libtiff/tif_open.c:499: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFCleanup`.

libtiff/tif_open.c:499:9: Call
497. bad:
498. 	tif->tif_mode = O_RDONLY;	/* XXX avoid flush */
499.         TIFFCleanup(tif);
             ^
500. bad2:
501. 	return ((TIFF*)0);

libtiff/tif_close.c:44:1: Parameter `tif->tif_dir.td_nstrips`
  42.  */
  43. 
  44. void
      ^
  45. TIFFCleanup(TIFF* tif)
  46. {

libtiff/tif_close.c:51:3: Call
  49.          */
  50. 	if (tif->tif_mode != O_RDONLY)
  51. 		TIFFFlush(tif);
        ^
  52. 	(*tif->tif_cleanup)(tif);
  53. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_nstrips`
    28. #include "tiffiop.h"
    29. 
    30. int
        ^
    31. TIFFFlush(TIFF* tif)
    32. {

libtiff/tif_flush.c:36:10: Call
    34.         return 1;
    35. 
    36.     if (!TIFFFlushData(tif))
                 ^
    37.         return (0);
    38.                 

libtiff/tif_flush.c:96:1: Parameter `tif->tif_dir.td_nstrips`
      94.  * problems for other people. 
      95.  */
      96. int
          ^
      97. TIFFFlushData(TIFF* tif)
      98. {

libtiff/tif_flush.c:81:13: Call
    79. 
    80.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
    81.         && !TIFFRewriteDirectory(tif))
                    ^
    82.         return (0);
    83. 

libtiff/tif_dirwrite.c:214:1: Parameter `tif->tif_dir.td_nstrips`
      212.  * previously used directory space. 
      213.  */ 
      214. int
           ^
      215. TIFFRewriteDirectory( TIFF *tif )
      216. {

libtiff/tif_dirwrite.c:221:10: Call
      219. 	/* We don't need to do anything special if it hasn't been written. */
      220. 	if( tif->tif_diroff == 0 )
      221. 		return TIFFWriteDirectory( tif );
                    ^
      222. 
      223. 	/*

libtiff/tif_dirwrite.c:178:1: Parameter `tif->tif_dir.td_nstrips`
        176.  * storage that's been changed.
        177.  */
        178. int
             ^
        179. TIFFWriteDirectory(TIFF* tif)
        180. {

libtiff/tif_dirwrite.c:181:9: Call
        179. TIFFWriteDirectory(TIFF* tif)
        180. {
        181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                     ^
        182. }
        183. 

libtiff/tif_dirwrite.c:360:1: Parameter `tif->tif_dir.td_nstrips`
          358. }
          359. 
          360. static int
               ^
          361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
          362. {

libtiff/tif_dirwrite.c:530:11: Call
          528. 				if (!isTiled(tif))
          529. 				{
          530. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))
                         ^
          531. 						goto bad;
          532. 				}

libtiff/tif_dirwrite.c:1694:1: Parameter `count`
            1692. /************************************************************************/
            1693. 
            1694. static int
                  ^
            1695. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
            1696. {

libtiff/tif_dirwrite.c:1747:21: Call
            1745.         */
            1746. 
            1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                                      ^
            1748.         uint32* q;
            1749.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
              310. {
              311.         if (s == 0)
              312.                 return ((void *) NULL);
                                   ^
              313. 
              314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1747:9: Assignment
            1745.         */
            1746. 
            1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                          ^
            1748.         uint32* q;
            1749.         uint64* ma;

libtiff/tif_dirwrite.c:1770:11: Call
            1768.         }
            1769. 
            1770.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                            ^
            1771.         _TIFFfree(p);
            1772.     }

libtiff/tif_dirwrite.c:2173:1: Parameter `*value`
              2171. }
              2172. 
              2173. static int
                    ^
              2174. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
              2175. {

libtiff/tif_dirwrite.c:2179:3: Call
              2177. 	assert(sizeof(uint32)==4);
              2178. 	if (tif->tif_flags&TIFF_SWAB)
              2179. 		TIFFSwabArrayOfLong(value,count);
                      ^
              2180. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
              2181. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
                100. 
                101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
                102. void
                     ^
                103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                104. {

libtiff/tif_swab.c:110:3: Assignment
                108. 	/* XXX unroll loop some */
                109. 	while (n-- > 0) {
                110. 		cp = (unsigned char *)lp;
                       ^
                111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFCleanup` 
                109. 	while (n-- > 0) {
                110. 		cp = (unsigned char *)lp;
                111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                           ^
                112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                113. 		lp++;
