PixarLogClose(TIFF* tif)
{
        PixarLogState* sp = (PixarLogState*) tif->tif_data;
	TIFFDirectory *td = &tif->tif_dir;

	assert(sp != 0);
	/* In a really sneaky (and really incorrect, and untruthful, and
	 * troublesome, and error-prone) maneuver that completely goes against
	 * the spirit of TIFF, and breaks TIFF, on close, we covertly
	 * modify both bitspersample and sampleformat in the directory to
	 * indicate 8-bit linear.  This way, the decode "just works" even for
	 * readers that don't know about PixarLog, or how to set
	 * the PIXARLOGDATFMT pseudo-tag.
	 */

        if (sp->state&PLSTATE_INIT) {
            /* We test the state to avoid an issue such as in
             * http://bugzilla.maptools.org/show_bug.cgi?id=2604
             * What appends in that case is that the bitspersample is 1 and
             * a TransferFunction is set. The size of the TransferFunction
             * depends on 1<<bitspersample. So if we increase it, an access
             * out of the buffer will happen at directory flushing.
             * Another option would be to clear those targs. 
             */
            td->td_bitspersample = 8;
            td->td_sampleformat = SAMPLEFORMAT_UINT;
        }
}
The software reads data past the end, or before the beginning, of the intended buffer.