contrib/addtiffo/tif_overview.c:150: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:146:9: Call
144. /*      Write directory, and return byte offset.                        */
145. /* -------------------------------------------------------------------- */
146.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
147.         return 0;
148. 

libtiff/tif_write.c:566:1: Parameter `*tif->tif_dir.td_stripoffset`
  564.  * that important information is not changed.
  565.  */
  566. int
       ^
  567. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  568. {

contrib/addtiffo/tif_overview.c:149:5: Call
147.         return 0;
148. 
149.     TIFFWriteDirectory( hTIFF );
         ^
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
151. 

libtiff/tif_dirwrite.c:181:1: Parameter `*tif->tif_dir.td_stripoffset`
  179.  * storage that's been changed.
  180.  */
  181. int
       ^
  182. TIFFWriteDirectory(TIFF* tif)
  183. {

libtiff/tif_dirwrite.c:184:9: Call
  182. TIFFWriteDirectory(TIFF* tif)
  183. {
  184. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  185. }
  186. 

libtiff/tif_dirwrite.c:363:1: Parameter `*tif->tif_dir.td_stripoffset`
    361. }
    362. 
    363. static int
         ^
    364. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    365. {

contrib/addtiffo/tif_overview.c:150:5: Call
148. 
149.     TIFFWriteDirectory( hTIFF );
150.     TIFFSetDirectory( hTIFF, (tdir_t) (TIFFNumberOfDirectories(hTIFF)-1) );
         ^
151. 
152.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1597:1: Parameter `*tif->tif_dir.td_stripoffset`
  1595.  * NB: Directories are numbered starting at 0.
  1596.  */
  1597. int
        ^
  1598. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1599. {

libtiff/tif_dir.c:1622:10: Call
  1620. 	 */
  1621. 	tif->tif_dirnumber = 0;
  1622. 	return (TIFFReadDirectory(tif));
                 ^
  1623. }
  1624. 

libtiff/tif_dirread.c:4155:8: <Offset trace>
4153. 
4154. 		tif->tif_dir.td_stripbytecountsorted = 1;
4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
4157. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:4155:8: Assignment
    4153. 
    4154. 		tif->tif_dir.td_stripbytecountsorted = 1;
    4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
                 ^
    4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    4157. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3854:10: <Length trace>
3852.                                     goto bad;
3853.                                 }
3854. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
               ^
3855. 					goto bad;
3856. #endif                                

libtiff/tif_dirread.c:3854:10: Call
    3852.                                     goto bad;
    3853.                                 }
    3854. 				if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset))  
                   ^
    3855. 					goto bad;
    3856. #endif                                

libtiff/tif_dirread.c:5537:1: Parameter `**lpp`
      5535.  * While this routine says "strips", in fact it's also used for tiles.
      5536.  */
      5537. static int
            ^
      5538. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
      5539. {

libtiff/tif_dirread.c:4157:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory` 
    4155. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
    4156. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    4157. 			    tif->tif_dir.td_stripoffset[strip]) {
                 ^
    4158. 				tif->tif_dir.td_stripbytecountsorted = 0;
    4159. 				break;
