contrib/addtiffo/tif_overview.c:152: error: Buffer Overrun L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory`.

contrib/addtiffo/tif_overview.c:149:9: Call
147. /*      Write directory, and return byte offset.                        */
148. /* -------------------------------------------------------------------- */
149.     if( TIFFWriteCheck( hTIFF, bTiled, "TIFFBuildOverviews" ) == 0 )
             ^
150.         return 0;
151. 

libtiff/tif_write.c:564:1: Parameter `*tif->tif_dir.td_stripbytecount`
  562.  * that important information is not changed.
  563.  */
  564. int
       ^
  565. TIFFWriteCheck(TIFF* tif, int tiles, const char* module)
  566. {

contrib/addtiffo/tif_overview.c:152:5: Call
150.         return 0;
151. 
152.     TIFFWriteDirectory( hTIFF );
         ^
153.     iNumDir = TIFFNumberOfDirectories(hTIFF);
154.     if( iNumDir > TIFF_DIR_MAX )

libtiff/tif_dirwrite.c:179:1: Parameter `*tif->tif_dir.td_stripbytecount`
  177.  * storage that's been changed.
  178.  */
  179. int
       ^
  180. TIFFWriteDirectory(TIFF* tif)
  181. {

libtiff/tif_dirwrite.c:182:9: Call
  180. TIFFWriteDirectory(TIFF* tif)
  181. {
  182. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
               ^
  183. }
  184. 

libtiff/tif_dirwrite.c:361:1: Parameter `*tif->tif_dir.td_stripbytecount`
    359. }
    360. 
    361. static int
         ^
    362. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
    363. {

libtiff/tif_dirwrite.c:531:11: Call
    529. 				if (!isTiled(tif))
    530. 				{
    531. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount))
                   ^
    532. 						goto bad;
    533. 				}

libtiff/tif_dirwrite.c:1668:1: Parameter `*value`
      1666. /************************************************************************/
      1667. 
      1668. static int
            ^
      1669. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
      1670. {

libtiff/tif_dirwrite.c:1687:16: Call
      1685.     /* We always write LONG8 for BigTIFF, no checking needed. */
      1686.     if( tif->tif_flags&TIFF_BIGTIFF )
      1687.         return TIFFWriteDirectoryTagCheckedLong8Array(tif,ndir,dir,
                           ^
      1688.                                                       tag,count,value);
      1689. 

libtiff/tif_dirwrite.c:2135:1: Parameter `*value`
        2133. #endif
        2134. 
        2135. static int
              ^
        2136. TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
        2137. {

libtiff/tif_dirwrite.c:2145:3: Call
        2143. 	}
        2144. 	if (tif->tif_flags&TIFF_SWAB)
        2145. 		TIFFSwabArrayOfLong8(value,count);
                ^
        2146. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
        2147. }

libtiff/tif_swab.c:119:1: <Length trace>
117. 
118. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
119. void
     ^
120. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
121. {

libtiff/tif_swab.c:119:1: Parameter `*lp`
          117. 
          118. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong8)
          119. void
               ^
          120. TIFFSwabArrayOfLong8(register uint64* lp, tmsize_t n)
          121. {

libtiff/tif_swab.c:127:3: Assignment
          125. 	/* XXX unroll loop some */
          126. 	while (n-- > 0) {
          127. 		cp = (unsigned char *)lp;
                 ^
          128. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
          129. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:128:7: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `TIFFWriteDirectory` 
          126. 	while (n-- > 0) {
          127. 		cp = (unsigned char *)lp;
          128. 		t = cp[7]; cp[7] = cp[0]; cp[0] = t;
                     ^
          129. 		t = cp[6]; cp[6] = cp[1]; cp[1] = t;
          130. 		t = cp[5]; cp[5] = cp[2]; cp[2] = t;
