Yeah, a threading bug sounds less likely. Anyway, the first "is 0 bytes after a block" sounds like what Mast described earlier and pretty harmless compared to the last one. Google tells me one can run gdb and valgrind together; try stopping at the last error, focus on frame for image_jpeg_encode and see what pointers gets passed to jpeg_write_scanlines. It would be interesting to see if they are reasonable blocks that can be traced to a struct *image or if the Pike internals are messed up.
If they are ok I'd suspect the library itself (especially if you say that most images can't trigger the bug), and the next step would perhaps be to compile your own with debug symbols and optimizations off.
