libtiff/tif_dirwrite.c:257: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec`.

libtiff/tif_dirwrite.c:250:1: Parameter `tif->tif_dir.td_nstrips`
248.  * readable before it is successfully completed/closed.
249.  */
250. int
     ^
251. TIFFCheckpointDirectory(TIFF* tif)
252. {

libtiff/tif_dirwrite.c:257:7: Call
255. 	if (tif->tif_dir.td_stripoffset_p == NULL)
256. 	    (void) TIFFSetupStrips(tif);
257. 	rc = TIFFWriteDirectorySec(tif,TRUE,FALSE,NULL);
           ^
258. 	(void) TIFFSetWriteOffset(tif, TIFFSeekFile(tif, 0, SEEK_END));
259. 	return rc;

libtiff/tif_dirwrite.c:420:1: Parameter `tif->tif_dir.td_nstrips`
  418. }
  419. 
  420. static int
       ^
  421. TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
  422. {

libtiff/tif_dirwrite.c:590:11: Call
  588. 				if (!isTiled(tif))
  589. 				{
  590. 					if (!TIFFWriteDirectoryTagLongLong8Array(tif,&ndir,dir,TIFFTAG_STRIPBYTECOUNTS,tif->tif_dir.td_nstrips,tif->tif_dir.td_stripbytecount_p))
                 ^
  591. 						goto bad;
  592. 				}

libtiff/tif_dirwrite.c:1807:1: Parameter `count`
    1805. /************************************************************************/
    1806. 
    1807. static int
          ^
    1808. TIFFWriteDirectoryTagLongLong8Array(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
    1809. {

libtiff/tif_dirwrite.c:1865:21: Call
    1863.         */
    1864. 
    1865.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                              ^
    1866.         uint32* q;
    1867.         uint64* ma;

libtiff/tif_unix.c:312:17: Assignment
      310. {
      311.         if (s == 0)
      312.                 return ((void *) NULL);
                           ^
      313. 
      314. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1865:9: Assignment
    1863.         */
    1864. 
    1865.         uint32* p = _TIFFmalloc(count*sizeof(uint32));
                  ^
    1866.         uint32* q;
    1867.         uint64* ma;

libtiff/tif_dirwrite.c:1888:11: Call
    1886.         }
    1887. 
    1888.         o=TIFFWriteDirectoryTagCheckedLongArray(tif,ndir,dir,tag,count,p);
                    ^
    1889.         _TIFFfree(p);
    1890.     }

libtiff/tif_dirwrite.c:2291:1: Parameter `*value`
      2289. }
      2290. 
      2291. static int
            ^
      2292. TIFFWriteDirectoryTagCheckedLongArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint32* value)
      2293. {

libtiff/tif_dirwrite.c:2297:3: Call
      2295. 	assert(sizeof(uint32)==4);
      2296. 	if (tif->tif_flags&TIFF_SWAB)
      2297. 		TIFFSwabArrayOfLong(value,count);
              ^
      2298. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG,count,count*4,value));
      2299. }

libtiff/tif_swab.c:102:1: <Length trace>
100. 
101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
102. void
     ^
103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
104. {

libtiff/tif_swab.c:102:1: Parameter `*lp`
        100. 
        101. #if defined(DISABLE_CHECK_TIFFSWABMACROS) || !defined(TIFFSwabArrayOfLong)
        102. void
             ^
        103. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
        104. {

libtiff/tif_swab.c:110:3: Assignment
        108. 	/* XXX unroll loop some */
        109. 	while (n-- > 0) {
        110. 		cp = (unsigned char *)lp;
               ^
        111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
        112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:111:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectorySec` 
        109. 	while (n-- > 0) {
        110. 		cp = (unsigned char *)lp;
        111. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                   ^
        112. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
        113. 		lp++;
