libtiff/tif_dirwrite.c:478: error: Buffer Overrun L3
  Offset: [0, 16] Size: [0, +oo] by call to `TIFFWriteDirectoryTagShortLong`.

libtiff/tif_dirwrite.c:400:2: Assignment
398. 		tif->tif_flags &= ~(TIFF_BEENWRITING|TIFF_BUFFERSETUP);
399. 	}
400. 	dir=NULL;
      ^
401. 	dirmem=NULL;
402. 	dirsize=0;

libtiff/tif_dirwrite.c:478:10: Call
476. 			if (TIFFFieldSet(tif,FIELD_ROWSPERSTRIP))
477. 			{
478. 				if (!TIFFWriteDirectoryTagShortLong(tif,&ndir,dir,TIFFTAG_ROWSPERSTRIP,tif->tif_dir.td_rowsperstrip))
              ^
479. 					goto bad;
480. 			}

libtiff/tif_dirwrite.c:1443:1: Parameter `*dir`
  1441. #endif
  1442. 
  1443. static int
        ^
  1444. TIFFWriteDirectoryTagShortLong(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 value)
  1445. {

libtiff/tif_dirwrite.c:1454:10: Call
  1452. 		return(TIFFWriteDirectoryTagCheckedShort(tif,ndir,dir,tag,(uint16)value));
  1453. 	else
  1454. 		return(TIFFWriteDirectoryTagCheckedLong(tif,ndir,dir,tag,value));
                 ^
  1455. }
  1456. 

libtiff/tif_dirwrite.c:1863:1: Parameter `*dir`
    1861. }
    1862. 
    1863. static int
          ^
    1864. TIFFWriteDirectoryTagCheckedLong(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 value)
    1865. {

libtiff/tif_dirwrite.c:1871:9: Call
    1869. 	if (tif->tif_flags&TIFF_SWAB)
    1870. 		TIFFSwabLong(&m);
    1871. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,1,4,&m));
                  ^
    1872. }
    1873. 

libtiff/tif_dirwrite.c:2170:1: <Offset trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*ndir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2170:1: <Length trace>
2168. }
2169. 
2170. static int
      ^
2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
2172. {

libtiff/tif_dirwrite.c:2170:1: Parameter `*dir`
      2168. }
      2169. 
      2170. static int
            ^
      2171. TIFFWriteDirectoryTagData(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint16 datatype, uint32 count, uint32 datalength, void* data)
      2172. {

libtiff/tif_dirwrite.c:2189:2: Array access: Offset: [0, 16] Size: [0, +oo] by call to `TIFFWriteDirectoryTagShortLong` 
      2187. 			dir[n]=dir[n-1];
      2188. 	}
      2189. 	dir[m].tdir_tag=tag;
             ^
      2190. 	dir[m].tdir_type=datatype;
      2191. 	dir[m].tdir_count=count;
