Bug Description
The Index parameter in hashmap functions RtlHashmapEntryInsert, RtlHashmapEntryLookup, and RtlHashmapEntryDelete is never used. Instead, a local variable UINT32 index = 0 shadows the parameter, causing all hashmap operations to always access bucket 0.
Affected Files
Affected Functions
RtlHashmapEntryInsert (line 153)
RtlHashmapEntryLookup (line 186)
RtlHashmapEntryDelete (line 214)
Root Cause
Each function declares a local variable UINT32 index = 0; that shadows the Index parameter:
PVOID
RtlHashmapEntryInsert(In PRTL_HASHMAP Hashmap, In UINT32 Index)
{
UINT32 index = 0; // ← Shadows the Index parameter
// ...
list_head = &(&Hashmap->buckets[index])->entry; // ← Uses local variable (always 0)
}## Impact
- Functional: All hashmap entries are inserted into, looked up from, and deleted from bucket 0 only, regardless of the hash key.
- Performance: The hashmap degrades to a linked list with O(n) lookup time instead of expected O(1) average.
- Correctness: Hash distribution is completely broken.
Proposed Fix
Remove the local UINT32 index = 0; declaration in all three functions and use the Index parameter directly:
PVOID
RtlHashmapEntryInsert(In PRTL_HASHMAP Hashmap, In UINT32 Index)
{
-
UINT32 index = 0;
PLIST_ENTRY list_head = NULL;
PRTL_HASHMAP_ENTRY entry = NULL;
PRTL_HASHMAP_ENTRY new_entry = NULL;
if (!Hashmap->active)
return NULL;
-
list_head = &(&Hashmap->buckets[index])->entry;
- list_head = &(&Hashmap->buckets[Index])->entry;
// ...
}Apply the same fix to RtlHashmapEntryLookup and RtlHashmapEntryDelete.
Bug Description
The
Indexparameter in hashmap functionsRtlHashmapEntryInsert,RtlHashmapEntryLookup, andRtlHashmapEntryDeleteis never used. Instead, a local variableUINT32 index = 0shadows the parameter, causing all hashmap operations to always access bucket 0.Affected Files
driver/containers/map.cAffected Functions
RtlHashmapEntryInsert(line 153)RtlHashmapEntryLookup(line 186)RtlHashmapEntryDelete(line 214)Root Cause
Each function declares a local variable
UINT32 index = 0;that shadows theIndexparameter:PVOID
RtlHashmapEntryInsert(In PRTL_HASHMAP Hashmap, In UINT32 Index)
{
UINT32 index = 0; // ← Shadows the Index parameter
// ...
list_head = &(&Hashmap->buckets[index])->entry; // ← Uses local variable (always 0)
}## Impact
Proposed Fix
Remove the local
UINT32 index = 0;declaration in all three functions and use theIndexparameter directly:PVOID
RtlHashmapEntryInsert(In PRTL_HASHMAP Hashmap, In UINT32 Index)
{
UINT32 index = 0;
PLIST_ENTRY list_head = NULL;
PRTL_HASHMAP_ENTRY entry = NULL;
PRTL_HASHMAP_ENTRY new_entry = NULL;
if (!Hashmap->active)
return NULL;
list_head = &(&Hashmap->buckets[index])->entry;
// ...
}Apply the same fix to
RtlHashmapEntryLookupandRtlHashmapEntryDelete.