Reproducable PNG Save Crash (CS2)

Question

PhotoShop fails to save PNG image - subsequent attempts to save write 0 byte files without error message. This has reproduced on two unrelated machines so far (it was reported to me by a friend, I tried his image, confirmed it, then tried to come up with a minimal reproduction.) This is pretty straightforward - create a blank image, 8-bit indexed color or greyscale at 800x992 pixels, then save as non-interlaced PNG.
I'd be interested to know if it reproduces for anyone else (or if there is a known fix, I didn't see one when I searched).
Steps to reproduce:
-Start PhotoShop (CS2 version 9.0.2 here)
-File->New
-Set a resolution of 800x992 (this seems to matter!)
-ColorMode grayscale (can do this now, or load or convert any picture to grayscale or 256 colors at exactly 800x992 pixels canvas size)
-Hit okay
-File->Save As...
-Select type PNG (any filename)
-Click Save
-Select None for Interlace (does not crash on Interlaced mode)
-Click Ok
-Get "Could not save as [file] because of a program error. (As a secondary bug, if the filename is long enough this message is cut off.)
-Any further attempt to save PNG results in a zero-byte file, no error message.
The easy workaround is to save as Interlaced, but it's still pretty bad since it hobbles the program till you restart it.
A debug monitor shows a bad pointer dereference related to the PNG plugin:
'Photoshop.exe': Loaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\File Formats\Png.8bi', Binary was not built with debug information.
'Photoshop.exe': Unloaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\File Formats\Png.8bi'
'Photoshop.exe': Loaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\File Formats\Png.8bi', Binary was not built with debug information.
'Photoshop.exe': Unloaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\File Formats\Png.8bi'
'Photoshop.exe': Loaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\File Formats\Png.8bi', Binary was not built with debug information.
First-chance exception at 0x0f7f15c7 in Photoshop.exe: 0xC0000005: Access violation reading location 0x0f8e2000.
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: photoshop_error at memory location 0x0012cc68..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
'Photoshop.exe': Unloaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\File Formats\Png.8bi'
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
First-chance exception at 0x7c812afb in Photoshop.exe: Microsoft C++ exception: [rethrow] at memory location 0x00000000..
The thread 'Win32 Thread' (0xa44) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0x17c) has exited with code 0 (0x0).
The thread 'Win32 Thread' (0xd1c) has exited with code 0 (0x0).
'Photoshop.exe': Unloaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\Automate\ScriptingSupport.8li'
'Photoshop.exe': Unloaded 'C:\Program Files\Adobe\Adobe Photoshop CS2\Required\PNGIcons.apl'

Answer 1

>You could try (but personally i don't see it helping, but always good to be uptodate when this sort of thing happens) installing service pack 3 and then
Ah, I didn't pay enough attention when I answered that part -- I'm on SP3, my friend's machine is SP2.
>Some other questions to add to do abit of further testing with cs4 on XP:
>1. does you document have image data in it or does it stil work if it is just blank?
Nope, fails just fine blank, I was able to get reproducability down to the exact steps I listed above. I tested various other sizes (but I did not test other widths or other multiples of the height count). For example, 991 lines or 993 lines work fine, as does saving with interlace on.
>2. what resolution is you image set to? is it the defualt 72?
Totally default - I only touched the values listed in my reproducability steps. It doesn't seem to matter when I try it here what res I use, which makes sense since it's only a field in the PNG header. To verify, I tried just now at both 10dpi, 72dpi, and 140dpi.
>3. What colour profile is the image using? is it the default sRGB IEC61966-2.1
When you set the image to grayscale for color mode, sRGB isn't an option for color profile. However, if I create an RGB image using that profile, then use Image->Mode->Indexed Color to reduce it to 256 colors with a uniform palette (palette doesn't seem to matter), then save that, it will still crash. It does NOT crash when saving RGB mode, only 8-bit.
>4. what aspect ratio is it using? Square Pixels, yes?
Yes. In testing, it doesn't appear to matter.
Thanks for the ideas! Probably the fact that we are working with 256-color images is the biggest reason it's never been seen, that's probably not as common. The resolution requirement is strange, I've verified that it's not because it's a multiple of 8, 16, or 32. Seems we hit that number just purely by accident.