drivers: adc: mcux_adc16: Fix buffer size check for multi-channel reads

The mcux_adc16 driver's read function fails to validate the user-provided
buffer size when `adc_sequence.options` are used (extra samplings).

The calculation erroneously considered only the size required for one
channel, neglecting the total number of channels in the sequence.

This leads to a **buffer overflow** when reading multiple channels.

Fix this by using `POPCOUNT(sequence->channels)` to determine the
correct channel count and ensure the buffer size is sufficient.

Signed-off-by: Your Name <[email protected]>

Author: kaabia

drivers/adc/adc_mcux_adc16.c

@@ -192,6 +192,8 @@ static int start_read(const struct device *dev,
 	uint32_t tmp32;
 	ADC_Type *base = config->base;
 
+	uint32_t channels_count = POPCOUNT(sequence->channels);
+
 	switch (sequence->resolution) {
 	case 8:
 	case 9:
@@ -247,10 +249,25 @@ static int start_read(const struct device *dev,
 		return -EINVAL;
 	}
 
+	size_t min_buffer_size = channels_count * sizeof(uint16_t);
+
+	if (channels_count == 0) {
+		LOG_ERR("No channels selected");
+		return -EINVAL;
+	}
+
+	if (sequence->buffer_size < min_buffer_size) {
+		LOG_ERR("sequence buffer size too small %d < %d",
+			sequence->buffer_size, min_buffer_size);
+		return -EINVAL;
+	}
+
 	if (sequence->options) {
-		if (sequence->buffer_size <
-			2 * (sequence->options->extra_samplings + 1)) {
-			LOG_ERR("sequence buffer size too small < 2 * extra + 2");
+		min_buffer_size = channels_count * sizeof(uint16_t) *
+				  (sequence->options->extra_samplings + 1);
+		if (sequence->buffer_size < min_buffer_size) {
+			LOG_ERR("sequence buffer size too small for samplings: %d < %d",
+				sequence->buffer_size, min_buffer_size);
 			return -EINVAL;
 		}
 	}