contrib/addtiffo/tif_ovrcache.c:256: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory`.

contrib/addtiffo/tif_ovrcache.c:232:5: Call
230. 				if ((iTileY+1)*psCache->nBlockYSize>psCache->nYSize)
231. 					RowsInStrip=psCache->nYSize-iTileY*psCache->nBlockYSize;
232. 				TIFFWriteEncodedStrip( psCache->hTIFF, nTileID,
         ^
233. 				    pabyData,
234. 				    TIFFVStripSize(psCache->hTIFF,RowsInStrip) );

libtiff/tif_write.c:183:1: Parameter `*tif->tif_dir.td_stripoffset`
  181.  * NB: Image length must be setup before writing.
  182.  */
  183. tmsize_t
       ^
  184. TIFFWriteEncodedStrip(TIFF* tif, uint32 strip, void* data, tmsize_t cc)
  185. {

contrib/addtiffo/tif_ovrcache.c:254:5: Call
252. /*      Restore access to original directory.                           */
253. /* -------------------------------------------------------------------- */
254.     TIFFFlush( psCache->hTIFF );
         ^
255.     /* TODO: add checks on error status return of TIFFFlush */
256.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );

libtiff/tif_flush.c:32:1: Parameter `*tif->tif_dir.td_stripoffset`
  30. #include "tiffiop.h"
  31. 
  32. int
      ^
  33. TIFFFlush(TIFF* tif)
  34. {

contrib/addtiffo/tif_ovrcache.c:256:5: Call
254.     TIFFFlush( psCache->hTIFF );
255.     /* TODO: add checks on error status return of TIFFFlush */
256.     TIFFSetSubDirectory( psCache->hTIFF, nBaseDirOffset );
         ^
257.     /* TODO: add checks on error status return of TIFFSetSubDirectory */
258. }

libtiff/tif_dir.c:1463:1: Parameter `*tif->tif_dir.td_stripoffset`
  1461.  * the SubIFD tag (e.g. thumbnail images).
  1462.  */
  1463. int
        ^
  1464. TIFFSetSubDirectory(TIFF* tif, uint64 diroff)
  1465. {

libtiff/tif_dir.c:1472:10: Call
  1470. 	 */
  1471. 	tif->tif_dirnumber = 0;
  1472. 	return (TIFFReadDirectory(tif));
                 ^
  1473. }
  1474. 

libtiff/tif_dirread.c:3996:8: <Offset trace>
3994. 
3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
             ^
3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3996:8: Assignment
    3994. 
    3995. 		tif->tif_dir.td_stripbytecountsorted = 1;
    3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
                 ^
    3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    3998. 			    tif->tif_dir.td_stripoffset[strip]) {

libtiff/tif_dirread.c:3417:1: <Length trace>
3415.  * format. We read directories sequentially.
3416.  */
3417. int
      ^
3418. TIFFReadDirectory(TIFF* tif)
3419. {

libtiff/tif_dirread.c:3417:1: Parameter `*tif->tif_dir.td_stripoffset`
    3415.  * format. We read directories sequentially.
    3416.  */
    3417. int
          ^
    3418. TIFFReadDirectory(TIFF* tif)
    3419. {

libtiff/tif_dirread.c:3459:2: Call
    3457. 	tif->tif_flags &= ~TIFF_BUF4WRITE;      /* reset before new dir */
    3458. 	/* free any old stuff and reinit */
    3459. 	TIFFFreeDirectory(tif);
           ^
    3460. 	TIFFDefaultDirectory(tif);
    3461. 	/*

libtiff/tif_dir.c:1136:1: Parameter `*tif->tif_dir.td_stripoffset`
      1134.  * Release storage associated with a directory.
      1135.  */
      1136. void
            ^
      1137. TIFFFreeDirectory(TIFF* tif)
      1138. {

libtiff/tif_dirread.c:3998:8: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `TIFFSetSubDirectory` 
    3996. 		for (strip = 1; strip < tif->tif_dir.td_nstrips; strip++) {
    3997. 			if (tif->tif_dir.td_stripoffset[strip - 1] >
    3998. 			    tif->tif_dir.td_stripoffset[strip]) {
                 ^
    3999. 				tif->tif_dir.td_stripbytecountsorted = 0;
    4000. 				break;
