tools/tiffcrop.c:7153: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose`.

tools/tiffcrop.c:6892:1: Parameter `out->tif_dir.td_samplesperpixel`
6890.  * original code assumes we are always copying all samples.
6891.  */
6892. static int  
      ^
6893. writeSingleSection(TIFF *in, TIFF *out, struct image_data *image,
6894.                    struct dump_opts *dump, uint32 width, uint32 length,

tools/tiffcrop.c:7146:7: Call
7144.     {
7145.     if (config == PLANARCONFIG_CONTIG)
7146.       writeBufferToContigStrips (out, sect_buff, length);
            ^
7147.     else
7148.       writeBufferToSeparateStrips(out, sect_buff, length, width, spp, dump);

tools/tiffcrop.c:1098:1: Parameter `out->tif_dir.td_samplesperpixel`
  1096.   }
  1097. 
  1098. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
        ^
  1099.   {
  1100.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1104:3: Call
  1102.   tsize_t stripsize;
  1103. 
  1104.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
          ^
  1105.   for (row = 0; row < imagelength; row += rowsperstrip)
  1106.     {

libtiff/tif_aux.c:298:1: Parameter `tif->tif_dir.td_samplesperpixel`
    296.  * value if the tag is not present in the directory.
    297.  */
    298. int
         ^
    299. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
    300. {

libtiff/tif_aux.c:305:8: Call
    303. 
    304. 	va_start(ap, tag);
    305. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                ^
    306. 	va_end(ap);
    307. 	return (ok);

libtiff/tif_aux.c:169:1: Parameter `tif->tif_dir.td_extrasamples`
      167.  *	place in the library -- in TIFFDefaultDirectory.
      168.  */
      169. int
           ^
      170. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
      171. {

tools/tiffcrop.c:7151:8: Call
7149.     }
7150. 
7151.   if (!TIFFWriteDirectory(out))
             ^
7152.     {
7153.     TIFFClose(out);

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_samplesperpixel`
  178.  * storage that's been changed.
  179.  */
  180. int
       ^
  181. TIFFWriteDirectory(TIFF* tif)
  182. {

libtiff/tif_dirwrite.c:183:9: Call
  181. TIFFWriteDirectory(TIFF* tif)
  182. {
  183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  184. }
  185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_samplesperpixel`
    360. }
    361. 
    362. static int
         ^
    363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    364. {

tools/tiffcrop.c:7153:5: Call
7151.   if (!TIFFWriteDirectory(out))
7152.     {
7153.     TIFFClose(out);
          ^
7154.     return (-1);
7155.     }

libtiff/tif_close.c:122:1: Parameter `tif->tif_dir.td_samplesperpixel`
  120.  */
  121. 
  122. void
       ^
  123. TIFFClose(TIFF* tif)
  124. {

libtiff/tif_close.c:128:2: Call
  126. 	thandle_t fd = tif->tif_clientdata;
  127. 
  128. 	TIFFCleanup(tif);
        ^
  129. 	(void) (*closeproc)(fd);
  130. }

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_samplesperpixel`
    44.  */
    45. 
    46. void
        ^
    47. TIFFCleanup(TIFF* tif)
    48. {

libtiff/tif_close.c:53:3: Call
    51.          */
    52. 	if (tif->tif_mode != O_RDONLY)
    53. 		TIFFFlush(tif);
          ^
    54. 	(*tif->tif_cleanup)(tif);
    55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_samplesperpixel`
      30. #include "tiffiop.h"
      31. 
      32. int
          ^
      33. TIFFFlush(TIFF* tif)
      34. {

libtiff/tif_flush.c:83:13: Call
      81. 
      82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      83.         && !TIFFRewriteDirectory(tif))
                      ^
      84.         return (0);
      85. 

libtiff/tif_dirwrite.c:216:1: Parameter `tif->tif_dir.td_samplesperpixel`
        214.  * previously used directory space. 
        215.  */ 
        216. int
             ^
        217. TIFFRewriteDirectory( TIFF *tif )
        218. {

libtiff/tif_dirwrite.c:223:10: Call
        221. 	/* We don't need to do anything special if it hasn't been written. */
        222. 	if( tif->tif_diroff == 0 )
        223. 		return TIFFWriteDirectory( tif );
                      ^
        224. 
        225. 	/*

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_samplesperpixel`
          178.  * storage that's been changed.
          179.  */
          180. int
               ^
          181. TIFFWriteDirectory(TIFF* tif)
          182. {

libtiff/tif_dirwrite.c:183:9: Call
          181. TIFFWriteDirectory(TIFF* tif)
          182. {
          183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          184. }
          185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_samplesperpixel`
            360. }
            361. 
            362. static int
                 ^
            363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            364. {

libtiff/tif_dirwrite.c:577:10: Call
            575. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
            576. 			{
            577. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                          ^
            578. 					goto bad;
            579. 			}

libtiff/tif_dirwrite.c:928:1: Parameter `count`
              926. }
              927. 
              928. static int
                   ^
              929. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
              930. {

libtiff/tif_dirwrite.c:935:9: Call
              933. 	uint32 i;
              934. 	int ok;
              935. 	conv = _TIFFmalloc(count*sizeof(double));
                           ^
              936. 	if (conv == NULL)
              937. 	{

libtiff/tif_unix.c:261:17: Assignment
                259. {
                260.         if (s == 0)
                261.                 return ((void *) NULL);
                                     ^
                262. 
                263. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:935:2: Assignment
              933. 	uint32 i;
              934. 	int ok;
              935. 	conv = _TIFFmalloc(count*sizeof(double));
                    ^
              936. 	if (conv == NULL)
              937. 	{

libtiff/tif_dirwrite.c:973:10: Call
              971. 				for (i = 0; i < count; ++i)
              972. 					((int32*)conv)[i] = (int32)value[i];
              973. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                            ^
              974. 			}
              975. 			break;

libtiff/tif_dirwrite.c:1324:1: Parameter `*value`
                1322. #endif
                1323. 
                1324. static int
                      ^
                1325. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                1326. {

libtiff/tif_dirwrite.c:1332:9: Call
                1330. 		return(1);
                1331. 	}
                1332. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                              ^
                1333. }
                1334. 

libtiff/tif_dirwrite.c:2020:1: Parameter `*value`
                  2018. #endif
                  2019. 
                  2020. static int
                        ^
                  2021. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                  2022. {

libtiff/tif_dirwrite.c:2026:3: Call
                  2024. 	assert(sizeof(int32)==4);
                  2025. 	if (tif->tif_flags&TIFF_SWAB)
                  2026. 		TIFFSwabArrayOfLong((uint32*)value,count);
                          ^
                  2027. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
                  2028. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
                    102. 
                    103. #ifndef TIFFSwabArrayOfLong
                    104. void
                         ^
                    105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                    106. {

libtiff/tif_swab.c:112:3: Assignment
                    110. 	/* XXX unroll loop some */
                    111. 	while (n-- > 0) {
                    112. 		cp = (unsigned char *)lp;
                           ^
                    113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                    114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose` 
                    111. 	while (n-- > 0) {
                    112. 		cp = (unsigned char *)lp;
                    113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                               ^
                    114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                    115. 		lp++;
