Here is the critical code:
…
root=MagickAllocateMemory(IntervalTree *,sizeof(IntervalTree)); //1198
root->child=(IntervalTree *) NULL;
root->sibling=(IntervalTree *) NULL;
root->tau=0.0;
root->left=0;
root->right=255;
…
MagickAllocateMemory(...) may return NULL, so the following operations on the “root" will dereference null pointer to cause memory error.
Credit: ADLab of Venustech
This problem is fixed by Mercurial changeset 15211:c550763898eb. Thanks for the report!