es1370: check total frame count against current frame

es1370: check total frame count against current frame

A guest user may set channel frame count via es1370_write()
such that, in es1370_transfer_audio(), total frame count
'size' is lesser than the number of frames that are processed
'cnt'.

    int cnt = d->frame_cnt >> 16;
    int size = d->frame_cnt & 0xffff;

if (size < cnt), it results in incorrect calculations leading
to OOB access issue(s). Add check to avoid it.

Reported-by: Ren Ding <[email protected]>
Reported-by: Hanqing Zhao <[email protected]>
Signed-off-by: Prasad J Pandit <[email protected]>
Message-id: 20200514200608.1744203[email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>