libtiff/tif_dirwrite.c:199: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec`.

libtiff/tif_dirwrite.c:192:1: Parameter `tif->tif_dir.td_nstrips`
190.  * readable before it is successfully completed/closed.
191.  */
192. int
     ^
193. TIFFCheckpointDirectory(TIFF* tif)
194. {

libtiff/tif_dirwrite.c:199:7: Call
197. 	if (tif->tif_dir.td_stripoffset == NULL)
198. 	    (void) TIFFSetupStrips(tif);
199. 	rc = TIFFWriteDirectorySec(tif,TRUE,FALSE,NULL);
           ^
200. 	(void) TIFFSetWriteOffset(tif, TIFFSeekFile(tif, 0, SEEK_END));
201. 	return rc;

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_nstrips`
  360. }
  361. 
  362. static int
       ^
  363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
  364. {

libtiff/tif_dirwrite.c:532:11: Call
  530. 				if (!isTiled(tif))
  531. 				{
  532. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                 ^
  533. 						goto bad;
  534. 				}

libtiff/tif_dirwrite.c:1587:1: Parameter `count`
    1585. /************************************************************************/
    1586. 
    1587. static int
          ^
    1588. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
    1589. {

libtiff/tif_dirwrite.c:1614:9: Call
    1612.     */
    1613. 
    1614.     p = _TIFFmalloc(count*sizeof(uint32));
                  ^
    1615.     if (p==NULL)
    1616.     {

libtiff/tif_unix.c:261:17: Assignment
      259. {
      260.         if (s == 0)
      261.                 return ((void *) NULL);
                           ^
      262. 
      263. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1614:5: Assignment
    1612.     */
    1613. 
    1614.     p = _TIFFmalloc(count*sizeof(uint32));
              ^
    1615.     if (p==NULL)
    1616.     {

libtiff/tif_dirwrite.c:1633:7: Call
    1631.     }
    1632. 
    1633.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                ^
    1634.     _TIFFfree(p);
    1635. 

libtiff/tif_dirwrite.c:1997:1: Parameter `*value`
      1995. }
      1996. 
      1997. static int
            ^
      1998. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
      1999. {

libtiff/tif_dirwrite.c:2003:3: Call
      2001. 	assert(sizeof(uint32)==4);
      2002. 	if (tif->tif_flags&TIFF_SWAB)
      2003. 		TIFFSwabArrayOfLong(value,count);
              ^
      2004. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
      2005. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
        102. 
        103. #ifndef TIFFSwabArrayOfLong
        104. void
             ^
        105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
        106. {

libtiff/tif_swab.c:112:3: Assignment
        110. 	/* XXX unroll loop some */
        111. 	while (n-- > 0) {
        112. 		cp = (unsigned char *)lp;
               ^
        113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
        114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec` 
        111. 	while (n-- > 0) {
        112. 		cp = (unsigned char *)lp;
        113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                   ^
        114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
        115. 		lp++;
