memory overflow in specpack.c code

[edwardhartnett]

In specpack.c we have this code:

    /* Calculate Laplacian scaling factors for each possible wave
     * number. */
    pscale = malloc((JJ + MM) * sizeof(g2float));
    tscale = (g2float)idrstmpl[4] * 1E-6;
    for (n = Js; n <= JJ + MM; n++)
        pscale[n] = pow((g2float)(n * (n + 1)), tscale);

Note that the for loop will always cause pscale to be written one beyond the size it has been malloced for. It was malloced for JJ + MM floats, but since the comparison in the for look is "<=" the loop will walk one float past JJ + MM.