tools/tiffdump.c:498: error: Buffer Overrun L3
  Offset: [8, +oo] Size: [0, +oo] by call to `PrintData`.

tools/tiffdump.c:290:3: Assignment
288. 		if (swabflag)
289. 			TIFFSwabShort(&dircount);
290. 		direntrysize = 12;
       ^
291. 	} else {
292. 		uint64 dircount64 = 0;

tools/tiffdump.c:306:11: Call
304. 		direntrysize = 20;
305. 	}
306. 	dirmem = _TIFFmalloc(dircount * direntrysize);
               ^
307. 	if (dirmem == NULL) {
308. 		Fatal("No space for TIFF directory");

libtiff/tif_unix.c:257:1: Parameter `s`
  255. #endif
  256. 
  257. void*
       ^
  258. _TIFFmalloc(tmsize_t s)
  259. {

libtiff/tif_unix.c:260:10: Array declaration
  258. _TIFFmalloc(tmsize_t s)
  259. {
  260. 	return (malloc((size_t) s));
                ^
  261. }
  262. 

libtiff/tif_unix.c:260:2: Assignment
  258. _TIFFmalloc(tmsize_t s)
  259. {
  260. 	return (malloc((size_t) s));
        ^
  261. }
  262. 

tools/tiffdump.c:306:2: Assignment
304. 		direntrysize = 20;
305. 	}
306. 	dirmem = _TIFFmalloc(dircount * direntrysize);
      ^
307. 	if (dirmem == NULL) {
308. 		Fatal("No space for TIFF directory");

tools/tiffdump.c:348:7: Assignment
346. 	    (unsigned long long)nextdiroff, (unsigned long long)nextdiroff);
347. #endif
348. 	for (dp = (uint8*)dirmem, n = dircount; n > 0; n--) {
           ^
349. 		uint16 tag;
350. 		uint16 type;

tools/tiffdump.c:361:3: Assignment
359. 		if (swabflag)
360. 			TIFFSwabShort(&tag);
361. 		dp += sizeof(uint16);
       ^
362. 		type = *(uint16*)dp;
363. 		dp += sizeof(uint16);

tools/tiffdump.c:363:3: Assignment
361. 		dp += sizeof(uint16);
362. 		type = *(uint16*)dp;
363. 		dp += sizeof(uint16);
       ^
364. 		if (swabflag)
365. 			TIFFSwabShort(&type);

tools/tiffdump.c:376:4: Assignment
374. 			if (swabflag)
375. 				TIFFSwabLong(&count32);
376. 			dp += sizeof(uint32);
        ^
377. 			count = count32;
378. 		}

tools/tiffdump.c:397:3: Assignment
395. 		datasize = count*typewidth;
396. 		datafits = 1;
397. 		datamem = dp;
       ^
398. 		dataoffset = 0;
399. 		datatruncated = 0;

tools/tiffdump.c:498:4: Call
496. 				}
497. 			}
498. 			PrintData(stdout,type,(uint32)count,datamem);
        ^
499. 			if (datatruncated)
500. 				printf(" ...");

tools/tiffdump.c:680:1: Parameter `*data`
  678. }
  679. 
  680. static void
       ^
  681. PrintData(FILE* fd, uint16 type, uint32 count, unsigned char* data)
  682. {

tools/tiffdump.c:699:3: Call
  697. 		break;
  698. 	case TIFF_ASCII:
  699. 		PrintASCII(fd, count, data);
         ^
  700. 		break;
  701. 	case TIFF_SHORT: {

tools/tiffdump.c:658:1: <Length trace>
656. #include <ctype.h>
657. 
658. static void
     ^
659. PrintASCII(FILE* fd, uint32 cc, const unsigned char* cp)
660. {

tools/tiffdump.c:658:1: Parameter `*cp`
    656. #include <ctype.h>
    657. 
    658. static void
         ^
    659. PrintASCII(FILE* fd, uint32 cc, const unsigned char* cp)
    660. {

tools/tiffdump.c:664:7: Array access: Offset: [8, +oo] Size: [0, +oo] by call to `PrintData` 
    662. 		const char* tp;
    663. 
    664. 		if (isprint(*cp)) {
               ^
    665. 			fputc(*cp, fd);
    666. 			continue;
