libtiff/tif_dirinfo.c:857: error: Buffer Overrun S2
  Offset: `tif->tif_nfieldscompat` Size: [0, +oo].

libtiff/tif_dirinfo.c:831:1: <Offset trace>
829. }
830. 
831. int
     ^
832. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
833. {

libtiff/tif_dirinfo.c:831:1: Parameter `tif->tif_nfieldscompat`
829. }
830. 
831. int
     ^
832. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
833. {

libtiff/tif_dirinfo.c:855:2: Assignment
853. 		return -1;
854. 	}
855. 	nfields = tif->tif_nfieldscompat++;
      ^
856. 
857. 	tif->tif_fieldscompat[nfields].type = tfiatOther;

libtiff/tif_dirinfo.c:831:1: <Length trace>
829. }
830. 
831. int
     ^
832. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
833. {

libtiff/tif_dirinfo.c:831:1: Parameter `*tif->tif_fieldscompat`
829. }
830. 
831. int
     ^
832. TIFFMergeFieldInfo(TIFF* tif, const TIFFFieldInfo info[], uint32 n)
833. {

libtiff/tif_dirinfo.c:842:4: Call
840. 	if (tif->tif_nfieldscompat > 0) {
841. 		tif->tif_fieldscompat = (TIFFFieldArray *)
842. 			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
        ^
843. 					  tif->tif_nfieldscompat + 1,
844. 					  sizeof(TIFFFieldArray), reason);

libtiff/tif_aux.c:40:2: Assignment
  38. 		  tmsize_t nmemb, tmsize_t elem_size, const char* what)
  39. {
  40. 	void* cp = NULL;
       ^
  41. 	tmsize_t bytes = nmemb * elem_size;
  42. 

libtiff/tif_aux.c:55:2: Assignment
  53. 			     what,(long) nmemb, (long) elem_size);
  54. 
  55. 	return cp;
       ^
  56. }
  57. 

libtiff/tif_dirinfo.c:841:3: Assignment
839. 
840. 	if (tif->tif_nfieldscompat > 0) {
841. 		tif->tif_fieldscompat = (TIFFFieldArray *)
       ^
842. 			_TIFFCheckRealloc(tif, tif->tif_fieldscompat,
843. 					  tif->tif_nfieldscompat + 1,

libtiff/tif_dirinfo.c:857:2: Array access: Offset: tif->tif_nfieldscompat Size: [0, +oo]
855. 	nfields = tif->tif_nfieldscompat++;
856. 
857. 	tif->tif_fieldscompat[nfields].type = tfiatOther;
      ^
858. 	tif->tif_fieldscompat[nfields].allocated_size = n;
859. 	tif->tif_fieldscompat[nfields].count = n;
