Here is the critical code:
...
tim_data=MagickAllocateMemory(unsigned char *,image_size);//228
if (tim_data == (unsigned char *) NULL)
ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
(void) ReadBlob(image,image_size,(char *) tim_data);
tim_pixels=tim_data;
...
switch (bits_per_pixel)
{
...
default:
ThrowReaderException(CorruptImageError,ImproperImageHeader,image)//371
}
if (image->storage_class == PseudoClass)
(void) SyncImage(image);
MagickFreeMemory(tim_pixels);
...
Line 371 do not free memory about tim_data, this will cause memory leak.
Credit: ADLab of Venustech
This problem is fixed by Mercurial changeset 15189:53a000dfa335. Thanks for the report!