tools/tiffcrop.c:6628: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `update_output_file`.

tools/tiffcrop.c:6542:1: Parameter `(*out)->tif_dir.td_samplesperpixel`
6540.   } /* end extractImageSection */
6541. 
6542. static int 
      ^
6543. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6544.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6628:16: Call
6626.          for (i = 0; i < crop->selections; i++)
6627.            {
6628.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6629.              return (1);
6630. 

tools/tiffcrop.c:2027:1: Parameter `(*tiffout)->tif_dir.td_samplesperpixel`
  2025.  * so TIFFTAG PAGENUM will be correct in image.
  2026.  */
  2027. static int 
        ^
  2028. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2029.                     char *outname, unsigned int *page)

tools/tiffcrop.c:2041:5: Call
  2039.     {   
  2040.     /* Close any export file that was previously opened */
  2041.     TIFFClose (*tiffout);
            ^
  2042.     *tiffout = NULL;
  2043.     }

libtiff/tif_close.c:122:1: Parameter `tif->tif_dir.td_samplesperpixel`
    120.  */
    121. 
    122. void
         ^
    123. TIFFClose(TIFF* tif)
    124. {

libtiff/tif_close.c:128:2: Call
    126. 	thandle_t fd = tif->tif_clientdata;
    127. 
    128. 	TIFFCleanup(tif);
          ^
    129. 	(void) (*closeproc)(fd);
    130. }

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_samplesperpixel`
      44.  */
      45. 
      46. void
          ^
      47. TIFFCleanup(TIFF* tif)
      48. {

libtiff/tif_close.c:53:3: Call
      51.          */
      52. 	if (tif->tif_mode != O_RDONLY)
      53. 		TIFFFlush(tif);
            ^
      54. 	(*tif->tif_cleanup)(tif);
      55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_samplesperpixel`
        30. #include "tiffiop.h"
        31. 
        32. int
            ^
        33. TIFFFlush(TIFF* tif)
        34. {

libtiff/tif_flush.c:83:13: Call
        81. 
        82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
        83.         && !TIFFRewriteDirectory(tif))
                        ^
        84.         return (0);
        85. 

libtiff/tif_dirwrite.c:199:1: Parameter `tif->tif_dir.td_samplesperpixel`
          197.  * previously used directory space. 
          198.  */ 
          199. int
               ^
          200. TIFFRewriteDirectory( TIFF *tif )
          201. {

libtiff/tif_dirwrite.c:206:10: Call
          204. 	/* We don't need to do anything special if it hasn't been written. */
          205. 	if( tif->tif_diroff == 0 )
          206. 		return TIFFWriteDirectory( tif );
                        ^
          207. 
          208. 	/*

libtiff/tif_dirwrite.c:163:1: Parameter `tif->tif_dir.td_samplesperpixel`
            161.  * storage that's been changed.
            162.  */
            163. int
                 ^
            164. TIFFWriteDirectory(TIFF* tif)
            165. {

libtiff/tif_dirwrite.c:166:9: Call
            164. TIFFWriteDirectory(TIFF* tif)
            165. {
            166. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                         ^
            167. }
            168. 

libtiff/tif_dirwrite.c:345:1: Parameter `tif->tif_dir.td_samplesperpixel`
              343. }
              344. 
              345. static int
                   ^
              346. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
              347. {

libtiff/tif_dirwrite.c:557:10: Call
              555. 			if (TIFFFieldSet(tif,FIELD_SMINSAMPLEVALUE))
              556. 			{
              557. 				if (!TIFFWriteDirectoryTagSampleformatPerSample(tif,&ndir,dir,TIFFTAG_SMINSAMPLEVALUE,tif->tif_dir.td_sminsamplevalue))
                            ^
              558. 					goto bad;
              559. 			}

libtiff/tif_dirwrite.c:903:1: Parameter `tif->tif_dir.td_samplesperpixel`
                901. }
                902. 
                903. static int
                     ^
                904. TIFFWriteDirectoryTagSampleformatPerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                905. {

