diff --git a/src/file_jpg.c b/src/file_jpg.c
index e7dd47fd..cb25828c 100644
--- a/src/file_jpg.c
+++ b/src/file_jpg.c
@@ -1493,20 +1493,18 @@ static uint64_t jpg_check_structure(file_recovery_t *file_recovery, const unsign
 	if(i+0x0A < nbytes && 2+size > 0x0A)
 	{
 	  const char *potential_error=NULL;
-	  const TIFFHeader *tiff=(const TIFFHeader*)&buffer[i+0x0A];
 	  const unsigned char *tiff_buffer=&buffer[i+0x0A];
 	  unsigned int tiff_size=2+size-0x0A;
-	  const char *thumb_data=NULL;
-	  const char *ifbytecount=NULL;
+	  unsigned int thumb_size=0;
 	  if(nbytes - (i+0x0A) < tiff_size)
 	    tiff_size=nbytes - (i+0x0A);
 	  if(file_recovery->time==0)
 	    file_recovery->time=get_date_from_tiff_header(tiff_buffer, tiff_size);
-	  thumb_data=find_tag_from_tiff_header(tiff, tiff_size, TIFFTAG_JPEGIFOFFSET, &potential_error);
-	  if(thumb_data!=NULL)
+	  thumb_offset=find_tag_from_tiff_header(tiff_buffer, tiff_size, TIFFTAG_JPEGIFOFFSET, &potential_error);
+	  if(thumb_offset!=0)
 	  {
-	    thumb_offset=thumb_data-(const char*)buffer;
-	    ifbytecount=find_tag_from_tiff_header(tiff, tiff_size, TIFFTAG_JPEGIFBYTECOUNT, &potential_error);
+	    thumb_offset+=i+0x0A;
+	    thumb_size=find_tag_from_tiff_header(tiff_buffer, tiff_size, TIFFTAG_JPEGIFBYTECOUNT, &potential_error);
 	  }
 	  if(potential_error!=NULL)
 	  {
@@ -1515,9 +1513,8 @@ static uint64_t jpg_check_structure(file_recovery_t *file_recovery, const unsign
 	  }
 	  if(file_recovery->offset_ok<i)
 	    file_recovery->offset_ok=i;
-	  if(thumb_data!=NULL && ifbytecount!=NULL)
+	  if(thumb_offset!=0 && thumb_size!=0)
 	  {
-	    const unsigned int thumb_size=ifbytecount-(const char*)tiff;
 	    if(thumb_offset < nbytes - 1)
 	    {
 	      unsigned int j=thumb_offset+2;
@@ -1606,7 +1603,7 @@ static uint64_t jpg_check_structure(file_recovery_t *file_recovery, const unsign
 		  *(sep+1)='t';
 		  if((out=fopen(thumbname,"wb"))!=NULL)
 		  {
-		    if(fwrite(thumb_data, thumb_size, 1, out) < 1)
+		    if(fwrite(&buffer[thumb_offset], thumb_size, 1, out) < 1)
 		    {
 		      log_error("Can't write to %s: %s\n", thumbname, strerror(errno));
 		    }
diff --git a/src/file_tiff.c b/src/file_tiff.c
index 33c7786b..346dc089 100644
--- a/src/file_tiff.c
+++ b/src/file_tiff.c
@@ -137,38 +137,49 @@ const char *tag_name(unsigned int tag)
 }
 #endif
 
-const char *find_tag_from_tiff_header(const TIFFHeader *tiff, const unsigned int tiff_size, const unsigned int tag, const char **potential_error)
+unsigned int find_tag_from_tiff_header(const unsigned char*buffer, const unsigned int buffer_size, const unsigned int tag, const char **potential_error)
 {
-  if(tiff_size < sizeof(TIFFHeader))
-    return NULL;
+  const TIFFHeader *tiff=(const TIFFHeader *)buffer;
+  if(buffer_size < sizeof(TIFFHeader))
+    return 0;
 #ifndef MAIN_tiff_le
   if(tiff->tiff_magic==TIFF_BIGENDIAN)
-    return find_tag_from_tiff_header_be(tiff, tiff_size, tag, potential_error);
+  {
+    const unsigned char *tmp=(const unsigned char *)find_tag_from_tiff_header_be(tiff, buffer_size, tag, potential_error);
+    if(tmp==NULL)
+      return 0;
+    return tmp-buffer;
+  }
 #endif
 #ifndef MAIN_tiff_be
   if(tiff->tiff_magic==TIFF_LITTLEENDIAN)
-    return find_tag_from_tiff_header_le(tiff, tiff_size, tag, potential_error);
+  {
+    const unsigned char *tmp=(const unsigned char *)find_tag_from_tiff_header_le(tiff, buffer_size, tag, potential_error);
+    if(tmp==NULL)
+      return 0;
+    return tmp-buffer;
+  }
 #endif
-  return NULL;
+  return 0;
 }
 
