I have one PCD (Kodak PhotoCD) file which crashes PHP when I run iptcparse on its contents.

The error message is "FATAL:  emalloc():  Unable to allocate -4095 bytes".

Unfortunately, I wasn't able to produce a core file (probably too dumb to configure with --enable-debug). PHP was configured "plain" (just "./configure", "make", "make install").

I can reproduce this crash with PHP 4.0.2-dev and 3.0.13-dev (error message here: "FATAL:  emalloc():  Unable to allocate 4294963201 bytes") under Solaris, and with an older PHP 4 under RedHat Linux 6.2.

Hundreds of other PCD files work fine, some of them bigger than my example file.

You can download this PCD file from http://www.digicol.de/crash.html (it's nearly 5 MB).

This is how you can reproduce the crash:
==============================================
[tim@dhcp5 tim]$ ll
insgesamt 7896
-rw-rw-r--    1 tim      tim       4898816 Jun 22 11:48 crash.pcd
-rw-rw-r--    1 tim      tim           510 Jun 22 12:06 iptcparse-crash.php
[tim@dhcp5 tim]$ cat iptcparse-crash.php
<?php

if (! isset($argv[ 1 ]))
  { echo "Usage: php iptcparse-crash.php <filename>\n";
        exit;
  }

$filename = $argv[ 1 ];

$buffer = "";

getimagesize($filename,&$info);

if (isset($info[ "APP13" ]))
  $buffer = $info[ "APP13" ];
else
  { $fp = fopen($filename,"r");
        if ($fp)
          { $buffer = fread($fp,filesize($filename));
                fclose($fp);
          }
  }

$ok = 0;

if ($buffer != "")
  { echo "before iptcparse() ...\n";
        $iptc = iptcparse($buffer);
        echo "... after iptcparse()\n";
  }

?>
[tim@dhcp5 tim]$ php -v
4.0.6
[tim@dhcp5 tim]$ php -q iptcparse-crash.php crash.pcd
before iptcparse() ...
FATAL:  emalloc():  Unable to allocate -4095 bytes
==============================================