libtiff/tif_dirwrite.c:1833: error: Buffer Overrun L3
  Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray`.

libtiff/tif_dirwrite.c:1809:3: Assignment
1807. 	 */
1808. 	if (n>3)
1809. 		n=3;
        ^
1810. 	if (n==3)
1811. 	{

libtiff/tif_dirwrite.c:1822:4: Call
1820. 	if (n==0)
1821. 		n=1;
1822. 	o=_TIFFmalloc(n*m*sizeof(uint16));
         ^
1823. 	if (o==NULL)
1824. 	{

libtiff/tif_unix.c:261:17: Assignment
  259. {
  260.         if (s == 0)
  261.                 return ((void *) NULL);
                       ^
  262. 
  263. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:1822:2: Assignment
1820. 	if (n==0)
1821. 		n=1;
1822. 	o=_TIFFmalloc(n*m*sizeof(uint16));
       ^
1823. 	if (o==NULL)
1824. 	{

libtiff/tif_dirwrite.c:1833:4: Call
1831. 	if (n>2)
1832. 		_TIFFmemcpy(&o[2*m],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16));
1833. 	p=TIFFWriteDirectoryTagCheckedShortArray(tif,ndir,dir,TIFFTAG_TRANSFERFUNCTION,n*m,o);
         ^
1834. 	_TIFFfree(o);
1835. 	return(p);

libtiff/tif_dirwrite.c:1953:1: Parameter `*value`
  1951. }
  1952. 
  1953. static int
        ^
  1954. TIFFWriteDirectoryTagCheckedShortArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, uint16* value)
  1955. {

libtiff/tif_dirwrite.c:1959:3: Call
  1957. 	assert(sizeof(uint16)==2);
  1958. 	if (tif->tif_flags&TIFF_SWAB)
  1959. 		TIFFSwabArrayOfShort(value,count);
          ^
  1960. 	return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_SHORT,count,count*2,value));
  1961. }

libtiff/tif_swab.c:72:1: <Length trace>
70. 
71. #ifndef TIFFSwabArrayOfShort
72. void
    ^
73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
74. {

libtiff/tif_swab.c:72:1: Parameter `*wp`
    70. 
    71. #ifndef TIFFSwabArrayOfShort
    72. void
        ^
    73. TIFFSwabArrayOfShort(register uint16* wp, tmsize_t n)
    74. {

libtiff/tif_swab.c:80:3: Assignment
    78. 	/* XXX unroll loop some */
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
          ^
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
    82. 		wp++;

libtiff/tif_swab.c:81:7: Array access: Offset: [1, +oo] (⇐ [0, +oo] + 1) Size: [0, +oo] by call to `TIFFWriteDirectoryTagCheckedShortArray` 
    79. 	while (n-- > 0) {
    80. 		cp = (unsigned char*) wp;
    81. 		t = cp[1]; cp[1] = cp[0]; cp[0] = t;
              ^
    82. 		wp++;
    83. 	}
