libtiff/tif_dirread.c:5144: error: Buffer Overrun S2
  Offset: [-1+max(1, `dp->tdir_count`), -1+min(65535, `dp->tdir_count`)] Size: [0, +oo].

libtiff/tif_dirread.c:4853:1: <Offset trace>
4851.  * Fetch a tag that is not handled by special case code.
4852.  */
4853. static int
      ^
4854. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4855. {

libtiff/tif_dirread.c:4853:1: Parameter `dp->tdir_count`
4851.  * Fetch a tag that is not handled by special case code.
4852.  */
4853. static int
      ^
4854. TIFFFetchNormalTag(TIFF* tif, TIFFDirEntry* dp, int recover)
4855. {

libtiff/tif_dirread.c:5140:10: Call
5138. 				else
5139. 				{
5140. 					err=TIFFReadDirEntryByteArray(tif,dp,&data);
               ^
5141. 					if (err==TIFFReadDirEntryErrOk)
5142. 					{

libtiff/tif_dirread.c:932:1: Parameter `direntry->tdir_count`
  930. }
  931. 
  932. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  933. {
  934. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5140:10: <Length trace>
5138. 				else
5139. 				{
5140. 					err=TIFFReadDirEntryByteArray(tif,dp,&data);
               ^
5141. 					if (err==TIFFReadDirEntryErrOk)
5142. 					{

libtiff/tif_dirread.c:5140:10: Call
5138. 				else
5139. 				{
5140. 					err=TIFFReadDirEntryByteArray(tif,dp,&data);
               ^
5141. 					if (err==TIFFReadDirEntryErrOk)
5142. 					{

libtiff/tif_dirread.c:932:1: Parameter `**value`
  930. }
  931. 
  932. static enum TIFFReadDirEntryErr TIFFReadDirEntryByteArray(TIFF* tif, TIFFDirEntry* direntry, uint8** value)
       ^
  933. {
  934. 	enum TIFFReadDirEntryErr err;

libtiff/tif_dirread.c:5144:51: Array access: Offset: [-1+max(1, dp->tdir_count), -1+min(65535, dp->tdir_count)] Size: [0, +oo]
5142. 					{
5143. 						int m;
5144.                         if( dp->tdir_count > 0 && data[dp->tdir_count-1] != '\0' )
                                                        ^
5145.                         {
5146.                             TIFFWarningExt(tif->tif_clientdata,module,"ASCII value for tag \"%s\" does not end in null byte. Forcing it to be null",fip->field_name);
