mux: ipc4: validate channels_count before building mask

build_config() looped over host-supplied channels_count
writing streams[].mask[] (size PLATFORM_MAX_CHANNELS),
overflowing it. Reject counts above the max.

Signed-off-by: Adrian Bonislawski <adrian.bonislawski@intel.com>

Author: abonislawski

src/audio/mux/mux_ipc4.c

@@ -36,9 +36,21 @@ static int build_config(struct processing_module *mod, struct mux_data *cfg)
 {
 	struct comp_dev *dev = mod->dev;
 	struct comp_data *cd = module_get_private_data(mod);
+	uint32_t base_ch = cfg->base_cfg.audio_fmt.channels_count;
+	uint32_t ref_ch = cfg->reference_format.channels_count;
+	uint32_t out_ch = cfg->output_format.channels_count;
 	int mask = 1;
 	int i;
 
+	/* base+reference map 1:1 to contiguous output channels: sink width
+	 * must equal their sum and fit the 8-bit output mask
+	 */
+	if (base_ch + ref_ch > PLATFORM_MAX_CHANNELS || out_ch != base_ch + ref_ch) {
+		comp_err(dev, "invalid channel count: base %u + reference %u -> output %u (max %u)",
+			 base_ch, ref_ch, out_ch, PLATFORM_MAX_CHANNELS);
+		return -EINVAL;
+	}
+
 	cd->config.num_streams = MUX_MAX_STREAMS;
 
 	/* clear masks */