igo_nr: reject out-of-range control switch element count

The switch get handler looped over a host-supplied element count while
writing the reply channel array and reading per-channel state. Reject
counts larger than the maximum channel count before the loop.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

Author: lrgirdwo

src/audio/igo_nr/igo_nr.c

@@ -566,6 +566,10 @@ static int igo_nr_get_config(struct processing_module *mod,
 		comp_info(dev, "SOF_CTRL_CMD_BINARY");
 		return comp_data_blob_get_cmd(cd->model_handler, cdata, fragment_size);
 	case SOF_CTRL_CMD_SWITCH:
+		if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) {
+			comp_err(dev, "num_elems %u out of range", cdata->num_elems);
+			return -EINVAL;
+		}
 		for (j = 0; j < cdata->num_elems; j++) {
 			cdata->chanv[j].channel = j;
 			cdata->chanv[j].value = cd->process_enable[j];