From pst@Shockwave.COM  Thu May  4 18:34:47 1995
Received: from precipice.shockwave.com (precipice.shockwave.com [171.69.108.33])
          by freefall.cdrom.com (8.6.10/8.6.6) with ESMTP id SAA07235
          for <FreeBSD-gnats-submit@freebsd.org>; Thu, 4 May 1995 18:34:45 -0700
Received: (from pst@localhost) by precipice.shockwave.com (8.6.11/8.6.9) id SAA00402; Thu, 4 May 1995 18:33:55 -0700
Message-Id: <199505050133.SAA00402@precipice.shockwave.com>
Date: Thu, 4 May 1995 18:33:55 -0700
From: Paul Traina <pst@Shockwave.COM>
Reply-To: pst@Shockwave.COM
To: FreeBSD-gnats-submit@freebsd.org
Cc: shipley@dis.org
Subject: divide by zero in speaker driver
X-Send-Pr-Version: 3.2

>Number:         382
>Category:       kern
>Synopsis:       kernel divide by zero in spkr driver code
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs (FreeBSD bugs mailing list)
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu May  4 18:40:01 1995
>Closed-Date:    Thu May 4 23:16:12 PDT 1995
>Last-Modified:
>Originator:     Peter Shipley / Paul Traina
>Release:        FreeBSD 2.1.0-Development i386
>Organization:
>Environment:

FreeBSD 1.1 through FreeBSD-current.

>Description:

The speaker code has some divides in it that are not protected.

>How-To-Repeat:

echo n90 >/dev/speaker

>Fix:
	
*** spkr.c	Thu Mar 16 13:16:46 1995
--- spkr.c	Thu May  4 18:24:55 1995
***************
*** 66,74 ****
  /* emit tone of frequency thz for given number of ticks */
  unsigned int thz, ticks;
  {
!     unsigned int divisor = TIMER_CLK / thz;
      int sps;
  
  #ifdef DEBUG
      (void) printf("tone: thz=%d ticks=%d\n", thz, ticks);
  #endif /* DEBUG */
--- 66,79 ----
  /* emit tone of frequency thz for given number of ticks */
  unsigned int thz, ticks;
  {
!     unsigned int divisor;
      int sps;
  
+     if (thz <= 0)
+ 	return;
+ 
+     divisor = TIMER_CLK / thz;
+ 
  #ifdef DEBUG
      (void) printf("tone: thz=%d ticks=%d\n", thz, ticks);
  #endif /* DEBUG */
***************
*** 205,210 ****
--- 210,218 ----
  	rest(whole * snum / (value * sdenom));
      else
      {
+ 	if (value == 0 || sdenom == 0)
+ 	    return;
+ 
  	sound = (whole * snum) / (value * sdenom)
  		- (whole * (FILLTIME - fill)) / (value * FILLTIME);
  	silence = whole * (FILLTIME-fill) * snum / (FILLTIME * value * sdenom);
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: davidg 
State-Changed-When: Thu May 4 23:16:12 PDT 1995 
State-Changed-Why:  
Bug fixed with inclosed patch, slightly modified by me. 

>Unformatted:



