Skip to content

[Bug] Hashmap functions ignore Index parameter - all operations use bucket 0 #21

@OnePaper

Description

@OnePaper

Bug Description

The Index parameter in hashmap functions RtlHashmapEntryInsert, RtlHashmapEntryLookup, and RtlHashmapEntryDelete is never used. Instead, a local variable UINT32 index = 0 shadows the parameter, causing all hashmap operations to always access bucket 0.

Affected Files

  • driver/containers/map.c

Affected Functions

  1. RtlHashmapEntryInsert (line 153)
  2. RtlHashmapEntryLookup (line 186)
  3. RtlHashmapEntryDelete (line 214)

Root Cause

Each function declares a local variable UINT32 index = 0; that shadows the Index parameter:

PVOID
RtlHashmapEntryInsert(In PRTL_HASHMAP Hashmap, In UINT32 Index)
{
UINT32 index = 0; // ← Shadows the Index parameter
// ...
list_head = &(&Hashmap->buckets[index])->entry; // ← Uses local variable (always 0)
}## Impact

  • Functional: All hashmap entries are inserted into, looked up from, and deleted from bucket 0 only, regardless of the hash key.
  • Performance: The hashmap degrades to a linked list with O(n) lookup time instead of expected O(1) average.
  • Correctness: Hash distribution is completely broken.

Proposed Fix

Remove the local UINT32 index = 0; declaration in all three functions and use the Index parameter directly:

PVOID
RtlHashmapEntryInsert(In PRTL_HASHMAP Hashmap, In UINT32 Index)
{

  • UINT32 index = 0;
    PLIST_ENTRY list_head = NULL;
    PRTL_HASHMAP_ENTRY entry = NULL;
    PRTL_HASHMAP_ENTRY new_entry = NULL;

    if (!Hashmap->active)
    return NULL;

  • list_head = &(&Hashmap->buckets[index])->entry;

  • list_head = &(&Hashmap->buckets[Index])->entry;
    // ...
    }Apply the same fix to RtlHashmapEntryLookup and RtlHashmapEntryDelete.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions