libtiff/tif_dirwrite.c:819: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalDoubleArray`.

libtiff/tif_dirwrite.c:770:25: Assignment
768. 		{
769.                         uint16 tag = (uint16)tif->tif_dir.td_customValues[m].info->field_tag;
770.                         uint32 count = tif->tif_dir.td_customValues[m].count;
                             ^
771. 			switch (tif->tif_dir.td_customValues[m].info->field_type)
772. 			{

libtiff/tif_dirwrite.c:819:13: Call
817. 						tv_size = _TIFFSetGetFieldSize(tif->tif_dir.td_customValues[m].info->set_field_type);
818. 						if (tv_size == 8) {
819. 							if (!TIFFWriteDirectoryTagRationalDoubleArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))
                 ^
820. 								goto bad;
821. 						} else {

libtiff/tif_dirwrite.c:1609:1: Parameter `count`
  1607. 
  1608. /*-- Rational2Double: additional write functions */
  1609. static int
        ^
  1610. TIFFWriteDirectoryTagRationalDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
  1611. {

libtiff/tif_dirwrite.c:1617:9: Call
  1615. 		return(1);
  1616. 	}
  1617. 	return(TIFFWriteDirectoryTagCheckedRationalDoubleArray(tif,ndir,dir,tag,count,value));
                ^
  1618. }
  1619. 

libtiff/tif_dirwrite.c:2560:1: Parameter `count`
    2558. 
    2559. /*-- Rational2Double: additional write functions for double arrays */
    2560. static int
          ^
    2561. TIFFWriteDirectoryTagCheckedRationalDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
    2562. {

libtiff/tif_dirwrite.c:2570:4: Call
    2568. 	int o;
    2569. 	assert(sizeof(uint32)==4);
    2570. 	m=_TIFFmalloc(count*2*sizeof(uint32));
             ^
    2571. 	if (m==NULL)
    2572. 	{

libtiff/tif_unix.c:312:17: Assignment
      310. {
      311.         if (s == 0)
      312.                 return ((void *) NULL);
                           ^
      313. 
      314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:2570:2: Assignment
    2568. 	int o;
    2569. 	assert(sizeof(uint32)==4);
    2570. 	m=_TIFFmalloc(count*2*sizeof(uint32));
           ^
    2571. 	if (m==NULL)
    2572. 	{

libtiff/tif_dirwrite.c:2576:17: Assignment
    2574. 		return(0);
    2575. 	}
    2576. 	for (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)
                          ^
    2577. 	{
    2578. 		DoubleToRational(*na, &nb[0], &nb[1]);

libtiff/tif_dirwrite.c:2578:3: Call
    2576. 	for (na=value, nb=m, nc=0; nc<count; na++, nb+=2, nc++)
    2577. 	{
    2578. 		DoubleToRational(*na, &nb[0], &nb[1]);
            ^
    2579. 	}
    2580. 	if (tif->tif_flags&TIFF_SWAB)

libtiff/tif_dirwrite.c:2821:1: <Length trace>
2819. * using the Euclidean algorithm to find the greatest common divisor (GCD)
2820. ------------------------------------------------------------------------*/
2821. static
      ^
2822. void DoubleToRational(double value, uint32 *num, uint32 *denom)
2823. {

libtiff/tif_dirwrite.c:2821:1: Parameter `*denom`
      2819. * using the Euclidean algorithm to find the greatest common divisor (GCD)
      2820. ------------------------------------------------------------------------*/
      2821. static
            ^
      2822. void DoubleToRational(double value, uint32 *num, uint32 *denom)
      2823. {

libtiff/tif_dirwrite.c:2844:3: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalDoubleArray` 
      2842. 	if (value == (uint32)(value)) {
      2843. 		*num = (uint32)value;
      2844. 		*denom = 1;
              ^
      2845. 		return;
      2846. 	}
