tools/thumbnail.c:620: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory`.

tools/thumbnail.c:619:13: Call
617.     diroff[0] = 0UL;
618.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
619.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
                 ^
620.             TIFFWriteDirectory(out) != -1);
621. }

libtiff/tif_write.c:183:1: Parameter `strip`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

tools/thumbnail.c:620:13: Call
618.     TIFFSetField(out, TIFFTAG_SUBIFD, 1, diroff);
619.     return (TIFFWriteEncodedStrip(out, 0, thumbnail, tnw*tnh) != -1 &&
620.             TIFFWriteDirectory(out) != -1);
                 ^
621. }
622. 

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_nstrips`
  178.  * storage that's been changed.
  179.  */
  180. int
       ^
  181. TIFFWriteDirectory(TIFF* tif)
  182. {

libtiff/tif_dirwrite.c:183:9: Call
  181. TIFFWriteDirectory(TIFF* tif)
  182. {
  183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  184. }
  185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_nstrips`
    360. }
    361. 
    362. static int
         ^
    363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    364. {

libtiff/tif_dirwrite.c:532:11: Call
    530. 				if (!isTiled(tif))
    531. 				{
    532. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                   ^
    533. 						goto bad;
    534. 				}

libtiff/tif_dirwrite.c:1587:1: Parameter `count`
      1585. /************************************************************************/
      1586. 
      1587. static int
            ^
      1588. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
      1589. {

libtiff/tif_dirwrite.c:1614:9: Call
      1612.     */
      1613. 
      1614.     p = _TIFFmalloc(count*sizeof(uint32));
                    ^
      1615.     if (p==NULL)
      1616.     {

libtiff/tif_unix.c:253:1: Parameter `s`
        251. #endif
        252. 
        253. void*
             ^
        254. _TIFFmalloc(tmsize_t s)
        255. {

libtiff/tif_unix.c:256:10: Array declaration
        254. _TIFFmalloc(tmsize_t s)
        255. {
        256. 	return (malloc((size_t) s));
                      ^
        257. }
        258. 

libtiff/tif_unix.c:256:2: Assignment
        254. _TIFFmalloc(tmsize_t s)
        255. {
        256. 	return (malloc((size_t) s));
              ^
        257. }
        258. 

libtiff/tif_dirwrite.c:1614:5: Assignment
      1612.     */
      1613. 
      1614.     p = _TIFFmalloc(count*sizeof(uint32));
                ^
      1615.     if (p==NULL)
      1616.     {

libtiff/tif_dirwrite.c:1633:7: Call
      1631.     }
      1632. 
      1633.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                  ^
      1634.     _TIFFfree(p);
      1635. 

libtiff/tif_dirwrite.c:1997:1: Parameter `*value`
        1995. }
        1996. 
        1997. static int
              ^
        1998. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
        1999. {

libtiff/tif_dirwrite.c:2003:3: Call
        2001. 	assert(sizeof(uint32)==4);
        2002. 	if (tif->tif_flags&TIFF_SWAB)
        2003. 		TIFFSwabArrayOfLong(value,count);
                ^
        2004. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
        2005. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
          102. 
          103. #ifndef TIFFSwabArrayOfLong
          104. void
               ^
          105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
          106. {

libtiff/tif_swab.c:112:3: Assignment
          110. 	/* XXX unroll loop some */
          111. 	while (n-- > 0) {
          112. 		cp = (unsigned char *)lp;
                 ^
          113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
          114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectory` 
          111. 	while (n-- > 0) {
          112. 		cp = (unsigned char *)lp;
          113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                     ^
          114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
          115. 		lp++;
