rtnr: clamp control switch element count

The switch get handler looped over a host-supplied element count while
writing the reply channel array. Reject counts larger than the maximum
channel count before the loop.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

Author: lrgirdwo

src/audio/rtnr/rtnr.c

@@ -454,6 +454,11 @@ static int rtnr_get_config(struct processing_module *mod,
 		return rtnr_get_bin_data(mod, cdata, fragment_size);
 
 	case SOF_CTRL_CMD_SWITCH:
+		if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) {
+			comp_err(dev, "rtnr_get_config() error: num_elems %u out of range",
+				 cdata->num_elems);
+			return -EINVAL;
+		}
 		for (j = 0; j < cdata->num_elems; j++) {
 			cdata->chanv[j].channel = j;
 			cdata->chanv[j].value = cd->process_enable;