Code: int Equalizer_setParameter (EffectContext *pContext, void *pParam, void *pValue){
 int status = 0;
 int32_t preset;
 int32_t band;
 int32_t level;
 int32_t *pParamTemp = (int32_t *)pParam;
 int32_t param = *pParamTemp++;


 switch (param) {
 case EQ_PARAM_CUR_PRESET:
        preset = (int32_t)(*(uint16_t *)pValue);

 if ((preset >= EqualizerGetNumPresets())||(preset < 0)) {
            status = -EINVAL;
 break;
 }
 EqualizerSetPreset(pContext, preset);
 break;
 case EQ_PARAM_BAND_LEVEL:

         band =  *pParamTemp;
         level = (int32_t)(*(int16_t *)pValue);
        if (band >= FIVEBAND_NUMBANDS) {
             status = -EINVAL;
             break;
         }
         EqualizerSetBandLevel(pContext, band, level);
 break;
 case EQ_PARAM_PROPERTIES: {
 int16_t *p = (int16_t *)pValue;
 if ((int)p[0] >= EqualizerGetNumPresets()) {
            status = -EINVAL;
 break;
 }
 if (p[0] >= 0) {
 EqualizerSetPreset(pContext, (int)p[0]);
 } else {
 if ((int)p[1] != FIVEBAND_NUMBANDS) {
                status = -EINVAL;
 break;
 }
 for (int i = 0; i < FIVEBAND_NUMBANDS; i++) {
 EqualizerSetBandLevel(pContext, i, (int)p[2 + i]);
 }
 }
 } break;
 default:
        ALOGV("\tLVM_ERROR : Equalizer_setParameter() invalid param %d", param);
        status = -EINVAL;
 break;
 }

 return status;
} /* end Equalizer_setParameter */

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588016.
Commit Message: Fix security vulnerability: Effect command might allow negative indexes

Bug: 32448258
Bug: 32095626

Test: Use POC bug or cts security test
Change-Id: I69f24eac5866f8d9090fc4c0ebe58c2c297b63df
(cherry picked from commit 01183402d757f0c28bfd5e3b127b3809dfd67459)
