contrib/addtiffo/tif_ovrcache.c:255: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFFlush`.

contrib/addtiffo/tif_ovrcache.c:192:6: Call
190. 					    iTileY * psCache->nBlockYSize,
191. 					    0, (tsample_t) iSample );
192. 					TIFFWriteEncodedTile( psCache->hTIFF, nTileID,
          ^
193. 					    pabyData,
194. 					    TIFFTileSize(psCache->hTIFF) );

libtiff/tif_write.c:390:1: Parameter `tile`
  388.  *     the image on each write (as TIFFWriteScanline does).
  389.  */
  390. tmsize_t
       ^
  391. TIFFWriteEncodedTile(TIFF* tif, uint32 tile, void* data, tmsize_t cc)
  392. {

contrib/addtiffo/tif_ovrcache.c:255:5: Call
253. /*      Restore access to original directory.                           */
254. /* -------------------------------------------------------------------- */
255.     TIFFFlush( psCache->hTIFF );
         ^
256.     /* TODO: add checks on error status return of TIFFFlush */
257.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_nstrips`
  28. #include "tiffiop.h"
  29. 
  30. int
      ^
  31. TIFFFlush(TIFF* tif)
  32. {

libtiff/tif_flush.c:36:10: Call
  34.         return 1;
  35. 
  36.     if (!TIFFFlushData(tif))
               ^
  37.         return (0);
  38.                 

libtiff/tif_flush.c:96:1: Parameter `tif->tif_dir.td_nstrips`
    94.  * problems for other people. 
    95.  */
    96. int
        ^
    97. TIFFFlushData(TIFF* tif)
    98. {

libtiff/tif_flush.c:81:13: Call
  79. 
  80.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
  81.         && !TIFFRewriteDirectory(tif))
                  ^
  82.         return (0);
  83. 

libtiff/tif_dirwrite.c:214:1: Parameter `tif->tif_dir.td_nstrips`
    212.  * previously used directory space. 
    213.  */ 
    214. int
         ^
    215. TIFFRewriteDirectory( TIFF *tif )
    216. {

libtiff/tif_dirwrite.c:221:10: Call
    219. 	/* We don't need to do anything special if it hasn't been written. */
    220. 	if( tif->tif_diroff == 0 )
    221. 		return TIFFWriteDirectory( tif );
                  ^
    222. 
    223. 	/*

libtiff/tif_dirwrite.c:178:1: Parameter `tif->tif_dir.td_nstrips`
      176.  * storage that's been changed.
      177.  */
      178. int
           ^
      179. TIFFWriteDirectory(TIFF* tif)
      180. {

libtiff/tif_dirwrite.c:181:9: Call
      179. TIFFWriteDirectory(TIFF* tif)
      180. {
      181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                   ^
      182. }
      183. 

libtiff/tif_dirwrite.c:360:1: Parameter `tif->tif_dir.td_nstrips`
        358. }
        359. 
        360. static int
             ^
        361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
        362. {

libtiff/tif_dirwrite.c:530:11: Call
        528. 				if (!isTiled(tif))
        529. 				{
        530. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))
                       ^
        531. 						goto bad;
        532. 				}

libtiff/tif_dirwrite.c:1694:1: Parameter `count`
          1692. /************************************************************************/
          1693. 
          1694. static int
                ^
          1695. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
          1696. {

libtiff/tif_dirwrite.c:1747:21: Call
          1745.         */
          1746. 
          1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                                    ^
          1748.         uint32* q;
          1749.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
            310. {
            311.         if (s == 0)
            312.                 return ((void *) NULL);
                                 ^
            313. 
            314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1747:9: Assignment
          1745.         */
          1746. 
          1747.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                        ^
          1748.         uint32* q;
          1749.         uint64* ma;

libtiff/tif_dirwrite.c:1770:11: Call
          1768.         }
          1769. 
          1770.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                          ^
          1771.         _TIFFfree(p);
          1772.     }

libtiff/tif_dirwrite.c:2173:1: Parameter `*value`
            2171. }
            2172. 
            2173. static int
                  ^
            2174. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
            2175. {

libtiff/tif_dirwrite.c:2179:3: Call
            2177. 	assert(sizeof(uint32)==4);
            2178. 	if (tif->tif_flags&TIFF_SWAB)
            2179. 		TIFFSwabArrayOfLong(value,count);
                    ^
            2180. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
            2181. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
              100. 
              101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
              102. void
                   ^
              103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
              104. {

libtiff/tif_swab.c:110:3: Assignment
              108. 	/* XXX unroll loop some */
              109. 	while (n-- > 0) {
              110. 		cp = (unsigned char *)lp;
                     ^
              111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
              112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFFlush` 
              109. 	while (n-- > 0) {
              110. 		cp = (unsigned char *)lp;
              111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                         ^
              112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
              113. 		lp++;
