xserver: Branch 'server-1.7-nominations'

[Alan Coopersmith]

 hw/xfree86/os-support/solaris/sun_bell.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

New commits:
commit 8f743f17ed0076d10d6c60fe8bdf3f54d3432ae5
Author: Alan Coopersmith <alan.coopersmith at sun.com>
Date:   Mon Feb 15 17:42:11 2010 -0800

    Solaris xf86OSRingBell() off-by-one error in filling iov[] array
    
    When generating sound buffers for /dev/audio bells, insert waveform
    for beep *or* silence, but not both, so we don't write one entry past
    the end of the iov buffer when the final bit of soundwave ends up in
    the final entry allocated in the iov array.
    
    Fixes OpenSolaris bug 6894890:
     http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6894890
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at sun.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Acked-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/hw/xfree86/os-support/solaris/sun_bell.c b/hw/xfree86/os-support/solaris/sun_bell.c
index 7f146ea..05d1749 100644
--- a/hw/xfree86/os-support/solaris/sun_bell.c
+++ b/hw/xfree86/os-support/solaris/sun_bell.c
@@ -126,14 +126,15 @@ xf86OSRingBell(int loudness, int pitch, int duration)
     iovcnt = 0;
 
     for (cnt = 0; cnt <= repeats; cnt++) {
-        iov[iovcnt].iov_base = (char *) samples;
-        iov[iovcnt++].iov_len = sizeof(samples);
         if (cnt == repeats) {
             /* Insert a bit of silence so that multiple beeps are distinct and
              * not compressed into a single tone.
              */
             iov[iovcnt].iov_base = (char *) silence;
             iov[iovcnt++].iov_len = sizeof(silence);
+        } else {
+            iov[iovcnt].iov_base = (char *) samples;
+            iov[iovcnt++].iov_len = sizeof(samples);
         }
         if ((iovcnt >= IOV_MAX) || (cnt == repeats)) {
             written = writev(audioFD, iov, iovcnt);