From 8f743f17ed0076d10d6c60fe8bdf3f54d3432ae5 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Mon, 15 Feb 2010 17:42:11 -0800 Subject: [PATCH] Solaris xf86OSRingBell() off-by-one error in filling iov[] array When generating sound buffers for /dev/audio bells, insert waveform for beep *or* silence, but not both, so we don't write one entry past the end of the iov buffer when the final bit of soundwave ends up in the final entry allocated in the iov array. Fixes OpenSolaris bug 6894890: http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6894890 Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Acked-by: Adam Jackson Signed-off-by: Keith Packard --- hw/xfree86/os-support/solaris/sun_bell.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/xfree86/os-support/solaris/sun_bell.c b/hw/xfree86/os-support/solaris/sun_bell.c index 7f146eaaf..05d17492a 100644 --- a/hw/xfree86/os-support/solaris/sun_bell.c +++ b/hw/xfree86/os-support/solaris/sun_bell.c @@ -126,14 +126,15 @@ xf86OSRingBell(int loudness, int pitch, int duration) iovcnt = 0; for (cnt = 0; cnt <= repeats; cnt++) { - iov[iovcnt].iov_base = (char *) samples; - iov[iovcnt++].iov_len = sizeof(samples); if (cnt == repeats) { /* Insert a bit of silence so that multiple beeps are distinct and * not compressed into a single tone. */ iov[iovcnt].iov_base = (char *) silence; iov[iovcnt++].iov_len = sizeof(silence); + } else { + iov[iovcnt].iov_base = (char *) samples; + iov[iovcnt++].iov_len = sizeof(samples); } if ((iovcnt >= IOV_MAX) || (cnt == repeats)) { written = writev(audioFD, iov, iovcnt);