contrib/addtiffo/tif_overview.c:162: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:149:9: Call
147. /*      Write directory, and return byte offset.                        */
148. /* -------------------------------------------------------------------- */
149.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
150.         return 0;
151. 

libtiff/tif_write.c:564:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
  562.  * that important information is not changed.
  563.  */
  564. int
       ^
  565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  566. {

contrib/addtiffo/tif_overview.c:152:5: Call
150.         return 0;
151. 
152.     TIFFWriteDirectory( hTIFF );
         ^
153.     iNumDir = TIFFNumberOfDirectories(hTIFF);
154.     if( iNumDir > TIFF_DIR_MAX )

libtiff/tif_dirwrite.c:178:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
  176.  * storage that's been changed.
  177.  */
  178. int
       ^
  179. TIFFWriteDirectory(TIFF* tif)
  180. {

libtiff/tif_dirwrite.c:181:9: Call
  179. TIFFWriteDirectory(TIFF* tif)
  180. {
  181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  182. }
  183. 

libtiff/tif_dirwrite.c:405:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
    403. }
    404. 
    405. static int
         ^
    406. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    407. {

contrib/addtiffo/tif_overview.c:162:5: Call
160.         exit(-1);
161.     }
162.     TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) );
         ^
163. 
164.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1615:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
  1613.  * NB: Directories are numbered starting at 0.
  1614.  */
  1615. int
        ^
  1616. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1617. {

libtiff/tif_dir.c:1640:10: Call
  1638. 	 */
  1639. 	tif->tif_dirnumber = 0;
  1640. 	return (TIFFReadDirectory(tif));
                 ^
  1641. }
  1642. 

libtiff/tif_dirread.c:3578:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
    3576.  * format. We read directories sequentially.
    3577.  */
    3578. int
          ^
    3579. TIFFReadDirectory(TIFF* tif)
    3580. {

libtiff/tif_dirread.c:3631:2: Call
    3629. 
    3630. 	/* free any old stuff and reinit */
    3631. 	TIFFFreeDirectory(tif);
           ^
    3632. 	TIFFDefaultDirectory(tif);
    3633. 	/*

libtiff/tif_dir.c:1266:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
      1264.  * Release storage associated with a directory.
      1265.  */
      1266. void
            ^
      1267. TIFFFreeDirectory(TIFF* tif)
      1268. {

libtiff/tif_dirread.c:4199:10: Call
    4197. 			   && tif->tif_dir.td_nstrips > 2
    4198. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
    4199. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                   ^
    4200. 			   && TIFFGetStrileByteCount(tif, 0) != 0
    4201. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6263:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
      6261. 
      6262. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
      6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
            ^
      6264. {
      6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6265:12: Call
      6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
      6264. {
      6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                       ^
      6266. }
      6267. 

libtiff/tif_dirread.c:6269:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
        6267. 
        6268. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
        6269. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
              ^
        6270. {
        6271.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6272:12: Call
        6270. {
        6271.     TIFFDirectory *td = &tif->tif_dir;
        6272.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                         ^
        6273.                                &(td->td_stripbytecount_entry),
        6274.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6204:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
          6202. }
          6203. 
          6204. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                ^
          6205.                                                    TIFFDirEntry* dirent,
          6206.                                                    uint64** parray,

libtiff/tif_dirread.c:4199:44: Call
    4197. 			   && tif->tif_dir.td_nstrips > 2
    4198. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
    4199. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                     ^
    4200. 			   && TIFFGetStrileByteCount(tif, 0) != 0
    4201. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6263:1: Parameter `strile`
      6261. 
      6262. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
      6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
            ^
      6264. {
      6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6265:12: Call
      6263. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
      6264. {
      6265.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                       ^
      6266. }
      6267. 

libtiff/tif_dirread.c:6269:1: Parameter `strile`
        6267. 
        6268. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
        6269. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
              ^
        6270. {
        6271.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6272:12: Call
        6270. {
        6271.     TIFFDirectory *td = &tif->tif_dir;
        6272.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                         ^
        6273.                                &(td->td_stripbytecount_entry),
        6274.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6204:1: Parameter `strile`
          6202. }
          6203. 
          6204. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                ^
          6205.                                                    TIFFDirEntry* dirent,
          6206.                                                    uint64** parray,

libtiff/tif_dirread.c:6230:19: Call
          6228.         else
          6229.         {
          6230.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                  ^
          6231.              {
          6232.                 if( pbErr )

libtiff/tif_dirread.c:6101:1: <Offset trace>
6099. }
6100. 
6101. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6102.                                  uint32 strile,
6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: Parameter `strile`
            6099. }
            6100. 
            6101. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6102.                                  uint32 strile,
            6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: <Length trace>
6099. }
6100. 
6101. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6102.                                  uint32 strile,
6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6101:1: Parameter `**parray`
            6099. }
            6100. 
            6101. static int _TIFFFetchStrileValue(TIFF* tif,
                  ^
            6102.                                  uint32 strile,
            6103.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6192:10: Array access: Offset: 1 Size: [0, +oo] by call to `TIFFSetDirectory` 
            6190.         return 0;
            6191. 
            6192.     if( ~((*parray)[strile]) == 0 )
                           ^
            6193.     {
            6194.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
