volume: require a full word for the attenuation control

The attenuation setter only rejected oversized payloads, then
dereferenced the data as a 32-bit value; a shorter payload read past the
mailbox. Require exactly a 32-bit payload.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

Author: lrgirdwo

src/audio/volume/volume_ipc4.c

@@ -277,8 +277,10 @@ static int volume_set_attenuation(struct processing_module *mod, const uint8_t *
 	struct comp_dev *dev = mod->dev;
 	uint32_t attenuation;
 
-	/* only support attenuation in format of 32bit */
-	if (data_size > sizeof(uint32_t)) {
+	/* only support attenuation in format of 32bit; the payload is
+	 * dereferenced as a uint32_t below so it must be exactly that size
+	 */
+	if (data_size != (int)sizeof(uint32_t)) {
 		comp_err(dev, "attenuation data size %d is incorrect", data_size);
 		return -EINVAL;
 	}