libtiff/tif_open.c:499: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFCleanup`.

libtiff/tif_open.c:499:9: Call
497. bad:
498. 	tif->tif_mode = O_RDONLY;	/* XXX avoid flush */
499.         TIFFCleanup(tif);
             ^
500. bad2:
501. 	return ((TIFF*)0);

libtiff/tif_close.c:44:1: Parameter `tif->tif_dir.td_samplesperpixel`
  42.  */
  43. 
  44. void
      ^
  45. TIFFCleanup(TIFF* tif)
  46. {

libtiff/tif_close.c:51:3: Call
  49.          */
  50. 	if (tif->tif_mode != O_RDONLY)
  51. 		TIFFFlush(tif);
        ^
  52. 	(*tif->tif_cleanup)(tif);
  53. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:30:1: Parameter `tif->tif_dir.td_samplesperpixel`
    28. #include "tiffiop.h"
    29. 
    30. int
        ^
    31. TIFFFlush(TIFF* tif)
    32. {

libtiff/tif_flush.c:53:13: Call
    51. 
    52.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
    53.         && !TIFFRewriteDirectory(tif))
                    ^
    54.         return (0);
    55. 

libtiff/tif_dirwrite.c:259:1: Parameter `tif->tif_dir.td_samplesperpixel`
      257.  * previously used directory space. 
      258.  */ 
      259. int
           ^
      260. TIFFRewriteDirectory( TIFF *tif )
      261. {

libtiff/tif_dirwrite.c:266:10: Call
      264. 	/* We don't need to do anything special if it hasn't been written. */
      265. 	if( tif->tif_diroff == 0 )
      266. 		return TIFFWriteDirectory( tif );
                    ^
      267. 
      268. 	/*

libtiff/tif_dirwrite.c:178:1: Parameter `tif->tif_dir.td_samplesperpixel`
        176.  * storage that's been changed.
        177.  */
        178. int
             ^
        179. TIFFWriteDirectory(TIFF* tif)
        180. {

libtiff/tif_dirwrite.c:181:9: Call
        179. TIFFWriteDirectory(TIFF* tif)
        180. {
        181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                     ^
        182. }
        183. 

libtiff/tif_dirwrite.c:405:1: Parameter `tif->tif_dir.td_samplesperpixel`
          403. }
          404. 
          405. static int
               ^
          406. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
          407. {

libtiff/tif_dirwrite.c:632:10: Call
          630. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
          631. 			{
          632. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                        ^
          633. 					goto bad;
          634. 			}

libtiff/tif_dirwrite.c:1047:1: Parameter `count`
            1045. }
            1046. 
            1047. static int
                  ^
            1048. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
            1049. {

libtiff/tif_dirwrite.c:1054:9: Call
            1052. 	uint32 i;
            1053. 	int ok;
            1054. 	conv = _TIFFmalloc(count*sizeof(double));
                          ^
            1055. 	if (conv == NULL)
            1056. 	{

libtiff/tif_unix.c:312:17: Assignment
              310. {
              311.         if (s == 0)
              312.                 return ((void *) NULL);
                                   ^
              313. 
              314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1054:2: Assignment
            1052. 	uint32 i;
            1053. 	int ok;
            1054. 	conv = _TIFFmalloc(count*sizeof(double));
                   ^
            1055. 	if (conv == NULL)
            1056. 	{

libtiff/tif_dirwrite.c:1092:10: Call
            1090. 				for (i = 0; i < count; ++i)
            1091. 					((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
            1092. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                           ^
            1093. 			}
            1094. 			break;

libtiff/tif_dirwrite.c:1443:1: Parameter `*value`
              1441. #endif
              1442. 
              1443. static int
                    ^
              1444. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
              1445. {

libtiff/tif_dirwrite.c:1451:9: Call
              1449. 		return(1);
              1450. 	}
              1451. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                            ^
              1452. }
              1453. 

libtiff/tif_dirwrite.c:2246:1: Parameter `*value`
                2244. #endif
                2245. 
                2246. static int
                      ^
                2247. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
                2248. {

libtiff/tif_dirwrite.c:2252:3: Call
                2250. 	assert(sizeof(int32)==4);
                2251. 	if (tif->tif_flags&TIFF_SWAB)
                2252. 		TIFFSwabArrayOfLong((uint32*)value,count);
                        ^
                2253. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
                2254. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
                  100. 
                  101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
                  102. void
                       ^
                  103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                  104. {

libtiff/tif_swab.c:110:3: Assignment
                  108. 	/* XXX unroll loop some */
                  109. 	while (n-- > 0) {
                  110. 		cp = (unsigned char *)lp;
                         ^
                  111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                  112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFCleanup` 
                  109. 	while (n-- > 0) {
                  110. 		cp = (unsigned char *)lp;
                  111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                             ^
                  112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                  113. 		lp++;
