contrib/addtiffo/tif_overview.c:162: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory`.

contrib/addtiffo/tif_overview.c:149:9: Call
147. /*      Write directory, and return byte offset.                        */
148. /* -------------------------------------------------------------------- */
149.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
150.         return 0;
151. 

libtiff/tif_write.c:564:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  562.  * that important information is not changed.
  563.  */
  564. int
       ^
  565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  566. {

contrib/addtiffo/tif_overview.c:152:5: Call
150.         return 0;
151. 
152.     TIFFWriteDirectory( hTIFF );
         ^
153.     iNumDir = TIFFNumberOfDirectories(hTIFF);
154.     if( iNumDir > TIFF_DIR_MAX )

libtiff/tif_dirwrite.c:178:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  176.  * storage that's been changed.
  177.  */
  178. int
       ^
  179. TIFFWriteDirectory(TIFF* tif)
  180. {

libtiff/tif_dirwrite.c:181:9: Call
  179. TIFFWriteDirectory(TIFF* tif)
  180. {
  181. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  182. }
  183. 

libtiff/tif_dirwrite.c:360:1: Parameter `*tif->tif_dir.td_stripoffset_p`
    358. }
    359. 
    360. static int
         ^
    361. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    362. {

contrib/addtiffo/tif_overview.c:162:5: Call
160.         exit(-1);
161.     }
162.     TIFFSetDirectory( hTIFF, (tdir_t) (iNumDir - 1) );
         ^
163. 
164.     nOffset = TIFFCurrentDirOffset( hTIFF );

libtiff/tif_dir.c:1615:1: Parameter `*tif->tif_dir.td_stripoffset_p`
  1613.  * NB: Directories are numbered starting at 0.
  1614.  */
  1615. int
        ^
  1616. TIFFSetDirectory(TIFF* tif, uint16 dirn)
  1617. {

libtiff/tif_dir.c:1640:10: Call
  1638. 	 */
  1639. 	tif->tif_dirnumber = 0;
  1640. 	return (TIFFReadDirectory(tif));
                 ^
  1641. }
  1642. 

libtiff/tif_dirread.c:3920:42: Call
    3918.                                         goto bad;
    3919.                                     }
    3920.                                     if (!TIFFFetchStripThing(tif,dp,tif->tif_dir.td_nstrips,&tif->tif_dir.td_stripoffset_p))  
                                                   ^
    3921.                                             goto bad;
    3922.                                 }

libtiff/tif_dirread.c:5621:1: Parameter `**lpp`
      5619.  * While this routine says "strips", in fact it's also used for tiles.
      5620.  */
      5621. static int
            ^
      5622. TIFFFetchStripThing(TIFF* tif, TIFFDirEntry* dir, uint32 nstrips, uint64** lpp)
      5623. {

libtiff/tif_dirread.c:4269:13: Call
    4267.             TIFFStripSize64(tif) > 0x7FFFFFFFUL )
    4268.         {
    4269.             TryChopUpUncompressedBigTiff(tif);
                      ^
    4270.         }
    4271. 

libtiff/tif_dirread.c:5900:10: Assignment
      5898. 
      5899.     /* Check that the strips are contiguous and of the expected size */
      5900.     for( i = 0; i < td->td_nstrips; i++ )
                     ^
      5901.     {
      5902.         if( i == td->td_nstrips - 1 )

libtiff/tif_dirread.c:5916:26: Call
      5914.                 return;
      5915.             }
      5916.             if( i > 0 && TIFFGetStrileOffset(tif, i) !=
                                     ^
      5917.                     TIFFGetStrileOffset(tif, i-1) + TIFFGetStrileByteCount(tif, i-1) )
      5918.             {

libtiff/tif_dirread.c:6233:1: Parameter `strile`
        6231. 
        6232. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
        6233. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
              ^
        6234. {
        6235.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);

libtiff/tif_dirread.c:6235:12: Call
        6233. uint64 TIFFGetStrileOffset(TIFF *tif, uint32 strile)
        6234. {
        6235.     return TIFFGetStrileOffsetWithErr(tif, strile, NULL);
                         ^
        6236. }
        6237. 

libtiff/tif_dirread.c:6239:1: Parameter `strile`
          6237. 
          6238. /* Return the value of the TileOffsets/StripOffsets array for the specified tile/strile */
          6239. uint64 TIFFGetStrileOffsetWithErr(TIFF *tif, uint32 strile, int *pbErr)
                ^
          6240. {
          6241.     TIFFDirectory *td = &tif->tif_dir;

libtiff/tif_dirread.c:6242:12: Call
          6240. {
          6241.     TIFFDirectory *td = &tif->tif_dir;
          6242.     return _TIFFGetStrileOffsetOrByteCountValue(tif, strile,
                           ^
          6243.                                &(td->td_stripoffset_entry),
          6244.                                &(td->td_stripoffset_p), pbErr);

libtiff/tif_dirread.c:6191:1: Parameter `strile`
            6189. }
            6190. 
            6191. static uint64 _TIFFGetStrileOffsetOrByteCountValue(TIFF *tif, uint32 strile,
                  ^
            6192.                                                    TIFFDirEntry* dirent,
            6193.                                                    uint64** parray,

libtiff/tif_dirread.c:6215:19: Call
            6213.         else
            6214.         {
            6215.              if( !_TIFFFetchStrileValue(tif, strile, dirent, parray) )
                                    ^
            6216.              {
            6217.                 if( pbErr )

libtiff/tif_dirread.c:6088:1: <Offset trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `strile`
              6086. }
              6087. 
              6088. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6089.                                  uint32 strile,
              6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: <Length trace>
6086. }
6087. 
6088. static int _TIFFFetchStrileValue(TIFF* tif,
      ^
6089.                                  uint32 strile,
6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6088:1: Parameter `**parray`
              6086. }
              6087. 
              6088. static int _TIFFFetchStrileValue(TIFF* tif,
                    ^
              6089.                                  uint32 strile,
              6090.                                  TIFFDirEntry* dirent,

libtiff/tif_dirread.c:6179:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetDirectory` 
              6177.         return 0;
              6178. 
              6179.     if( ~((*parray)[strile]) == 0 )
                             ^
              6180.     {
              6181.         if( !_TIFFPartialReadStripArray( tif, dirent, strile, *parray ) )
