From owner-freebsd-bugs  Thu May  4 18:40:03 1995
Return-Path: bugs-owner
Received: (from majordom@localhost)
          by freefall.cdrom.com (8.6.10/8.6.6) id SAA07330
          for bugs-outgoing; Thu, 4 May 1995 18:40:03 -0700
Received: (from gnats@localhost)
          by freefall.cdrom.com (8.6.10/8.6.6) id SAA07323
          ; Thu, 4 May 1995 18:40:02 -0700
Date: Thu, 4 May 1995 18:40:02 -0700
Message-Id: <199505050140.SAA07323@freefall.cdrom.com>
From: Paul Traina <pst@Shockwave.COM>
Reply-To: Paul Traina <pst@Shockwave.COM>
To: freebsd-bugs
Subject: kern/382: divide by zero in speaker driver
In-Reply-To: Your message of Thu, 4 May 1995 18:33:55 -0700
	<199505050133.SAA00402@precipice.shockwave.com>
Sender: bugs-owner@FreeBSD.org
Precedence: bulk


>Number:         382
>Category:       kern
>Synopsis:       kernel divide by zero in spkr driver code
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs (FreeBSD bugs mailing list)
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu May  4 18:40:01 1995
>Originator:     Peter Shipley / Paul Traina
>Organization:
>Release:        FreeBSD 2.1.0-Development i386
>Environment:

FreeBSD 1.1 through FreeBSD-current.

>Description:

The speaker code has some divides in it that are not protected.

>How-To-Repeat:

echo n90 >/dev/speaker

>Fix:
	
*** spkr.c	Thu Mar 16 13:16:46 1995
--- spkr.c	Thu May  4 18:24:55 1995
***************
*** 66,74 ****
  /* emit tone of frequency thz for given number of ticks */
  unsigned int thz, ticks;
  {
!     unsigned int divisor = TIMER_CLK / thz;
      int sps;
  
  #ifdef DEBUG
      (void) printf("tone: thz=%d ticks=%d\n", thz, ticks);
  #endif /* DEBUG */
--- 66,79 ----
  /* emit tone of frequency thz for given number of ticks */
  unsigned int thz, ticks;
  {
!     unsigned int divisor;
      int sps;
  
+     if (thz <= 0)
+ 	return;
+ 
+     divisor = TIMER_CLK / thz;
+ 
  #ifdef DEBUG
      (void) printf("tone: thz=%d ticks=%d\n", thz, ticks);
  #endif /* DEBUG */
***************
*** 205,210 ****
--- 210,218 ----
  	rest(whole * snum / (value * sdenom));
      else
      {
+ 	if (value == 0 || sdenom == 0)
+ 	    return;
+ 
  	sound = (whole * snum) / (value * sdenom)
  		- (whole * (FILLTIME - fill)) / (value * FILLTIME);
  	silence = whole * (FILLTIME-fill) * snum / (FILLTIME * value * sdenom);
>Audit-Trail:
>Unformatted: