tools/tiffcrop.c:6982: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `writeCroppedImage`.

tools/tiffcrop.c:6891:1: Parameter `(*out)->tif_dir.td_samplesperpixel`
6889.   } /* end extractImageSection */
6890. 
6891. static int 
      ^
6892. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6893.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6977:16: Call
6975.          for (i = 0; i < crop->selections; i++)
6976.            {
6977.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6978.              return (1);
6979. 

tools/tiffcrop.c:2106:1: Parameter `(*tiffout)->tif_dir.td_samplesperpixel`
  2104.  * so TIFFTAG PAGENUM will be correct in image.
  2105.  */
  2106. static int
        ^
  2107. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2108.                     char *outname, unsigned int *page)

tools/tiffcrop.c:6982:16: Call
6980.            crop_buff = seg_buffs[i].buffer;
6981.            /* Write the current region to the current file */
6982.            if (writeCroppedImage(in, *out, image, dump,
                     ^
6983.                                  crop->regionlist[i].width, 
6984.                                  crop->regionlist[i].length, 

tools/tiffcrop.c:7734:1: Parameter `out->tif_dir.td_samplesperpixel`
  7732.  * then passed in as an argument.
  7733.  */
  7734. static int  
        ^
  7735. writeCroppedImage(TIFF *in, TIFF *out, struct image_data *image, 
  7736.                   struct dump_opts *dump, uint32 width, uint32 length, 

tools/tiffcrop.c:7991:11: Call
  7989.     if (config == PLANARCONFIG_CONTIG)
  7990.       {
  7991.       if (writeBufferToContigStrips (out, crop_buff, length))
                  ^
  7992.         TIFFError("","Unable to write contiguous strip data for page %d", pagenum);
  7993.       }

tools/tiffcrop.c:1114:1: Parameter `out->tif_dir.td_samplesperpixel`
    1112.   }
    1113. 
    1114. static int writeBufferToContigStrips(TIFF* out, uint8* buf, uint32 imagelength)
          ^
    1115.   {
    1116.   uint32 row, nrows, rowsperstrip;

tools/tiffcrop.c:1120:3: Call
    1118.   tsize_t stripsize;
    1119. 
    1120.   TIFFGetFieldDefaulted(out, TIFFTAG_ROWSPERSTRIP, &rowsperstrip);
            ^
    1121.   for (row = 0; row < imagelength; row += rowsperstrip)
    1122.     {

libtiff/tif_aux.c:307:1: Parameter `tif->tif_dir.td_samplesperpixel`
      305.  * value if the tag is not present in the directory.
      306.  */
      307. int
           ^
      308. TIFFGetFieldDefaulted(TIFF* tif, uint32 tag, ...)
      309. {

libtiff/tif_aux.c:314:8: Call
      312. 
      313. 	va_start(ap, tag);
      314. 	ok =  TIFFVGetFieldDefaulted(tif, tag, ap);
                  ^
      315. 	va_end(ap);
      316. 	return (ok);

libtiff/tif_aux.c:171:1: Parameter `tif->tif_dir.td_extrasamples`
        169.  *	place in the library -- in TIFFDefaultDirectory.
        170.  */
        171. int
             ^
        172. TIFFVGetFieldDefaulted(TIFF* tif, uint32 tag, va_list ap)
        173. {

tools/tiffcrop.c:8001:8: Call
  7999.     }
  8000. 
  8001.   if (!TIFFWriteDirectory(out))
               ^
  8002.     {
  8003.     TIFFError("","Failed to write IFD for page number %d", pagenum);

libtiff/tif_dirwrite.c:179:1: Parameter `tif->tif_dir.td_samplesperpixel`
    177.  * storage that's been changed.
    178.  */
    179. int
         ^
    180. TIFFWriteDirectory(TIFF* tif)
    181. {

libtiff/tif_dirwrite.c:182:9: Call
    180. TIFFWriteDirectory(TIFF* tif)
    181. {
    182. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                 ^
    183. }
    184. 

libtiff/tif_dirwrite.c:361:1: Parameter `tif->tif_dir.td_samplesperpixel`
      359. }
      360. 
      361. static int
           ^
      362. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
      363. {

libtiff/tif_dirwrite.c:588:10: Call
      586. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
      587. 			{
      588. 				if (!TIFFWriteDirectoryTagSampleformatArray(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_samplesperpixel,tif->tif_dir.td_sminsamplevalue))
                    ^
      589. 					goto bad;
      590. 			}

libtiff/tif_dirwrite.c:1012:1: Parameter `count`
        1010. }
        1011. 
        1012. static int
              ^
        1013. TIFFWriteDirectoryTagSampleformatArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
        1014. {

libtiff/tif_dirwrite.c:1019:9: Call
        1017. 	uint32 i;
        1018. 	int ok;
        1019. 	conv = _TIFFmalloc(count*sizeof(double));
                      ^
        1020. 	if (conv == NULL)
        1021. 	{

libtiff/tif_unix.c:312:17: Assignment
          310. {
          311.         if (s == 0)
          312.                 return ((void *) NULL);
                               ^
          313. 
          314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1019:2: Assignment
        1017. 	uint32 i;
        1018. 	int ok;
        1019. 	conv = _TIFFmalloc(count*sizeof(double));
               ^
        1020. 	if (conv == NULL)
        1021. 	{

libtiff/tif_dirwrite.c:1057:10: Call
        1055. 				for (i = 0; i < count; ++i)
        1056. 					((int32*)conv)[i] = TIFFClampDoubleToInt32(value[i]);
        1057. 				ok = TIFFWriteDirectoryTagSlongArray(tif,ndir,dir,tag,count,(int32*)conv);
                       ^
        1058. 			}
        1059. 			break;

libtiff/tif_dirwrite.c:1408:1: Parameter `*value`
          1406. #endif
          1407. 
          1408. static int
                ^
          1409. TIFFWriteDirectoryTagSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
          1410. {

libtiff/tif_dirwrite.c:1416:9: Call
          1414. 		return(1);
          1415. 	}
          1416. 	return(TIFFWriteDirectoryTagCheckedSlongArray(tif,ndir,dir,tag,count,value));
                        ^
          1417. }
          1418. 

libtiff/tif_dirwrite.c:2111:1: Parameter `*value`
            2109. #endif
            2110. 
            2111. static int
                  ^
            2112. TIFFWriteDirectoryTagCheckedSlongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, int32* value)
            2113. {

libtiff/tif_dirwrite.c:2117:3: Call
            2115. 	assert(sizeof(int32)==4);
            2116. 	if (tif->tif_flags&TIFF_SWAB)
            2117. 		TIFFSwabArrayOfLong((uint32*)value,count);
                    ^
            2118. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SLONG,count,count*4,value));
            2119. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
              100. 
              101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
              102. void
                   ^
              103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
              104. {

libtiff/tif_swab.c:110:3: Assignment
              108. 	/* XXX unroll loop some */
              109. 	while (n-- > 0) {
              110. 		cp = (unsigned char *)lp;
                     ^
              111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
              112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `writeCroppedImage` 
              109. 	while (n-- > 0) {
              110. 		cp = (unsigned char *)lp;
              111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                         ^
              112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
              113. 		lp++;
