libtiff/tif_dirwrite.c:550: error: Buffer Overrun L3
  Offset: [0, 26] Size: [0, +oo] by call to `TIFFWriteDirectoryTagShortPerSample`.

libtiff/tif_dirwrite.c:400:2: Assignment
398. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
399. 	}
400. 	dir=NULL;
      ^
401. 	dirmem=NULL;
402. 	dirsize=0;

libtiff/tif_dirwrite.c:550:10: Call
548. 			if (TIFFFieldSet(tif,FIELD_SAMPLEFORMAT))
549. 			{
550. 				if (!TIFFWriteDirectoryTagShortPerSample(tif,&ndir,dir,TIFFTAG_SAMPLEFORMAT,tif->tif_dir.td_sampleformat))
              ^
551. 					goto bad;
552. 			}

libtiff/tif_dirwrite.c:1070:1: Parameter `*dir`
  1068. }
  1069. 
  1070. static int
        ^
  1071. TIFFWriteDirectoryTagShortPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 value)
  1072. {

libtiff/tif_dirwrite.c:1091:4: Call
  1089. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
  1090. 		*na=value;
  1091. 	o=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
           ^
  1092. 	_TIFFfree(m);
  1093. 	return(o);

libtiff/tif_dirwrite.c:1830:1: Parameter `*dir`
    1828. }
    1829. 
    1830. static int
          ^
    1831. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
    1832. {

libtiff/tif_dirwrite.c:1837:9: Call
    1835. 	if (tif->tif_flags&TIFF_SWAB)
    1836. 		TIFFSwabArrayOfShort(value,count);
    1837. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
                  ^
    1838. }
    1839. 

libtiff/tif_dirwrite.c:2170:1: <Offset trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*ndir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2170:1: <Length trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*dir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2189:2: Array access: Offset: [0, 26] Size: [0, +oo] by call to `TIFFWriteDirectoryTagShortPerSample` 
      2187. 			dir[n]=dir[n-1];
      2188. 	}
      2189. 	dir[m].tdir_tag=tag;
             ^
      2190. 	dir[m].tdir_type=datatype;
      2191. 	dir[m].tdir_count=count;
