tools/tiff2ps.c:1621: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `TIFFReadDirectory`.

tools/tiff2ps.c:1486:1: Parameter `tif->tif_dir.td_stripbytecount_p`
1484.  */
1485. 
1486. int TIFF2PS(FILE* fd, TIFF* tif, double pgwidth, double pgheight, double lm, double bm, int center)
      ^
1487.   {
1488.   uint32 pixwidth = 0, pixheight = 0;  /* Image width and height in pixels */

tools/tiff2ps.c:1621:59: Call
1619.     rotation = 0.0;
1620.   TIFFGetFieldDefaulted(tif, TIFFTAG_SUBFILETYPE, &subfiletype);
1621.   } while (((subfiletype & FILETYPE_PAGE) || printAll) && TIFFReadDirectory(tif));
                                                                ^
1622. 
1623. return(npages);

libtiff/tif_dirread.c:3938:42: Call
  3936.                                         goto bad;
  3937.                                     }
  3938.                                     if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripbytecount_p))  
                                                 ^
  3939.                                             goto bad;
  3940.                                 }

libtiff/tif_dirread.c:5621:1: Parameter `**lpp`
    5619.  * While this routine says "strips", in fact it's also used for tiles.
    5620.  */
    5621. static int
          ^
    5622. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
    5623. {

libtiff/tif_dirread.c:4187:10: Call
  4185. 			   && tif->tif_dir.td_nstrips > 2
  4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
  4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                 ^
  4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
  4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6248:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
    6246. 
    6247. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
          ^
    6249. {
    6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6250:12: Call
    6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
    6249. {
    6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                     ^
    6251. }
    6252. 

libtiff/tif_dirread.c:6254:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
      6252. 
      6253. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
      6254. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
            ^
      6255. {
      6256.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6257:12: Call
      6255. {
      6256.     TIFFDirectory *td = &tif->tif_dir;
      6257.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                       ^
      6258.                                &(td->td_stripbytecount_entry),
      6259.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `*tif->tif_dir.td_stripbytecount_p`
        6189. }
        6190. 
        6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
              ^
        6192.                                                    TIFFDirEntry* dirent,
        6193.                                                    uint64** parray,

libtiff/tif_dirread.c:4187:44: Call
  4185. 			   && tif->tif_dir.td_nstrips > 2
  4186. 			   && tif->tif_dir.td_compression == COMPRESSION_NONE
  4187. 			   && TIFFGetStrileByteCount(tif, 0) != TIFFGetStrileByteCount(tif, 1)
                                                   ^
  4188. 			   && TIFFGetStrileByteCount(tif, 0) != 0
  4189. 			   && TIFFGetStrileByteCount(tif, 1) != 0 ) {

libtiff/tif_dirread.c:6248:1: Parameter `strile`
    6246. 
    6247. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
    6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
          ^
    6249. {
    6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6250:12: Call
    6248. uint64 TIFFGetStrileByteCount(TIFF *tif, uint32 strile)
    6249. {
    6250.     return TIFFGetStrileByteCountWithErr(tif, strile, NULL);
                     ^
    6251. }
    6252. 

libtiff/tif_dirread.c:6254:1: Parameter `strile`
      6252. 
      6253. /* Return the value of the TileByteCounts/StripByteCounts array for the specified tile/strile */
      6254. uint64 TIFFGetStrileByteCountWithErr(TIFF *tif, uint32 strile, int *pbErr)
            ^
      6255. {
      6256.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6257:12: Call
      6255. {
      6256.     TIFFDirectory *td = &tif->tif_dir;
      6257.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                       ^
      6258.                                &(td->td_stripbytecount_entry),
      6259.                                &(td->td_stripbytecount_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `strile`
        6189. }
        6190. 
        6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
              ^
        6192.                                                    TIFFDirEntry* dirent,
        6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6215:19: Call
        6213.         else
        6214.         {
        6215.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                ^
        6216.              {
        6217.                 if( pbErr )

libtiff/tif_dirread.c:6088:1: <Offset trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `strile`
          6086. }
          6087. 
          6088. static int _TIFFFetchStrileValue(TIFF* tif,
                ^
          6089.                                  uint32 strile,
          6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: <Length trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `**parray`
          6086. }
          6087. 
          6088. static int _TIFFFetchStrileValue(TIFF* tif,
                ^
          6089.                                  uint32 strile,
          6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6179:10: Array access: Offset: 1 Size: [0, +oo] by call to `TIFFReadDirectory` 
          6177.         return 0;
          6178. 
          6179.     if( ~((*parray)[strile]) == 0 )
                         ^
          6180.     {
          6181.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
