mux: ipc4: validate channels_count before building mask

build_config() looped over host-supplied channels_count
writing streams[].mask[] (size PLATFORM_MAX_CHANNELS),
overflowing it. Reject counts above the max.

Signed-off-by: Adrian Bonislawski <adrian.bonislawski@intel.com>

Author: abonislawski

src/audio/mux/mux_ipc4.c

@@ -39,6 +39,16 @@ static int build_config(struct processing_module *mod, struct mux_data *cfg)
 	int mask = 1;
 	int i;
 
+	/* channels_count is host-supplied; bound it to mask[] size */
+	if (cfg->base_cfg.audio_fmt.channels_count > PLATFORM_MAX_CHANNELS ||
+	    cfg->reference_format.channels_count > PLATFORM_MAX_CHANNELS) {
+		comp_err(dev, "invalid channel count: base %u reference %u (max %u)",
+			 cfg->base_cfg.audio_fmt.channels_count,
+			 cfg->reference_format.channels_count,
+			 PLATFORM_MAX_CHANNELS);
+		return -EINVAL;
+	}
+
 	cd->config.num_streams = MUX_MAX_STREAMS;
 
 	/* clear masks */