rtnr: clamp control switch element count in set path

The switch set handler looped over a host-supplied element count reading
the control channel array past the payload. Reject counts above the
maximum channel count.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

Author: lrgirdwo

src/audio/rtnr/rtnr.c

@@ -565,6 +565,12 @@ static int32_t rtnr_set_value(struct processing_module *mod, void *ctl_data)
 	uint32_t val = 0;
 	int32_t j;
 
+	if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) {
+		comp_err(dev, "rtnr_set_value() error: num_elems %u out of range",
+			 cdata->num_elems);
+		return -EINVAL;
+	}
+
 	for (j = 0; j < cdata->num_elems; j++) {
 		val |= cdata->chanv[j].value;
 		comp_dbg(dev, "value = %u", val);