tools/tiffcrop.c:6965: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFClose`.

tools/tiffcrop.c:6707:1: Parameter `out->tif_dir.td_samplesperpixel`
6705.  * original code assumes we are always copying all samples.
6706.  */
6707. static int  
      ^
6708. writeSingleSection(TIFF *in, TIFF *out, struct image_data *image,
6709.                    struct dump_opts *dump, uint32 width, uint32 length,

tools/tiffcrop.c:6958:7: Call
6956.     {
6957.     if (config == PLANARCONFIG_CONTIG)
6958.       writeBufferToContigStrips (out, sect_buff, length);
            ^
6959.     else
6960.       writeBufferToSeparateStrips(out, sect_buff, length, width, spp, dump);

tools/tiffcrop.c:1086:1: Parameter `out->tif_dir.td_samplesperpixel`
  1084.   }
  1085. 
  1086. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
        ^
  1087.   {
  1088.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1092:3: Call
  1090.   tsize_t stripsize;
  1091. 
  1092.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
          ^
  1093.   for (row = 0; row < imagelength; row += rowsperstrip)
  1094.     {

libtiff/tif_aux.c:271:1: Parameter `tif->tif_dir.td_samplesperpixel`
    269.  * value if the tag is not present in the directory.
    270.  */
    271. int
         ^
    272. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
    273. {

libtiff/tif_aux.c:278:8: Call
    276. 
    277. 	va_start(ap, tag);
    278. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                ^
    279. 	va_end(ap);
    280. 	return (ok);

libtiff/tif_aux.c:142:1: Parameter `tif->tif_dir.td_extrasamples`
      140.  *	place in the library -- in TIFFDefaultDirectory.
      141.  */
      142. int
           ^
      143. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
      144. {

tools/tiffcrop.c:6963:8: Call
6961.     }
6962. 
6963.   if (!TIFFWriteDirectory(out))
             ^
6964.     {
6965.     TIFFClose(out);

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
  161.  * storage that's been changed.
  162.  */
  163. int
       ^
  164. TIFFWriteDirectory(TIFF* tif)
  165. {

libtiff/tif_dirwrite.c:166:9: Call
  164. TIFFWriteDirectory(TIFF* tif)
  165. {
  166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  167. }
  168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
    343. }
    344. 
    345. static int
         ^
    346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    347. {

tools/tiffcrop.c:6965:5: Call
6963.   if (!TIFFWriteDirectory(out))
6964.     {
6965.     TIFFClose(out);
          ^
6966.     return (-1);
6967.     }

libtiff/tif_close.c:122:1: Parameter `tif->tif_dir.td_samplesperpixel`
  120.  */
  121. 
  122. void
       ^
  123. TIFFClose(TIFF* tif)
  124. {

libtiff/tif_close.c:128:2: Call
  126. 	thandle_t fd = tif->tif_clientdata;
  127. 
  128. 	TIFFCleanup(tif);
        ^
  129. 	(void) (*closeproc)(fd);
  130. }

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_samplesperpixel`
    44.  */
    45. 
    46. void
        ^
    47. TIFFCleanup(TIFF* tif)
    48. {

libtiff/tif_close.c:53:3: Call
    51.          */
    52. 	if (tif->tif_mode != O_RDONLY)
    53. 		TIFFFlush(tif);
          ^
    54. 	(*tif->tif_cleanup)(tif);
    55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_samplesperpixel`
      30. #include "tiffiop.h"
      31. 
      32. int
          ^
      33. TIFFFlush(TIFF* tif)
      34. {

libtiff/tif_flush.c:83:13: Call
      81. 
      82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
      83.         && !TIFFRewriteDirectory(tif))
                      ^
      84.         return (0);
      85. 

libtiff/tif_dirwrite.c:199:1: Parameter `tif->tif_dir.td_samplesperpixel`
        197.  * previously used directory space. 
        198.  */ 
        199. int
             ^
        200. TIFFRewriteDirectory( TIFF *tif )
        201. {

libtiff/tif_dirwrite.c:206:10: Call
        204. 	/* We don't need to do anything special if it hasn't been written. */
        205. 	if( tif->tif_diroff == 0 )
        206. 		return TIFFWriteDirectory( tif );
                      ^
        207. 
        208. 	/*

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
          161.  * storage that's been changed.
          162.  */
          163. int
               ^
          164. TIFFWriteDirectory(TIFF* tif)
          165. {

libtiff/tif_dirwrite.c:166:9: Call
          164. TIFFWriteDirectory(TIFF* tif)
          165. {
          166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                       ^
          167. }
          168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
            343. }
            344. 
            345. static int
                 ^
            346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
            347. {

libtiff/tif_dirwrite.c:445:10: Call
            443. 			if (TIFFFieldSet(tif,FIELD_BITSPERSAMPLE))
            444. 			{
            445. 				if (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_BITSPERSAMPLE,tif->tif_dir.td_bitspersample))
                          ^
            446. 					goto bad;
            447. 			}

libtiff/tif_dirwrite.c:1076:1: Parameter `tif->tif_dir.td_samplesperpixel`
              1074. }
              1075. 
              1076. static int
                    ^
              1077. TIFFWriteDirectoryTagShortPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 value)
              1078. {

libtiff/tif_dirwrite.c:1089:4: Call
              1087. 		return(1);
              1088. 	}
              1089. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(uint16));
                       ^
              1090. 	if (m==NULL)
              1091. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
                251. #endif
                252. 
                253. void*
                     ^
                254. _TIFFmalloc(tmsize_t s)
                255. {

libtiff/tif_unix.c:256:10: Array declaration
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                              ^
                257. }
                258. 

libtiff/tif_unix.c:256:2: Assignment
                254. _TIFFmalloc(tmsize_t s)
                255. {
                256. 	return (malloc((size_t) s));
                      ^
                257. }
                258. 

libtiff/tif_dirwrite.c:1089:2: Assignment
              1087. 		return(1);
              1088. 	}
              1089. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(uint16));
                     ^
              1090. 	if (m==NULL)
              1091. 	{

libtiff/tif_dirwrite.c:1097:4: Call
              1095. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
              1096. 		*na=value;
              1097. 	o=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                       ^
              1098. 	_TIFFfree(m);
              1099. 	return(o);

libtiff/tif_dirwrite.c:1836:1: Parameter `*value`
                1834. }
                1835. 
                1836. static int
                      ^
                1837. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
                1838. {

libtiff/tif_dirwrite.c:1842:3: Call
                1840. 	assert(sizeof(uint16)==2);
                1841. 	if (tif->tif_flags&TIFF_SWAB)
                1842. 		TIFFSwabArrayOfShort(value,count);
                        ^
                1843. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
                1844. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
                  70. 
                  71. #ifndef TIFFSwabArrayOfShort
                  72. void
                      ^
                  73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
                  74. {

libtiff/tif_swab.c:80:3: Assignment
                  78. 	/* XXX unroll loop some */
                  79. 	while (n-- > 0) {
                  80. 		cp = (unsigned char*) wp;
                        ^
                  81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
                  82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFClose` 
                  79. 	while (n-- > 0) {
                  80. 		cp = (unsigned char*) wp;
                  81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
                            ^
                  82. 		wp++;
                  83. 	}
