libtiff/tif_dirread.c:5382: error: Buffer Overrun S2
  Offset: [-1+max(1, `dp->tdir_count`), `dp->tdir_count` - 1] Size: [0, +oo].

libtiff/tif_dirread.c:4913:1: <Offset trace>
4911.  * Fetch a tag that is not handled by special case code.
4912.  */
4913. static int
      ^
4914. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4915. {

libtiff/tif_dirread.c:4913:1: Parameter `dp->tdir_count`
4911.  * Fetch a tag that is not handled by special case code.
4912.  */
4913. static int
      ^
4914. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4915. {

libtiff/tif_dirread.c:5378:9: Call
5376. 				assert(fip->field_readcount==TIFF_VARIABLE2);
5377. 				assert(fip->field_passcount==1);
5378. 				err=TIFFReadDirEntryByteArray(tif,dp,&data);
              ^
5379. 				if (err==TIFFReadDirEntryErrOk)
5380. 				{

libtiff/tif_dirread.c:931:1: Parameter `direntry->tdir_count`
  929. }
  930. 
  931. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  932. {
  933. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5378:9: <Length trace>
5376. 				assert(fip->field_readcount==TIFF_VARIABLE2);
5377. 				assert(fip->field_passcount==1);
5378. 				err=TIFFReadDirEntryByteArray(tif,dp,&data);
              ^
5379. 				if (err==TIFFReadDirEntryErrOk)
5380. 				{

libtiff/tif_dirread.c:5378:9: Call
5376. 				assert(fip->field_readcount==TIFF_VARIABLE2);
5377. 				assert(fip->field_passcount==1);
5378. 				err=TIFFReadDirEntryByteArray(tif,dp,&data);
              ^
5379. 				if (err==TIFFReadDirEntryErrOk)
5380. 				{

libtiff/tif_dirread.c:931:1: Parameter `**value`
  929. }
  930. 
  931. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  932. {
  933. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5382:45: Array access: Offset: [-1+max(1, dp->tdir_count), dp->tdir_count - 1] Size: [0, +oo]
5380. 				{
5381. 					int m;
5382. 					if( data != 0 && dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
                                                  ^
5383. 					{
5384. 					    TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
