tools/tiffcrop.c:6962: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `update_output_file`.

tools/tiffcrop.c:6876:1: Parameter `(*out)->tif_dir.td_nstrips`
6874.   } /* end extractImageSection */
6875. 
6876. static int 
      ^
6877. writeSelections(TIFF *in, TIFF **out, struct crop_mask *crop, 
6878.                 struct image_data *image, struct dump_opts *dump,

tools/tiffcrop.c:6962:16: Call
6960.          for (i = 0; i < crop->selections; i++)
6961.            {
6962.            if (update_output_file (out, mp, autoindex, filename, page))
                     ^
6963.              return (1);
6964. 

tools/tiffcrop.c:2111:1: Parameter `(*tiffout)->tif_dir.td_nstrips`
  2109.  * so TIFFTAG PAGENUM will be correct in image.
  2110.  */
  2111. static int 
        ^
  2112. update_output_file (TIFF **tiffout, char *mode, int autoindex,
  2113.                     char *outname, unsigned int *page)

tools/tiffcrop.c:2124:5: Call
  2122.     {   
  2123.     /* Close any export file that was previously opened */
  2124.     TIFFClose (*tiffout);
            ^
  2125.     *tiffout = NULL;
  2126.     }

libtiff/tif_close.c:122:1: Parameter `tif->tif_dir.td_nstrips`
    120.  */
    121. 
    122. void
         ^
    123. TIFFClose(TIFF* tif)
    124. {

libtiff/tif_close.c:128:2: Call
    126. 	thandle_t fd = tif->tif_clientdata;
    127. 
    128. 	TIFFCleanup(tif);
          ^
    129. 	(void) (*closeproc)(fd);
    130. }

libtiff/tif_close.c:46:1: Parameter `tif->tif_dir.td_nstrips`
      44.  */
      45. 
      46. void
          ^
      47. TIFFCleanup(TIFF* tif)
      48. {

libtiff/tif_close.c:53:3: Call
      51.          */
      52. 	if (tif->tif_mode != O_RDONLY)
      53. 		TIFFFlush(tif);
            ^
      54. 	(*tif->tif_cleanup)(tif);
      55. 	TIFFFreeDirectory(tif);

libtiff/tif_flush.c:32:1: Parameter `tif->tif_dir.td_nstrips`
        30. #include "tiffiop.h"
        31. 
        32. int
            ^
        33. TIFFFlush(TIFF* tif)
        34. {

libtiff/tif_flush.c:38:10: Call
        36.         return 1;
        37. 
        38.     if (!TIFFFlushData(tif))
                     ^
        39.         return (0);
        40.                 

libtiff/tif_flush.c:98:1: Parameter `tif->tif_dir.td_nstrips`
           96.  * problems for other people. 
           97.  */
           98. int
               ^
           99. TIFFFlushData(TIFF* tif)
          100. {

libtiff/tif_flush.c:83:13: Call
        81. 
        82.     if ((tif->tif_flags & (TIFF_DIRTYDIRECT|TIFF_DIRTYSTRIP)) 
        83.         && !TIFFRewriteDirectory(tif))
                        ^
        84.         return (0);
        85. 

libtiff/tif_dirwrite.c:216:1: Parameter `tif->tif_dir.td_nstrips`
          214.  * previously used directory space. 
          215.  */ 
          216. int
               ^
          217. TIFFRewriteDirectory( TIFF *tif )
          218. {

libtiff/tif_dirwrite.c:223:10: Call
          221. 	/* We don't need to do anything special if it hasn't been written. */
          222. 	if( tif->tif_diroff == 0 )
          223. 		return TIFFWriteDirectory( tif );
                        ^
          224. 
          225. 	/*

libtiff/tif_dirwrite.c:180:1: Parameter `tif->tif_dir.td_nstrips`
            178.  * storage that's been changed.
            179.  */
            180. int
                 ^
            181. TIFFWriteDirectory(TIFF* tif)
            182. {

libtiff/tif_dirwrite.c:183:9: Call
            181. TIFFWriteDirectory(TIFF* tif)
            182. {
            183. 	return TIFFWriteDirectorySec(tif,TRUE,TRUE,NULL);
                         ^
            184. }
            185. 

libtiff/tif_dirwrite.c:362:1: Parameter `tif->tif_dir.td_nstrips`
              360. }
              361. 
              362. static int
                   ^
              363. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
              364. {

libtiff/tif_dirwrite.c:557:26: Call
              555.                     */
              556.                     if (tif->tif_dir.td_stripoffset != NULL &&
              557.                         !TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPOFFSETS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripoffset))
                                            ^
              558.                         goto bad;
              559. 				}

libtiff/tif_dirwrite.c:1601:1: Parameter `count`
                1599. /************************************************************************/
                1600. 
                1601. static int
                      ^
                1602. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
                1603. {

libtiff/tif_dirwrite.c:1628:9: Call
                1626.     */
                1627. 
                1628.     p = _TIFFmalloc(count*sizeof(uint32));
                              ^
                1629.     if (p==NULL)
                1630.     {

libtiff/tif_unix.c:314:17: Assignment
                  312. {
                  313.         if (s == 0)
                  314.                 return ((void *) NULL);
                                       ^
                  315. 
                  316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1628:5: Assignment
                1626.     */
                1627. 
                1628.     p = _TIFFmalloc(count*sizeof(uint32));
                          ^
                1629.     if (p==NULL)
                1630.     {

libtiff/tif_dirwrite.c:1647:7: Call
                1645.     }
                1646. 
                1647.     o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                            ^
                1648.     _TIFFfree(p);
                1649. 

libtiff/tif_dirwrite.c:2011:1: Parameter `*value`
                  2009. }
                  2010. 
                  2011. static int
                        ^
                  2012. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
                  2013. {

libtiff/tif_dirwrite.c:2017:3: Call
                  2015. 	assert(sizeof(uint32)==4);
                  2016. 	if (tif->tif_flags&TIFF_SWAB)
                  2017. 		TIFFSwabArrayOfLong(value,count);
                          ^
                  2018. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
                  2019. }

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
                    102. 
                    103. #ifndef TIFFSwabArrayOfLong
                    104. void
                         ^
                    105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
                    106. {

libtiff/tif_swab.c:112:3: Assignment
                    110. 	/* XXX unroll loop some */
                    111. 	while (n-- > 0) {
                    112. 		cp = (unsigned char *)lp;
                           ^
                    113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                    114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `update_output_file` 
                    111. 	while (n-- > 0) {
                    112. 		cp = (unsigned char *)lp;
                    113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                               ^
                    114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
                    115. 		lp++;