 time_t get_date_from_tiff_header(const unsigned char *buffer, const unsigned int buffer_size)
 {
   const char *potential_error=NULL;
-  const unsigned char *date_asc;
+  unsigned int date_asc;
   if(buffer_size < sizeof(TIFFHeader) || buffer_size < 19)
     return (time_t)0;
   /*@ assert buffer_size >= sizeof(TIFFHeader); */
   /* DateTimeOriginal */
-  date_asc=(const unsigned char *)find_tag_from_tiff_header((const TIFFHeader *)buffer, buffer_size, 0x9003, &potential_error);
+  date_asc=find_tag_from_tiff_header(buffer, buffer_size, 0x9003, &potential_error);
   /* DateTimeDigitalized*/
-  if(date_asc==NULL || date_asc < buffer || &date_asc[18] >= buffer + buffer_size)
-    date_asc=(const unsigned char *)find_tag_from_tiff_header((const TIFFHeader *)buffer, buffer_size, 0x9004, &potential_error);
-  if(date_asc==NULL || date_asc < buffer || &date_asc[18] >= buffer + buffer_size)
-    date_asc=(const unsigned char *)find_tag_from_tiff_header((const TIFFHeader *)buffer, buffer_size, 0x132, &potential_error);
-  if(date_asc==NULL || date_asc < buffer || &date_asc[18] >= buffer + buffer_size)
+  if(date_asc==0 || date_asc >=  buffer_size - 19)
+    date_asc=find_tag_from_tiff_header(buffer, buffer_size, 0x9004, &potential_error);
+  if(date_asc==0 || date_asc >=  buffer_size - 19)
+    date_asc=find_tag_from_tiff_header(buffer, buffer_size, 0x132, &potential_error);
+  if(date_asc==0 || date_asc >=  buffer_size - 19)
     return (time_t)0;
-  return get_time_from_YYYY_MM_DD_HH_MM_SS(date_asc);
+  return get_time_from_YYYY_MM_DD_HH_MM_SS(&buffer[date_asc]);
 }
 
 static void register_header_check_tiff(file_stat_t *file_stat)
diff --git a/src/file_tiff.h b/src/file_tiff.h
index 1882b6a9..3cd6a63f 100644
--- a/src/file_tiff.h
+++ b/src/file_tiff.h
@@ -69,16 +69,16 @@ struct ifd_header {
 } __attribute__ ((gcc_struct, __packed__));
 
 /*@
-  @ requires tiff_size >= sizeof(TIFFHeader);
+  @ requires buffer_size >= sizeof(TIFFHeader);
   @ requires \valid_read(buffer+(0..buffer_size-1));
   @*/
 time_t get_date_from_tiff_header(const unsigned char*buffer, const unsigned int buffer_size);
 
 /*@
-  @ requires \valid_read((const unsigned char *)tiff+(0..tiff_size-1));
-  @ requires \separated(potential_error, tiff);
+  @ requires \valid_read(buffer+(0..buffer_size-1));
+  @ requires \separated(potential_error, buffer);
   @*/
-const char *find_tag_from_tiff_header(const TIFFHeader *tiff, const unsigned int tiff_size, const unsigned int tag, const char **potential_error);
+unsigned int find_tag_from_tiff_header(const unsigned char *buffer, const unsigned int buffer_size, const unsigned int tag, const char **potential_error);
 
 #ifndef MAIN_tiff_be
 /*@