tools/tiffcrop.c:7311: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose`.

tools/tiffcrop.c:7049:1: Parameter `out->tif_dir.td_samplesperpixel`
7047.  * original code assumes we are always copying all samples.
7048.  */
7049. static int  
      ^
7050. writeSingleSection(TIFF *in, TIFF *out, struct image_data *image,
7051.                    struct dump_opts *dump, uint32 width, uint32 length,

tools/tiffcrop.c:7304:7: Call
7302.     {
7303.     if (config == PLANARCONFIG_CONTIG)
7304.       writeBufferToContigStrips (out, sect_buff, length);
            ^
7305.     else
7306.       writeBufferToSeparateStrips(out, sect_buff, length, width, spp, dump);

tools/tiffcrop.c:1117:1: Parameter `out->tif_dir.td_samplesperpixel`
  1115.   }
  1116. 
  1117. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
        ^
  1118.   {
  1119.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1123:3: Call
  1121.   tsize_t stripsize;
  1122. 
  1123.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
          ^
  1124.   for (row = 0; row < imagelength; row += rowsperstrip)
  1125.     {

libtiff/tif_aux.c:307:1: Parameter `tif->tif_dir.td_samplesperpixel`
    305.  * value if the tag is not present in the directory.
    306.  */
    307. int
         ^
    308. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
    309. {

libtiff/tif_aux.c:314:8: Call
    312. 
    313. 	va_start(ap, tag);
    314. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                ^
    315. 	va_end(ap);
    316. 	return (ok);

libtiff/tif_aux.c:171:1: Parameter `tif->tif_dir.td_extrasamples`
      169.  *	place in the library -- in TIFFDefaultDirectory.
      170.  */
      171. int
           ^
      172. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
      173. {

tools/tiffcrop.c:7309:8: Call
7307.     }
7308. 
7309.   if (!TIFFWriteDirectory(out))
             ^
7310.     {
7311.     TIFFClose(out);

libtiff/tif_dirwrite.c:179:1: Parameter `tif->tif_dir.td_samplesperpixel`
  177.  * storage that's been changed.
  178.  */
  179. int
       ^
  180. TIFFWriteDirectory(TIFF* tif)
  181. {

libtiff/tif_dirwrite.c:182:9: Call
  180. TIFFWriteDirectory(TIFF* tif)
  181. {
  182. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  183. }
  184. 

libtiff/tif_dirwrite.c:361:1: Parameter `tif->tif_dir.td_samplesperpixel`
    359. }
    360. 
    361. static int
         ^
    362. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    363. {

tools/tiffcrop.c:7311:5: Call
7309.   if (!TIFFWriteDirectory(out))
7310.     {
7311.     TIFFClose(out);
          ^
7312.     return (-1);
7313.     }

libtiff/tif_close.c:120:1: Parameter `tif->tif_dir.td_samplesperpixel`
  118.  */
  119. 
  120. void
       ^
  121. TIFFClose(TIFF* tif)
  122. {

libtiff/tif_close.c:126:2: Call
  124. 	thandle_t fd = tif->tif_clientdata;
  125. 
  126. 	TIFFCleanup(tif);
        ^
  127. 	(void) (*closeproc)(fd);
  128. }

libtiff/tif_close.c:44:1: Parameter `tif->tif_dir.td_samplesperpixel`
    42.  */
    43. 
    44. void
        ^
    45. TIFFCleanup(TIFF* tif)
    46. {

libtiff/tif_close.c:51:3: Call
    49.          */
    50. 	if (tif->tif_mode != O_RDONLY)
    51. 		TIFFFlush(tif);
          ^
    52. 	(*tif->tif_cleanup)(tif);
    53. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_samplesperpixel`
      28. #include "tiffiop.h"
      29. 
      30. int
          ^
      31. TIFFFlush(TIFF* tif)
      32. {

libtiff/tif_flush.c:81:13: Call
      79. 
      80.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      81.         && !TIFFRewriteDirectory(tif))
                      ^
      82.         return (0);
      83. 

libtiff/tif_dirwrite.c:215:1: Parameter `tif->tif_dir.td_samplesperpixel`
        213.  * previously used directory space. 
        214.  */ 
        215. int
             ^
        216. TIFFRewriteDirectory( TIFF *tif )
        217. {

libtiff/tif_dirwrite.c:222:10: Call
        220. 	/* We don't need to do anything special if it hasn't been written. */
        221. 	if( tif->tif_diroff == 0 )
        222. 		return TIFFWriteDirectory( tif );
                      ^
        223. 
        224. 	/*

libtiff/tif_dirwrite.c:179:1: Parameter `tif->tif_dir.td_samplesperpixel`
          177.  * storage that's been changed.
          178.  */
          179. int
               ^
          180. TIFFWriteDirectory(TIFF* tif)
          181. {

libtiff/tif_dirwrite.c:182:9: Call
          180. TIFFWriteDirectory(TIFF* tif)
          181. {
          182. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          183. }
          184. 

libtiff/tif_dirwrite.c:361:1: Parameter `tif->tif_dir.td_samplesperpixel`
            359. }
            360. 
            361. static int
                 ^
            362. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            363. {

libtiff/tif_dirwrite.c:588:10: Call
            586. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
            587. 			{
            588. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                          ^
            589. 					goto bad;
            590. 			}

libtiff/tif_dirwrite.c:1009:1: Parameter `count`
              1007. }
              1008. 
              1009. static int
                    ^
              1010. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
              1011. {

libtiff/tif_dirwrite.c:1016:9: Call
              1014. 	uint32 i;
              1015. 	int ok;
              1016. 	conv = _TIFFmalloc(count*sizeof(double));
                            ^
              1017. 	if (conv == NULL)
              1018. 	{

libtiff/tif_unix.c:312:17: Assignment
                310. {
                311.         if (s == 0)
                312.                 return ((void *) NULL);
                                     ^
                313. 
                314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1016:2: Assignment
              1014. 	uint32 i;
              1015. 	int ok;
              1016. 	conv = _TIFFmalloc(count*sizeof(double));
                     ^
              1017. 	if (conv == NULL)
              1018. 	{

libtiff/tif_dirwrite.c:1054:10: Call
              1052. 				for (i = 0; i < count; ++i)
              1053. 					((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
              1054. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                             ^
              1055. 			}
              1056. 			break;

libtiff/tif_dirwrite.c:1405:1: Parameter `*value`
                1403. #endif
                1404. 
                1405. static int
                      ^
                1406. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                1407. {

libtiff/tif_dirwrite.c:1413:9: Call
                1411. 		return(1);
                1412. 	}
                1413. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                              ^
                1414. }
                1415. 

libtiff/tif_dirwrite.c:2108:1: Parameter `*value`
                  2106. #endif
                  2107. 
                  2108. static int
                        ^
                  2109. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                  2110. {

libtiff/tif_dirwrite.c:2114:3: Call
                  2112. 	assert(sizeof(int32)==4);
                  2113. 	if (tif->tif_flags&TIFF_SWAB)
                  2114. 		TIFFSwabArrayOfLong((uint32*)value,count);
                          ^
                  2115. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
                  2116. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
                    100. 
                    101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
                    102. void
                         ^
                    103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                    104. {

libtiff/tif_swab.c:110:3: Assignment
                    108. 	/* XXX unroll loop some */
                    109. 	while (n-- > 0) {
                    110. 		cp = (unsigned char *)lp;
                           ^
                    111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                    112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFClose` 
                    109. 	while (n-- > 0) {
                    110. 		cp = (unsigned char *)lp;
                    111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                               ^
                    112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                    113. 		lp++;
