[PATCH] Solaris xf86OSRingBell() off-by-one error in filling iov[] array

[Peter Hutterer]

On Mon, Feb 15, 2010 at 01:42:28PM -0800, Alan Coopersmith wrote:
> When generating sound buffers for /dev/audio bells, insert waveform
> for beep *or* silence, but not both, so we don't write one entry past
> the end of the iov buffer when the final bit of soundwave ends up in
> the final entry allocated in the iov array.
> 
> Fixes OpenSolaris bug 6894890:
>  http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6894890
> 
> Signed-off-by: Alan Coopersmith <alan.coopersmith at sun.com>
> ---
>  hw/xfree86/os-support/solaris/sun_bell.c |    5 +++--
>  1 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/xfree86/os-support/solaris/sun_bell.c b/hw/xfree86/os-support/solaris/sun_bell.c
> index 7f146ea..05d1749 100644
> --- a/hw/xfree86/os-support/solaris/sun_bell.c
> +++ b/hw/xfree86/os-support/solaris/sun_bell.c
> @@ -126,14 +126,15 @@ xf86OSRingBell(int loudness, int pitch, int duration)
>      iovcnt = 0;
>  
>      for (cnt = 0; cnt <= repeats; cnt++) {
> -        iov[iovcnt].iov_base = (char *) samples;
> -        iov[iovcnt++].iov_len = sizeof(samples);
>          if (cnt == repeats) {
>              /* Insert a bit of silence so that multiple beeps are distinct and
>               * not compressed into a single tone.
>               */
>              iov[iovcnt].iov_base = (char *) silence;
>              iov[iovcnt++].iov_len = sizeof(silence);
> +        } else {
> +            iov[iovcnt].iov_base = (char *) samples;
> +            iov[iovcnt++].iov_len = sizeof(samples);
>          }
>          if ((iovcnt >= IOV_MAX) || (cnt == repeats)) {
>              written = writev(audioFD, iov, iovcnt);
> -- 
> 1.5.6.5
 
Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>

Cheers,
  Peter