LogLuvClose(TIFF* tif)
{
        LogLuvState* sp = (LogLuvState*) tif->tif_data;
	TIFFDirectory *td = &tif->tif_dir;

	assert(sp != 0);
	/*
	 * For consistency, we always want to write out the same
	 * bitspersample and sampleformat for our TIFF file,
	 * regardless of the data format being used by the application.
	 * Since this routine is called after tags have been set but
	 * before they have been recorded in the file, we reset them here.
         * Note: this is really a nasty approach. See PixarLogClose
	 */
        if( sp->encoder_state )
        {
            /* See PixarLogClose. Might avoid issues with tags whose size depends
             * on those below, but not completely sure this is enough. */
            td->td_samplesperpixel =
                (td->td_photometric == PHOTOMETRIC_LOGL) ? 1 : 3;
            td->td_bitspersample = 16;
            td->td_sampleformat = SAMPLEFORMAT_INT;
        }
}
The software reads data past the end, or before the beginning, of the intended buffer.