tools/tiff2pdf.c:5527: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `t2p_write_advance_directory`.

tools/tiff2pdf.c:5526:16: Call
5524. 				streamlen=written;
5525. 				t2p_read_tiff_size_tile(t2p, input, i2);
5526. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
                     ^
5527. 				t2p_write_advance_directory(t2p, output);
5528. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}

tools/tiff2pdf.c:2761:1: Parameter `output->tif_dir.td_nstrips`
  2759.  */
  2760. 
  2761. tsize_t t2p_readwrite_pdf_image_tile(T2P* t2p, TIFF* input, TIFF* output, ttile_t tile){
        ^
  2762. 
  2763. 	uint16 edge=0;

tools/tiff2pdf.c:5527:5: Call
5525. 				t2p_read_tiff_size_tile(t2p, input, i2);
5526. 				written += t2p_readwrite_pdf_image_tile(t2p, input, output, i2);
5527. 				t2p_write_advance_directory(t2p, output);
          ^
5528. 				if(t2p->t2p_error!=T2P_ERR_OK){return(0);}
5529. 				streamlen=written-streamlen;

tools/tiff2pdf.c:3612:1: Parameter `output->tif_dir.td_nstrips`
  3610.  */
  3611. 
  3612. void
        ^
  3613. t2p_write_advance_directory(T2P* t2p, TIFF* output)
  3614. {

tools/tiff2pdf.c:3616:6: Call
  3614. {
  3615. 	t2p_disable(output);
  3616. 	if(!TIFFWriteDirectory(output)){
             ^
  3617. 		TIFFError(TIFF2PDF_MODULE, 
  3618. 			"Error writing virtual directory to output PDF %s", 

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_nstrips`
    178.  * storage that's been changed.
    179.  */
    180. int
         ^
    181. TIFFWriteDirectory(TIFF* tif)
    182. {

libtiff/tif_dirwrite.c:183:9: Call
    181. TIFFWriteDirectory(TIFF* tif)
    182. {
    183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    184. }
    185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_nstrips`
      360. }
      361. 
      362. static int
           ^
      363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      364. {

libtiff/tif_dirwrite.c:557:26: Call
      555.                     */
      556.                     if (tif->tif_dir.td_stripoffset != NULL &&
      557.                         !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
                                    ^
      558.                         goto bad;
      559. 				}

libtiff/tif_dirwrite.c:1601:1: Parameter `count`
        1599. /************************************************************************/
        1600. 
        1601. static int
              ^
        1602. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
        1603. {

libtiff/tif_dirwrite.c:1628:9: Call
        1626.     */
        1627. 
        1628.     p = _TIFFmalloc(count*sizeof(uint32));
                      ^
        1629.     if (p==NULL)
        1630.     {

libtiff/tif_unix.c:314:17: Assignment
          312. {
          313.         if (s == 0)
          314.                 return ((void *) NULL);
                               ^
          315. 
          316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1628:5: Assignment
        1626.     */
        1627. 
        1628.     p = _TIFFmalloc(count*sizeof(uint32));
                  ^
        1629.     if (p==NULL)
        1630.     {

libtiff/tif_dirwrite.c:1647:7: Call
        1645.     }
        1646. 
        1647.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                    ^
        1648.     _TIFFfree(p);
        1649. 

libtiff/tif_dirwrite.c:2011:1: Parameter `*value`
          2009. }
          2010. 
          2011. static int
                ^
          2012. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
          2013. {

libtiff/tif_dirwrite.c:2017:3: Call
          2015. 	assert(sizeof(uint32)==4);
          2016. 	if (tif->tif_flags&TIFF_SWAB)
          2017. 		TIFFSwabArrayOfLong(value,count);
                  ^
          2018. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
          2019. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
            102. 
            103. #ifndef TIFFSwabArrayOfLong
            104. void
                 ^
            105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
            106. {

libtiff/tif_swab.c:112:3: Assignment
            110. 	/* XXX unroll loop some */
            111. 	while (n-- > 0) {
            112. 		cp = (unsigned char *)lp;
                   ^
            113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
            114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `t2p_write_advance_directory` 
            111. 	while (n-- > 0) {
            112. 		cp = (unsigned char *)lp;
            113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                       ^
            114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
            115. 		lp++;
