tools/tiff2pdf.c:5248: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `t2p_write_advance_directory`.

tools/tiff2pdf.c:5128:1: Parameter `output->tif_dir.td_samplesperpixel`
5126. */
5127. 
5128. tsize_t t2p_write_pdf(T2P* t2p, TIFF* input, TIFF* output){
      ^
5129. 
5130. 	tsize_t written=0;

tools/tiff2pdf.c:5247:16: Call
5245. 				streamlen=written;
5246. 				t2p_read_tiff_size_tile(t2p, input, i2);
5247. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
                     ^
5248. 				t2p_write_advance_directory(t2p, output);
5249. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2567:1: Parameter `output->tif_dir.td_samplesperpixel`
  2565.  */
  2566. 
  2567. tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){
        ^
  2568. 
  2569. 	uint16 edge=0;

tools/tiff2pdf.c:5248:5: Call
5246. 				t2p_read_tiff_size_tile(t2p, input, i2);
5247. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
5248. 				t2p_write_advance_directory(t2p, output);
          ^
5249. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}
5250. 				streamlen=written-streamlen;

tools/tiff2pdf.c:3372:1: Parameter `output->tif_dir.td_samplesperpixel`
  3370.  */
  3371. 
  3372. void
        ^
  3373. t2p_write_advance_directory(T2P* t2p, TIFF* output)
  3374. {

tools/tiff2pdf.c:3376:6: Call
  3374. {
  3375. 	t2p_disable(output);
  3376. 	if(!TIFFWriteDirectory(output)){
             ^
  3377. 		TIFFError(TIFF2PDF_MODULE, 
  3378. 			"Error writing virtual directory to output PDF %s", 

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
    161.  * storage that's been changed.
    162.  */
    163. int
         ^
    164. TIFFWriteDirectory(TIFF* tif)
    165. {

libtiff/tif_dirwrite.c:166:9: Call
    164. TIFFWriteDirectory(TIFF* tif)
    165. {
    166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    167. }
    168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
      343. }
      344. 
      345. static int
           ^
      346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      347. {

libtiff/tif_dirwrite.c:557:10: Call
      555. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
      556. 			{
      557. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                    ^
      558. 					goto bad;
      559. 			}

libtiff/tif_dirwrite.c:903:1: Parameter `tif->tif_dir.td_samplesperpixel`
        901. }
        902. 
        903. static int
             ^
        904. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
        905. {

libtiff/tif_dirwrite.c:912:12: Call
        910. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
        911. 			else
        912. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                        ^
        913. 		case SAMPLEFORMAT_INT:
        914. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1400:1: Parameter `tif->tif_dir.td_samplesperpixel`
          1398. }
          1399. 
          1400. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                ^
          1401. {
          1402. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1412:4: Call
          1410. 		return(1);
          1411. 	}
          1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                   ^
          1413. 	if (m==NULL)
          1414. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
            251. #endif
            252. 
            253. void*
                 ^
            254. _TIFFmalloc(tmsize_t s)
            255. {

libtiff/tif_unix.c:256:10: Array declaration
            254. _TIFFmalloc(tmsize_t s)
            255. {
            256. 	return (malloc((size_t) s));
                          ^
            257. }
            258. 

libtiff/tif_unix.c:256:2: Assignment
            254. _TIFFmalloc(tmsize_t s)
            255. {
            256. 	return (malloc((size_t) s));
                  ^
            257. }
            258. 

libtiff/tif_dirwrite.c:1412:2: Assignment
          1410. 		return(1);
          1411. 	}
          1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                 ^
          1413. 	if (m==NULL)
          1414. 	{

libtiff/tif_dirwrite.c:1420:4: Call
          1418. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
          1419. 		*na=value;
          1420. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                   ^
          1421. 	_TIFFfree(m);
          1422. 	return(o);

libtiff/tif_dirwrite.c:2144:1: Parameter `*value`
            2142. #endif
            2143. 
            2144. static int
                  ^
            2145. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
            2146. {

libtiff/tif_dirwrite.c:2151:3: Call
            2149. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
            2150. 	if (tif->tif_flags&TIFF_SWAB)
            2151. 		TIFFSwabArrayOfDouble(value,count);
                    ^
            2152. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
            2153. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
              181. 
              182. #ifndef TIFFSwabArrayOfDouble
              183. void
                   ^
              184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
              185. {

libtiff/tif_swab.c:191:3: Assignment
              189. 	/* XXX unroll loop some */
              190. 	while (n-- > 0) {
              191. 		cp = (unsigned char *)dp;
                     ^
              192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
              193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `t2p_write_advance_directory` 
              190. 	while (n-- > 0) {
              191. 		cp = (unsigned char *)dp;
              192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                         ^
              193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
              194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
