The patch Mark attached looks good and valgrind gives it a clean bill of health:

Mark.Howson@ntu.ac.uk 2010-12-15 07:45:25 PST

Reproducible here under Windows and Linux. Looking at the code for
SDL_Upsample_S16LSB_2c:

const int dstsize = (int) (((double)cvt->len_cvt) * cvt->rate_incr);
Sint16 *dst = ((Sint16 *) (cvt->buf + dstsize)) - 2;
const Sint16 *target = ((const Sint16 *) cvt->buf) - 2;
while (dst > target) {
   dst[1] = ((Sint16) SDL_SwapLE16(sample1));
   dst[0] = ((Sint16) SDL_SwapLE16(sample0));
   dst -= 2;
...

if dstsize is odd (and therefore dst), it'll write to target[1] which is one
byte before the allocated buf.

The attached patch to sdlgenaudiocvt.pl changes dst > target to dst >= target,
and removes the - $channels for the upsample case. The patch is not fully
tested, but seems to work here.