security: fix heap OOB read in PulseAudio sample cache playback

The sample cache upload buffer is allocated as MAXLENGTH (4MB) but
sample->length can be up to SCACHE_ENTRY_SIZE_MAX (16MB). During
playback, the read offset can exceed the buffer size, causing an
out-of-bounds heap read. Wrap the offset into the ring buffer.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/modules/module-protocol-pulse/sample-play.c

@@ -100,7 +100,7 @@ static void sample_play_stream_process(void *data)
 	if (b->requested)
 		size = SPA_MIN(size, b->requested * p->stride);
 
-	memcpy(d, s->buffer + p->offset, size);
+	memcpy(d, s->buffer + (p->offset % MAXLENGTH), size);
 
 	p->offset += size;