module_adapter: ipc4: validate pin counts against IPC4 maximum

Reject IPC4 module init payloads where nb_input_pins or nb_output_pins
exceed the protocol maximum (IPC4_MAX_SRC_QUEUE / IPC4_MAX_DST_QUEUE = 8).

The existing cfgsz equality check ensures the immediate pointer
arithmetic is in-bounds, but it does not prevent unsupported pin counts
from being stored in dst->nb_input_pins / dst->nb_output_pins and used
by downstream module code. Add explicit upper-bound validation before
computing pinsz, matching the IPC4 ABI contract advertised via
IPC4_MAX_MODULE_PIN_COUNT_FW_CFG.

Signed-off-by: Adrian Bonislawski <adrian.bonislawski@intel.com>

Author: abonislawski

src/audio/module_adapter/module_adapter_ipc4.c

@@ -20,6 +20,7 @@
 #include <sof/ut.h>
 #include <rtos/interrupt.h>
 #include <rtos/symbol.h>
+#include <ipc4/base_fw.h>
 #include <limits.h>
 #include <stdint.h>
 
@@ -141,8 +142,13 @@ int module_adapter_init_data(struct comp_dev *dev,
 	if (cfgsz >= sizeof(*cfg)) {
 		int n_in = cfg->base_cfg_ext.nb_input_pins;
 		int n_out = cfg->base_cfg_ext.nb_output_pins;
-		size_t pinsz = (n_in * sizeof(*dst->input_pins))
-			     + (n_out * sizeof(*dst->output_pins));
+		size_t pinsz;
+
+		if (n_in > IPC4_MAX_SRC_QUEUE || n_out > IPC4_MAX_DST_QUEUE)
+			return -EINVAL;
+
+		pinsz = (n_in * sizeof(*dst->input_pins))
+		       + (n_out * sizeof(*dst->output_pins));
 
 		if (cfgsz == (sizeof(*cfg) + pinsz)) {
 			dst->nb_input_pins = n_in;