tools/tiffsplit.c:90: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory`.

tools/tiffsplit.c:87:9: Call
85. 			if (out == NULL)
86. 				return (-2);
87. 			if (!tiffcp(in, out))
            ^
88. 				return (-1);
89. 			TIFFClose(out);

tools/tiffsplit.c:155:1: Parameter `in->tif_dir.td_stripoffset_p`
  153. }
  154. 
  155. static int
       ^
  156. tiffcp(TIFF* in, TIFF* out)
  157. {

tools/tiffsplit.c:223:11: Call
  221. 	CopyField(TIFFTAG_FAXDCS, stringv);
  222. 	if (TIFFIsTiled(in))
  223. 		return (cpTiles(in, out));
                 ^
  224. 	else
  225. 		return (cpStrips(in, out));

tools/tiffsplit.c:262:1: Parameter `in->tif_dir.td_stripoffset_p`
    260. }
    261. 
    262. static int
         ^
    263. cpTiles(TIFF* in, TIFF* out)
    264. {

tools/tiffsplit.c:90:12: Call
88. 				return (-1);
89. 			TIFFClose(out);
90. 		} while (TIFFReadDirectory(in));
               ^
91. 		(void) TIFFClose(in);
92. 	}

libtiff/tif_dirread.c:3920:42: Call
  3918.                                         goto bad;
  3919.                                     }
  3920.                                     if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset_p))  
                                                 ^
  3921.                                             goto bad;
  3922.                                 }

libtiff/tif_dirread.c:5621:1: Parameter `**lpp`
    5619.  * While this routine says "strips", in fact it's also used for tiles.
    5620.  */
    5621. static int
          ^
    5622. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
    5623. {

libtiff/tif_dirread.c:4269:13: Call
  4267.             TIFFStripSize64(tif) > 0x7FFFFFFFUL )
  4268.         {
  4269.             TryChopUpUncompressedBigTiff(tif);
                    ^
  4270.         }
  4271. 

libtiff/tif_dirread.c:5900:10: Assignment
    5898. 
    5899.     /* Check that the strips are contiguous and of the expected size */
    5900.     for( i = 0; i < td->td_nstrips; i++ )
                   ^
    5901.     {
    5902.         if( i == td->td_nstrips - 1 )

libtiff/tif_dirread.c:5916:26: Call
    5914.                 return;
    5915.             }
    5916.             if( i > 0 && TIFFGetStrileOffset(tif, i) !=
                                   ^
    5917.                     TIFFGetStrileOffset(tif, i-1) + TIFFGetStrileByteCount(tif, i-1) )
    5918.             {

libtiff/tif_dirread.c:6233:1: Parameter `strile`
      6231. 
      6232. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
      6233. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
            ^
      6234. {
      6235.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6235:12: Call
      6233. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
      6234. {
      6235.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
                       ^
      6236. }
      6237. 

libtiff/tif_dirread.c:6239:1: Parameter `strile`
        6237. 
        6238. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
        6239. uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)
              ^
        6240. {
        6241.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6242:12: Call
        6240. {
        6241.     TIFFDirectory *td = &tif->tif_dir;
        6242.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                         ^
        6243.                                &(td->td_stripoffset_entry),
        6244.                                &(td->td_stripoffset_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `strile`
          6189. }
          6190. 
          6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                ^
          6192.                                                    TIFFDirEntry* dirent,
          6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6215:19: Call
          6213.         else
          6214.         {
          6215.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                  ^
          6216.              {
          6217.                 if( pbErr )

libtiff/tif_dirread.c:6088:1: <Offset trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `strile`
            6086. }
            6087. 
            6088. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6089.                                  uint32 strile,
            6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: <Length trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `**parray`
            6086. }
            6087. 
            6088. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6089.                                  uint32 strile,
            6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6179:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory` 
            6177.         return 0;
            6178. 
            6179.     if( ~((*parray)[strile]) == 0 )
                           ^
            6180.     {
            6181.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