libtiff/tif_dirwrite.c:912:12: Call
                910. 				return(TIFFWriteDirectoryTagFloatPerSample(tif,ndir,dir,tag,(float)value));
                911. 			else
                912. 				return(TIFFWriteDirectoryTagDoublePerSample(tif,ndir,dir,tag,value));
                                ^
                913. 		case SAMPLEFORMAT_INT:
                914. 			if (tif->tif_dir.td_bitspersample<=8)

libtiff/tif_dirwrite.c:1400:1: Parameter `tif->tif_dir.td_samplesperpixel`
                  1398. }
                  1399. 
                  1400. static int TIFFWriteDirectoryTagDoublePerSample(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, double value)
                        ^
                  1401. {
                  1402. 	static const char module[] = "TIFFWriteDirectoryTagDoublePerSample";

libtiff/tif_dirwrite.c:1412:4: Call
                  1410. 		return(1);
                  1411. 	}
                  1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                           ^
                  1413. 	if (m==NULL)
                  1414. 	{

libtiff/tif_unix.c:253:1: Parameter `s`
                    251. #endif
                    252. 
                    253. void*
                         ^
                    254. _TIFFmalloc(tmsize_t s)
                    255. {

libtiff/tif_unix.c:256:10: Array declaration
                    254. _TIFFmalloc(tmsize_t s)
                    255. {
                    256. 	return (malloc((size_t) s));
                                  ^
                    257. }
                    258. 

libtiff/tif_unix.c:256:2: Assignment
                    254. _TIFFmalloc(tmsize_t s)
                    255. {
                    256. 	return (malloc((size_t) s));
                          ^
                    257. }
                    258. 

libtiff/tif_dirwrite.c:1412:2: Assignment
                  1410. 		return(1);
                  1411. 	}
                  1412. 	m=_TIFFmalloc(tif->tif_dir.td_samplesperpixel*sizeof(double));
                         ^
                  1413. 	if (m==NULL)
                  1414. 	{

libtiff/tif_dirwrite.c:1420:4: Call
                  1418. 	for (na=m, nb=0; nb<tif->tif_dir.td_samplesperpixel; na++, nb++)
                  1419. 		*na=value;
                  1420. 	o=TIFFWriteDirectoryTagCheckedDoubleArray(tif,ndir,dir,tag,tif->tif_dir.td_samplesperpixel,m);
                           ^
                  1421. 	_TIFFfree(m);
                  1422. 	return(o);

libtiff/tif_dirwrite.c:2144:1: Parameter `*value`
                    2142. #endif
                    2143. 
                    2144. static int
                          ^
                    2145. TIFFWriteDirectoryTagCheckedDoubleArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, double* value)
                    2146. {

libtiff/tif_dirwrite.c:2151:3: Call
                    2149. 	TIFFCvtNativeToIEEEDouble(tif,count,&value);
                    2150. 	if (tif->tif_flags&TIFF_SWAB)
                    2151. 		TIFFSwabArrayOfDouble(value,count);
                            ^
                    2152. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_DOUBLE,count,count*8,value));
                    2153. }

libtiff/tif_swab.c:183:1: <Length trace>
181. 
182. #ifndef TIFFSwabArrayOfDouble
183. void
     ^
184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
185. {

libtiff/tif_swab.c:183:1: Parameter `*dp`
                      181. 
                      182. #ifndef TIFFSwabArrayOfDouble
                      183. void
                           ^
                      184. TIFFSwabArrayOfDouble(double* dp, tmsize_t n)
                      185. {

libtiff/tif_swab.c:191:3: Assignment
                      189. 	/* XXX unroll loop some */
                      190. 	while (n-- > 0) {
                      191. 		cp = (unsigned char *)dp;
                             ^
                      192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                      193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:192:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `update_output_file` 
                      190. 	while (n-- > 0) {
                      191. 		cp = (unsigned char *)dp;
                      192. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                                 ^
                      193. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
                      194. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
