Out of curiosity: Do those test files actually cause a failed "make check" (autotools) or "make test" (cmake) if the source code fix isn't applied? Because when I quickly checked that, the simple test case refuses to load those files with "unknown format" error and hence doesn't really run into the memory error. Would this need some different calling arguments?

They admittedly aren't that great as test cases. I you have compile libofx with -fsanitize=address, running ofxdump on the test cases will result in memory errors being reported. But even then, the test harness considers that a 'failure' same as a format error.