fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-25 00:10:05 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Solaris xf86OSRingBell() off-by-one error in filling iov[] array

Browse source 
When generating sound buffers for /dev/audio bells, insert waveform
for beep *or* silence, but not both, so we don't write one entry past
the end of the iov buffer when the final bit of soundwave ends up in
the final entry allocated in the iov array.

Fixes OpenSolaris bug 6894890:
 http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6894890

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Alan Coopersmith 2010-02-15 17:42:11 -08:00
parent d35e08b6db
commit 8f743f17ed
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
hw/xfree86/os-support/solaris/sun_bell.c
View file

@ -126,14 +126,15 @@ xf86OSRingBell(int loudness, int pitch, int duration)
iovcnt = 0;
for (cnt = 0; cnt <= repeats; cnt++) {
iov[iovcnt].iov_base = (char *) samples;
iov[iovcnt++].iov_len = sizeof(samples);
if (cnt == repeats) {
/* Insert a bit of silence so that multiple beeps are distinct and
* not compressed into a single tone.
*/
iov[iovcnt].iov_base = (char *) silence;
iov[iovcnt++].iov_len = sizeof(silence);
} else {
iov[iovcnt].iov_base = (char *) samples;
iov[iovcnt++].iov_len = sizeof(samples);
}
if ((iovcnt >= IOV_MAX) || (cnt == repeats)) {
written = writev(audioFD, iov, iovcnt);