tools/tiffcp.c:146: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose`.

tools/tiffcp.c:145:9: Call
143. 		if (tif) {
144. 			**imageSpec = comma;  /* replace the comma */
145. 			if (!nextSrcImage(tif, imageSpec)) {
             ^
146. 				TIFFClose (tif);
147. 				tif = NULL;

tools/tiffcp.c:97:1: Parameter `tif->tif_dir.td_nstrips`
  95. static int pageInSeq = 0;
  96. 
  97. static int nextSrcImage (TIFF *tif, char **imageSpec)
      ^
  98. /*
  99.   seek to the next image specified in *imageSpec

tools/tiffcp.c:146:5: Call
144. 			**imageSpec = comma;  /* replace the comma */
145. 			if (!nextSrcImage(tif, imageSpec)) {
146. 				TIFFClose (tif);
         ^
147. 				tif = NULL;
148. 			}

libtiff/tif_close.c:120:1: Parameter `tif->tif_dir.td_nstrips`
  118.  */
  119. 
  120. void
       ^
  121. TIFFClose(TIFF* tif)
  122. {

libtiff/tif_close.c:126:2: Call
  124. 	thandle_t fd = tif->tif_clientdata;
  125. 
  126. 	TIFFCleanup(tif);
        ^
  127. 	(void) (*closeproc)(fd);
  128. }

libtiff/tif_close.c:44:1: Parameter `tif->tif_dir.td_nstrips`
    42.  */
    43. 
    44. void
        ^
    45. TIFFCleanup(TIFF* tif)
    46. {

libtiff/tif_close.c:51:3: Call
    49.          */
    50. 	if (tif->tif_mode != O_RDONLY)
    51. 		TIFFFlush(tif);
          ^
    52. 	(*tif->tif_cleanup)(tif);
    53. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_nstrips`
      28. #include "tiffiop.h"
      29. 
      30. int
          ^
      31. TIFFFlush(TIFF* tif)
      32. {

libtiff/tif_flush.c:36:10: Call
      34.         return 1;
      35. 
      36.     if (!TIFFFlushData(tif))
                   ^
      37.         return (0);
      38.                 

libtiff/tif_flush.c:96:1: Parameter `tif->tif_dir.td_nstrips`
        94.  * problems for other people. 
        95.  */
        96. int
            ^
        97. TIFFFlushData(TIFF* tif)
        98. {

libtiff/tif_flush.c:81:13: Call
      79. 
      80.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      81.         && !TIFFRewriteDirectory(tif))
                      ^
      82.         return (0);
      83. 

libtiff/tif_dirwrite.c:214:1: Parameter `tif->tif_dir.td_nstrips`
        212.  * previously used directory space. 
        213.  */ 
        214. int
             ^
        215. TIFFRewriteDirectory( TIFF *tif )
        216. {

libtiff/tif_dirwrite.c:221:10: Call
        219. 	/* We don't need to do anything special if it hasn't been written. */
        220. 	if( tif->tif_diroff == 0 )
        221. 		return TIFFWriteDirectory( tif );
                      ^
        222. 
        223. 	/*

libtiff/tif_dirwrite.c:178:1: Parameter `tif->tif_dir.td_nstrips`
          176.  * storage that's been changed.
          177.  */
          178. int
               ^
          179. TIFFWriteDirectory(TIFF* tif)
          180. {

libtiff/tif_dirwrite.c:181:9: Call
          179. TIFFWriteDirectory(TIFF* tif)
          180. {
          181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          182. }
          183. 

libtiff/tif_dirwrite.c:360:1: Parameter `tif->tif_dir.td_nstrips`
            358. }
            359. 
            360. static int
                 ^
            361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            362. {

libtiff/tif_dirwrite.c:530:11: Call
            528. 				if (!isTiled(tif))
            529. 				{
            530. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))
                           ^
            531. 						goto bad;
            532. 				}

libtiff/tif_dirwrite.c:1694:1: Parameter `count`
              1692. /************************************************************************/
              1693. 
              1694. static int
                    ^
              1695. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
              1696. {

libtiff/tif_dirwrite.c:1747:21: Call
              1745.         */
              1746. 
              1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                                        ^
              1748.         uint32* q;
              1749.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
                310. {
                311.         if (s == 0)
                312.                 return ((void *) NULL);
                                     ^
                313. 
                314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1747:9: Assignment
              1745.         */
              1746. 
              1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                            ^
              1748.         uint32* q;
              1749.         uint64* ma;

libtiff/tif_dirwrite.c:1770:11: Call
              1768.         }
              1769. 
              1770.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                              ^
              1771.         _TIFFfree(p);
              1772.     }

libtiff/tif_dirwrite.c:2173:1: Parameter `*value`
                2171. }
                2172. 
                2173. static int
                      ^
                2174. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
                2175. {

libtiff/tif_dirwrite.c:2179:3: Call
                2177. 	assert(sizeof(uint32)==4);
                2178. 	if (tif->tif_flags&TIFF_SWAB)
                2179. 		TIFFSwabArrayOfLong(value,count);
                        ^
                2180. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
                2181. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
                  100. 
                  101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
                  102. void
                       ^
                  103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                  104. {

libtiff/tif_swab.c:110:3: Assignment
                  108. 	/* XXX unroll loop some */
                  109. 	while (n-- > 0) {
                  110. 		cp = (unsigned char *)lp;
                         ^
                  111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                  112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose` 
                  109. 	while (n-- > 0) {
                  110. 		cp = (unsigned char *)lp;
                  111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                             ^
                  112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                  113. 		lp++;
