tools/tiffcrop.c:6977: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `update_output_file`.

tools/tiffcrop.c:6891:1: Parameter `(*out)->tif_dir.td_samplesperpixel`
6889.   } /* end extractImageSection */
6890. 
6891. static int 
      ^
6892. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6893.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6977:16: Call
6975.          for (i = 0; i < crop->selections; i++)
6976.            {
6977.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6978.              return (1);
6979. 

tools/tiffcrop.c:2106:1: Parameter `(*tiffout)->tif_dir.td_samplesperpixel`
  2104.  * so TIFFTAG PAGENUM will be correct in image.
  2105.  */
  2106. static int
        ^
  2107. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2108.                     char *outname, unsigned int *page)

tools/tiffcrop.c:2119:5: Call
  2117.     {
  2118.     /* Close any export file that was previously opened */
  2119.     TIFFClose (*tiffout);
            ^
  2120.     *tiffout = NULL;
  2121.     }

libtiff/tif_close.c:120:1: Parameter `tif->tif_dir.td_samplesperpixel`
    118.  */
    119. 
    120. void
         ^
    121. TIFFClose(TIFF* tif)
    122. {

libtiff/tif_close.c:126:2: Call
    124. 	thandle_t fd = tif->tif_clientdata;
    125. 
    126. 	TIFFCleanup(tif);
          ^
    127. 	(void) (*closeproc)(fd);
    128. }

libtiff/tif_close.c:44:1: Parameter `tif->tif_dir.td_samplesperpixel`
      42.  */
      43. 
      44. void
          ^
      45. TIFFCleanup(TIFF* tif)
      46. {

libtiff/tif_close.c:51:3: Call
      49.          */
      50. 	if (tif->tif_mode != O_RDONLY)
      51. 		TIFFFlush(tif);
            ^
      52. 	(*tif->tif_cleanup)(tif);
      53. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_samplesperpixel`
        28. #include "tiffiop.h"
        29. 
        30. int
            ^
        31. TIFFFlush(TIFF* tif)
        32. {

libtiff/tif_flush.c:53:13: Call
        51. 
        52.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
        53.         && !TIFFRewriteDirectory(tif))
                        ^
        54.         return (0);
        55. 

libtiff/tif_dirwrite.c:259:1: Parameter `tif->tif_dir.td_samplesperpixel`
          257.  * previously used directory space. 
          258.  */ 
          259. int
               ^
          260. TIFFRewriteDirectory( TIFF *tif )
          261. {

libtiff/tif_dirwrite.c:266:10: Call
          264. 	/* We don't need to do anything special if it hasn't been written. */
          265. 	if( tif->tif_diroff == 0 )
          266. 		return TIFFWriteDirectory( tif );
                        ^
          267. 
          268. 	/*

libtiff/tif_dirwrite.c:178:1: Parameter `tif->tif_dir.td_samplesperpixel`
            176.  * storage that's been changed.
            177.  */
            178. int
                 ^
            179. TIFFWriteDirectory(TIFF* tif)
            180. {

libtiff/tif_dirwrite.c:181:9: Call
            179. TIFFWriteDirectory(TIFF* tif)
            180. {
            181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                         ^
            182. }
            183. 

libtiff/tif_dirwrite.c:405:1: Parameter `tif->tif_dir.td_samplesperpixel`
              403. }
              404. 
              405. static int
                   ^
              406. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
              407. {

libtiff/tif_dirwrite.c:632:10: Call
              630. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
              631. 			{
              632. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                            ^
              633. 					goto bad;
              634. 			}

libtiff/tif_dirwrite.c:1047:1: Parameter `count`
                1045. }
                1046. 
                1047. static int
                      ^
                1048. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
                1049. {

libtiff/tif_dirwrite.c:1054:9: Call
                1052. 	uint32 i;
                1053. 	int ok;
                1054. 	conv = _TIFFmalloc(count*sizeof(double));
                              ^
                1055. 	if (conv == NULL)
                1056. 	{

libtiff/tif_unix.c:312:17: Assignment
                  310. {
                  311.         if (s == 0)
                  312.                 return ((void *) NULL);
                                       ^
                  313. 
                  314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1054:2: Assignment
                1052. 	uint32 i;
                1053. 	int ok;
                1054. 	conv = _TIFFmalloc(count*sizeof(double));
                       ^
                1055. 	if (conv == NULL)
                1056. 	{

libtiff/tif_dirwrite.c:1092:10: Call
                1090. 				for (i = 0; i < count; ++i)
                1091. 					((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
                1092. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                               ^
                1093. 			}
                1094. 			break;

libtiff/tif_dirwrite.c:1443:1: Parameter `*value`
                  1441. #endif
                  1442. 
                  1443. static int
                        ^
                  1444. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                  1445. {

libtiff/tif_dirwrite.c:1451:9: Call
                  1449. 		return(1);
                  1450. 	}
                  1451. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                                ^
                  1452. }
                  1453. 

libtiff/tif_dirwrite.c:2246:1: Parameter `*value`
                    2244. #endif
                    2245. 
                    2246. static int
                          ^
                    2247. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                    2248. {

libtiff/tif_dirwrite.c:2252:3: Call
                    2250. 	assert(sizeof(int32)==4);
                    2251. 	if (tif->tif_flags&TIFF_SWAB)
                    2252. 		TIFFSwabArrayOfLong((uint32*)value,count);
                            ^
                    2253. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
                    2254. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
                      100. 
                      101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
                      102. void
                           ^
                      103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                      104. {

libtiff/tif_swab.c:110:3: Assignment
                      108. 	/* XXX unroll loop some */
                      109. 	while (n-- > 0) {
                      110. 		cp = (unsigned char *)lp;
                             ^
                      111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                      112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `update_output_file` 
                      109. 	while (n-- > 0) {
                      110. 		cp = (unsigned char *)lp;
                      111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                                 ^
                      112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                      113. 		lp++;
