libtiff/tif_dirread.c:5205: error: Buffer Overrun S2
  Offset: [-1+max(1, `dp->tdir_count`), -1+min(65535, `dp->tdir_count`)] Size: [0, +oo].

libtiff/tif_dirread.c:4913:1: <Offset trace>
4911.  * Fetch a tag that is not handled by special case code.
4912.  */
4913. static int
      ^
4914. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4915. {

libtiff/tif_dirread.c:4913:1: Parameter `dp->tdir_count`
4911.  * Fetch a tag that is not handled by special case code.
4912.  */
4913. static int
      ^
4914. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4915. {

libtiff/tif_dirread.c:5201:10: Call
5199. 				else
5200. 				{
5201. 					err=TIFFReadDirEntryByteArray(tif,dp,&data);
               ^
5202. 					if (err==TIFFReadDirEntryErrOk)
5203. 					{

libtiff/tif_dirread.c:931:1: Parameter `direntry->tdir_count`
  929. }
  930. 
  931. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  932. {
  933. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5201:10: <Length trace>
5199. 				else
5200. 				{
5201. 					err=TIFFReadDirEntryByteArray(tif,dp,&data);
               ^
5202. 					if (err==TIFFReadDirEntryErrOk)
5203. 					{

libtiff/tif_dirread.c:5201:10: Call
5199. 				else
5200. 				{
5201. 					err=TIFFReadDirEntryByteArray(tif,dp,&data);
               ^
5202. 					if (err==TIFFReadDirEntryErrOk)
5203. 					{

libtiff/tif_dirread.c:931:1: Parameter `**value`
  929. }
  930. 
  931. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  932. {
  933. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5205:46: Array access: Offset: [-1+max(1, dp->tdir_count), -1+min(65535, dp->tdir_count)] Size: [0, +oo]
5203. 					{
5204. 						int m;
5205. 						if( data != 0 && dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
                                                   ^
5206. 						{
5207. 						    TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
