroppedImage`.

tools/tiffcrop.c:6727:1: Parameter `(*out)->tif_dir.td_samplesperpixel`
6725.   } /* end extractImageSection */
6726. 
6727. static int 
      ^
6728. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6729.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6743:14: Call
6741.          autoindex = 0;
6742.          crop_buff = seg_buffs[0].buffer;
6743.          if (update_output_file (out, mp, autoindex, filename, page))
                   ^
6744.            return (1);
6745.          page_count = total_pages;

tools/tiffcrop.c:2037:1: Parameter `(*tiffout)->tif_dir.td_samplesperpixel`
  2035.  * so TIFFTAG PAGENUM will be correct in image.
  2036.  */
  2037. static int 
        ^
  2038. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2039.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6746:14: Call
6744.            return (1);
6745.          page_count = total_pages;
6746.          if (writeCroppedImage(in, *out, image, dump,
                   ^
6747.                                crop->combined_width, 
6748.                                crop->combined_length,

tools/tiffcrop.c:7569:1: Parameter `out->tif_dir.td_samplesperpixel`
  7567.  * then passed in as an argument.
  7568.  */
  7569. static int  
        ^
  7570. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7571.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7825:11: Call
  7823.     if (config == PLANARCONFIG_CONTIG)
  7824.       {
  7825.       if (writeBufferToContigStrips (out, crop_buff, length))
                  ^
  7826.         TIFFError("","Unable to write contiguous strip data for page %d", pagenum);
  7827.       }

tools/tiffcrop.c:1098:1: Parameter `out->tif_dir.td_samplesperpixel`
    1096.   }
    1097. 
    1098. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
          ^
    1099.   {
    1100.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1104:3: Call
    1102.   tsize_t stripsize;
    1103. 
    1104.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
            ^
    1105.   for (row = 0; row < imagelength; row += rowsperstrip)
    1106.     {

libtiff/tif_aux.c:298:1: Parameter `tif->tif_dir.td_samplesperpixel`
      296.  * value if the tag is not present in the directory.
      297.  */
      298. int
           ^
      299. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
      300. {

libtiff/tif_aux.c:305:8: Call
      303. 
      304. 	va_start(ap, tag);
      305. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                  ^
      306. 	va_end(ap);
      307. 	return (ok);

libtiff/tif_aux.c:169:1: Parameter `tif->tif_dir.td_extrasamples`
        167.  *	place in the library -- in TIFFDefaultDirectory.
        168.  */
        169. int
             ^
        170. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
        171. {

tools/tiffcrop.c:7835:8: Call
  7833.     }
  7834. 
  7835.   if (!TIFFWriteDirectory(out))
               ^
  7836.     {
  7837.     TIFFError("","Failed to write IFD for page number %d", pagenum);

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_samplesperpixel`
    178.  * storage that's been changed.
    179.  */
    180. int
         ^
    181. TIFFWriteDirectory(TIFF* tif)
    182. {

libtiff/tif_dirwrite.c:183:9: Call
    181. TIFFWriteDirectory(TIFF* tif)
    182. {
    183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    184. }
    185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_samplesperpixel`
      360. }
      361. 
      362. static int
           ^
      363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      364. {

libtiff/tif_dirwrite.c:577:10: Call
      575. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
      576. 			{
      577. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                    ^
      578. 					goto bad;
      579. 			}

libtiff/tif_dirwrite.c:928:1: Parameter `count`
        926. }
        927. 
        928. static int
             ^
        929. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
        930. {

libtiff/tif_dirwrite.c:935:9: Call
        933. 	uint32 i;
        934. 	int ok;
        935. 	conv = _TIFFmalloc(count*sizeof(double));
                     ^
        936. 	if (conv == NULL)
        937. 	{

libtiff/tif_unix.c:261:17: Assignment
          259. {
          260.         if (s == 0)
          261.                 return ((void *) NULL);
                               ^
          262. 
          263. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:935:2: Assignment
        933. 	uint32 i;
        934. 	int ok;
        935. 	conv = _TIFFmalloc(count*sizeof(double));
              ^
        936. 	if (conv == NULL)
        937. 	{

libtiff/tif_dirwrite.c:973:10: Call
        971. 				for (i = 0; i < count; ++i)
        972. 					((int32*)conv)[i] = (int32)value[i];
        973. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                      ^
        974. 			}
        975. 			break;

libtiff/tif_dirwrite.c:1324:1: Parameter `*value`
          1322. #endif
          1323. 
          1324. static int
                ^
          1325. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
          1326. {

libtiff/tif_dirwrite.c:1332:9: Call
          1330. 		return(1);
          1331. 	}
          1332. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                        ^
          1333. }
          1334. 

libtiff/tif_dirwrite.c:2020:1: Parameter `*value`
            2018. #endif
            2019. 
            2020. static int
                  ^
            2021. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
            2022. {

libtiff/tif_dirwrite.c:2026:3: Call
            2024. 	assert(sizeof(int32)==4);
            2025. 	if (tif->tif_flags&TIFF_SWAB)
            2026. 		TIFFSwabArrayOfLong((uint32*)value,count);
                    ^
            2027. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
            2028. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
              102. 
              103. #ifndef TIFFSwabArrayOfLong
              104. void
                   ^
              105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
              106. {

libtiff/tif_swab.c:112:3: Assignment
              110. 	/* XXX unroll loop some */
              111. 	while (n-- > 0) {
              112. 		cp = (unsigned char *)lp;
                     ^
              113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
              114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `writeCroppedImage` 
              111. 	while (n-- > 0) {
              112. 		cp = (unsigned char *)lp;
              113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                         ^
              114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
              115. 		lp++;
