libtiff/tif_open.c:484: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFCleanup`.

libtiff/tif_open.c:484:9: Call
482. bad:
483. 	tif->tif_mode = O_RDONLY;	/* XXX avoid flush */
484.         TIFFCleanup(tif);
             ^
485. bad2:
486. 	return ((TIFF*)0);

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_nstrips`
  44.  */
  45. 
  46. void
      ^
  47. TIFFCleanup(TIFF* tif)
  48. {

libtiff/tif_close.c:53:3: Call
  51.          */
  52. 	if (tif->tif_mode != O_RDONLY)
  53. 		TIFFFlush(tif);
        ^
  54. 	(*tif->tif_cleanup)(tif);
  55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_nstrips`
    30. #include "tiffiop.h"
    31. 
    32. int
        ^
    33. TIFFFlush(TIFF* tif)
    34. {

libtiff/tif_flush.c:38:10: Call
    36.         return 1;
    37. 
    38.     if (!TIFFFlushData(tif))
                 ^
    39.         return (0);
    40.                 

libtiff/tif_flush.c:98:1: Parameter `tif->tif_dir.td_nstrips`
       96.  * problems for other people. 
       97.  */
       98. int
           ^
       99. TIFFFlushData(TIFF* tif)
      100. {

libtiff/tif_flush.c:83:13: Call
    81. 
    82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
    83.         && !TIFFRewriteDirectory(tif))
                    ^
    84.         return (0);
    85. 

libtiff/tif_dirwrite.c:216:1: Parameter `tif->tif_dir.td_nstrips`
      214.  * previously used directory space. 
      215.  */ 
      216. int
           ^
      217. TIFFRewriteDirectory( TIFF *tif )
      218. {

libtiff/tif_dirwrite.c:223:10: Call
      221. 	/* We don't need to do anything special if it hasn't been written. */
      222. 	if( tif->tif_diroff == 0 )
      223. 		return TIFFWriteDirectory( tif );
                    ^
      224. 
      225. 	/*

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_nstrips`
        178.  * storage that's been changed.
        179.  */
        180. int
             ^
        181. TIFFWriteDirectory(TIFF* tif)
        182. {

libtiff/tif_dirwrite.c:183:9: Call
        181. TIFFWriteDirectory(TIFF* tif)
        182. {
        183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                     ^
        184. }
        185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_nstrips`
          360. }
          361. 
          362. static int
               ^
          363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
          364. {

libtiff/tif_dirwrite.c:532:11: Call
          530. 				if (!isTiled(tif))
          531. 				{
          532. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                         ^
          533. 						goto bad;
          534. 				}

libtiff/tif_dirwrite.c:1587:1: Parameter `count`
            1585. /************************************************************************/
            1586. 
            1587. static int
                  ^
            1588. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
            1589. {

libtiff/tif_dirwrite.c:1614:9: Call
            1612.     */
            1613. 
            1614.     p = _TIFFmalloc(count*sizeof(uint32));
                          ^
            1615.     if (p==NULL)
            1616.     {

libtiff/tif_unix.c:253:1: Parameter `s`
              251. #endif
              252. 
              253. void*
                   ^
              254. _TIFFmalloc(tmsize_t s)
              255. {

libtiff/tif_unix.c:256:10: Array declaration
              254. _TIFFmalloc(tmsize_t s)
              255. {
              256. 	return (malloc((size_t) s));
                            ^
              257. }
              258. 

libtiff/tif_unix.c:256:2: Assignment
              254. _TIFFmalloc(tmsize_t s)
              255. {
              256. 	return (malloc((size_t) s));
                    ^
              257. }
              258. 

libtiff/tif_dirwrite.c:1614:5: Assignment
            1612.     */
            1613. 
            1614.     p = _TIFFmalloc(count*sizeof(uint32));
                      ^
            1615.     if (p==NULL)
            1616.     {

libtiff/tif_dirwrite.c:1633:7: Call
            1631.     }
            1632. 
            1633.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                        ^
            1634.     _TIFFfree(p);
            1635. 

libtiff/tif_dirwrite.c:1997:1: Parameter `*value`
              1995. }
              1996. 
              1997. static int
                    ^
              1998. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
              1999. {

libtiff/tif_dirwrite.c:2003:3: Call
              2001. 	assert(sizeof(uint32)==4);
              2002. 	if (tif->tif_flags&TIFF_SWAB)
              2003. 		TIFFSwabArrayOfLong(value,count);
                      ^
              2004. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
              2005. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
                102. 
                103. #ifndef TIFFSwabArrayOfLong
                104. void
                     ^
                105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                106. {

libtiff/tif_swab.c:112:3: Assignment
                110. 	/* XXX unroll loop some */
                111. 	while (n-- > 0) {
                112. 		cp = (unsigned char *)lp;
                       ^
                113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFCleanup` 
                111. 	while (n-- > 0) {
                112. 		cp = (unsigned char *)lp;
                113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                           ^
                114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                115. 		lp++;
