tools/tiffsplit.c:92: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory`.

tools/tiffsplit.c:89:9: Call
87. 			if (out == NULL)
88. 				return (-2);
89. 			if (!tiffcp(in, out))
            ^
90. 				return (-1);
91. 			TIFFClose(out);

tools/tiffsplit.c:157:1: Parameter `out->tif_dir.td_stripoffset`
  155. }
  156. 
  157. static int
       ^
  158. tiffcp(TIFF* in, TIFF* out)
  159. {

tools/tiffsplit.c:225:11: Call
  223. 	CopyField(TIFFTAG_FAXDCS, stringv);
  224. 	if (TIFFIsTiled(in))
  225. 		return (cpTiles(in, out));
                 ^
  226. 	else
  227. 		return (cpStrips(in, out));

tools/tiffsplit.c:263:1: Parameter `out->tif_dir.td_stripoffset`
    261. }
    262. 
    263. static int
         ^
    264. cpTiles(TIFF* in, TIFF* out)
    265. {

tools/tiffsplit.c:92:12: Call
90. 				return (-1);
91. 			TIFFClose(out);
92. 		} while (TIFFReadDirectory(in));
               ^
93. 		(void) TIFFClose(in);
94. 	}

libtiff/tif_dirread.c:3996:8: <Offset trace>
3994. 
3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3996:8: Assignment
  3994. 
  3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
  3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
               ^
  3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
  3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3417:1: <Length trace>
3415.  * format. We read directories sequentially.
3416.  */
3417. int
      ^
3418. TIFFReadDirectory(TIFF* tif)
3419. {

libtiff/tif_dirread.c:3417:1: Parameter `*tif->tif_dir.td_stripoffset`
  3415.  * format. We read directories sequentially.
  3416.  */
  3417. int
        ^
  3418. TIFFReadDirectory(TIFF* tif)
  3419. {

libtiff/tif_dirread.c:3459:2: Call
  3457. 	tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
  3458. 	/* free any old stuff and reinit */
  3459. 	TIFFFreeDirectory(tif);
         ^
  3460. 	TIFFDefaultDirectory(tif);
  3461. 	/*

libtiff/tif_dir.c:1136:1: Parameter `*tif->tif_dir.td_stripoffset`
    1134.  * Release storage associated with a directory.
    1135.  */
    1136. void
          ^
    1137. TIFFFreeDirectory(TIFF* tif)
    1138. {

libtiff/tif_dirread.c:3998:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFReadDirectory` 
  3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
  3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
  3998. 			    tif->tif_dir.td_stripoffset[strip]) {
               ^
  3999. 				tif->tif_dir.td_stripbytecountsorted = 0;
  4000. 				break;
