libtiff/tif_dirread.c:5321: error: Buffer Overrun S2
  Offset: [-1+max(1, `dp->tdir_count`), `dp->tdir_count` - 1] Size: [0, +oo].

libtiff/tif_dirread.c:4853:1: <Offset trace>
4851.  * Fetch a tag that is not handled by special case code.
4852.  */
4853. static int
      ^
4854. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4855. {

libtiff/tif_dirread.c:4853:1: Parameter `dp->tdir_count`
4851.  * Fetch a tag that is not handled by special case code.
4852.  */
4853. static int
      ^
4854. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4855. {

libtiff/tif_dirread.c:5317:9: Call
5315. 				assert(fip->field_readcount==TIFF_VARIABLE2);
5316. 				assert(fip->field_passcount==1);
5317. 				err=TIFFReadDirEntryByteArray(tif,dp,&data);
              ^
5318. 				if (err==TIFFReadDirEntryErrOk)
5319. 				{

libtiff/tif_dirread.c:932:1: Parameter `direntry->tdir_count`
  930. }
  931. 
  932. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  933. {
  934. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5317:9: <Length trace>
5315. 				assert(fip->field_readcount==TIFF_VARIABLE2);
5316. 				assert(fip->field_passcount==1);
5317. 				err=TIFFReadDirEntryByteArray(tif,dp,&data);
              ^
5318. 				if (err==TIFFReadDirEntryErrOk)
5319. 				{

libtiff/tif_dirread.c:5317:9: Call
5315. 				assert(fip->field_readcount==TIFF_VARIABLE2);
5316. 				assert(fip->field_passcount==1);
5317. 				err=TIFFReadDirEntryByteArray(tif,dp,&data);
              ^
5318. 				if (err==TIFFReadDirEntryErrOk)
5319. 				{

libtiff/tif_dirread.c:932:1: Parameter `**value`
  930. }
  931. 
  932. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  933. {
  934. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5321:47: Array access: Offset: [-1+max(1, dp->tdir_count), dp->tdir_count - 1] Size: [0, +oo]
5319. 				{
5320. 					int m;
5321.                     if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
                                                    ^
5322.                     {
5323.                         TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
