libtiff/tif_dirwrite.c:741: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray`.

libtiff/tif_dirwrite.c:697:25: Assignment
695. 		{
696.                         uint16 tag = (uint16)tif->tif_dir.td_customValues[m].info->field_tag;
697.                         uint32 count = tif->tif_dir.td_customValues[m].count;
                             ^
698. 			switch (tif->tif_dir.td_customValues[m].info->field_type)
699. 			{

libtiff/tif_dirwrite.c:741:11: Call
739. 					break;
740. 				case TIFF_RATIONAL:
741. 					if (!TIFFWriteDirectoryTagRationalArray(tif,&ndir,dir,tag,count,tif->tif_dir.td_customValues[m].value))
               ^
742. 						goto bad;
743. 					break;

libtiff/tif_dirwrite.c:1424:1: Parameter `count`
  1422. }
  1423. 
  1424. static int
        ^
  1425. TIFFWriteDirectoryTagRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
  1426. {

libtiff/tif_dirwrite.c:1432:9: Call
  1430. 		return(1);
  1431. 	}
  1432. 	return(TIFFWriteDirectoryTagCheckedRationalArray(tif,ndir,dir,tag,count,value));
                ^
  1433. }
  1434. 

libtiff/tif_dirwrite.c:2116:1: Parameter `count`
    2114. }
    2115. 
    2116. static int
          ^
    2117. TIFFWriteDirectoryTagCheckedRationalArray(TIFF* tif, uint32* ndir, TIFFDirEntry* dir, uint16 tag, uint32 count, float* value)
    2118. {

libtiff/tif_dirwrite.c:2126:4: Call
    2124. 	int o;
    2125. 	assert(sizeof(uint32)==4);
    2126. 	m=_TIFFmalloc(count*2*sizeof(uint32));
             ^
    2127. 	if (m==NULL)
    2128. 	{

libtiff/tif_unix.c:314:17: Assignment
      312. {
      313.         if (s == 0)
      314.                 return ((void *) NULL);
                           ^
      315. 
      316. 	return (malloc((size_t) s));

libtiff/tif_dirwrite.c:2126:2: Assignment
    2124. 	int o;
    2125. 	assert(sizeof(uint32)==4);
    2126. 	m=_TIFFmalloc(count*2*sizeof(uint32));
           ^
    2127. 	if (m==NULL)
    2128. 	{

libtiff/tif_dirwrite.c:2156:3: Call
    2154. 	}
    2155. 	if (tif->tif_flags&TIFF_SWAB)
    2156. 		TIFFSwabArrayOfLong(m,count*2);
            ^
    2157. 	o=TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_RATIONAL,count,count*8,&m[0]);
    2158. 	_TIFFfree(m);

libtiff/tif_swab.c:104:1: <Length trace>
102. 
103. #ifndef TIFFSwabArrayOfLong
104. void
     ^
105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
106. {

libtiff/tif_swab.c:104:1: Parameter `*lp`
      102. 
      103. #ifndef TIFFSwabArrayOfLong
      104. void
           ^
      105. TIFFSwabArrayOfLong(register uint32* lp, tmsize_t n)
      106. {

libtiff/tif_swab.c:112:3: Assignment
      110. 	/* XXX unroll loop some */
      111. 	while (n-- > 0) {
      112. 		cp = (unsigned char *)lp;
             ^
      113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
      114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;

libtiff/tif_swab.c:113:7: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `TIFFWriteDirectoryTagRationalArray` 
      111. 	while (n-- > 0) {
      112. 		cp = (unsigned char *)lp;
      113. 		t = cp[3]; cp[3] = cp[0]; cp[0] = t;
                 ^
      114. 		t = cp[2]; cp[2] = cp[1]; cp[1] = t;
      115. 		lp++;
