max/lean4-htt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
lean4-htt/src/kernel
History
Paul Reichert 57915af218
fix: reducing Nat.pow, kernel interprets constant as Nat literal (#8060) 
This PR fixes a bug in the Lean kernel. During reduction of `Nat.pow`,
the kernel did not validate that the WHNF of the first argument is a
`Nat` literal before interpreting it as an `mpz` number. This PR adds
the missing check.

### Explanation

In `type_checker::reduce_pow`, an expression was interpreted as a `Nat`
literal without previously validating that it actually was a `Nat`
literal.

We (@TwoFX and me) noticed this while fuzzing the Lean kernel with GMP
and Mimalloc disabled. Until now, the fuzzer found one crash, leading us
to this issue.

What are the consequences? If GMP is disabled, the Lean kernel will
crash on some inputs after the memory allocator returns `null`. (MPZ
tries to clone the `.const` expression in disguise of a `Nat` literal
which accidentally has a size field indicating that the number has 88
trillion `mpz` digits. This is too much for every allocator.) If GMP is
enabled, it is possible to [prove
`False`](https://live.lean-lang.org/#codez=JYWwDg9gTgLgBAGQKYEMB2AoDATJAzOAcwDoBvAVwF84AuOABQFU1gYyq5AkwjgDkV4aAXjh5yaOAH04ggHxwIYJOIDCAGxQBnDcADGKVXGDjgBACoBPRdLgWrMABZK4ABjhJVGpC6wBaH3AApcg14AHcoViNCOAADPjZIULgACnjiRLgARlcADgBKOABWZwAmGLhQiHJVbDh9DQgK6ABrAG5YtIzU/nSIJOy4fKLnAGZyyursNAByGBx8G1pefi4GKAVaYVFxAA9pORM4PeFXBycAMXqvd08bKHIkX39TRzhmpCg0dzgoJGxyHRIDRwBzAYEwRooOBocggABGHzgCJgoSQTmyAD0cqMSnU0LVMdiACw5eYEegAeQA6gBCTbLBJ9FIkUjOaiAC/JAJfkBUyWHcKDhcAARABiIwAKyQOhgEjhKGwEjA6wgeCFSx0EBAIHQtVkcGwEAwcDgqiQ8FwOgMdGQ6GIABEpeooPxgBBxEI4MRcHg0A7LXBSEbjcG0CgQF4PTEQOYHCAADRB4NwexGGDAj3EX6EaooKAuBNJ40aFB4M3menEYulguFmCWCPCZLEFBgMApYgatAhWKmOAAbQAugUm53uzFKbT+0O8jWk6aAG7uei5sPp4SD2fB+f6B70kduseme5IYip9ZTvKJuCUIM2tDEACi6jhxGUmu1+OIqhMMDfvwAsikd7Ntg2B+gYFqqJeGB+HAyjOhojjAocADi/70IYwLYGCAqmtgGBimgkrSrK8qKsqeBYGc0BICARASEgACOEgAF4fI0dAshw4gnPScLmEGYh4BANREEGGhgN+8AADytHIUB4KoVGODRdGIX0Eh4FcSyXB4DZIgJxo6PY6CEF4vbdIySSuJkl7GlASR9oACYT0UxrHsQOQZIDsKDSnA0axhgQA)
because the kernel doesn't crash on a memory allocation and instead just
happily interprets the `.const` expression as a GMP number.

Importantly, this is _not_ a flaw in Lean's type theory. It is an
implementation bug in the built-in kernel, related to the efficient
reduction of `Nat.pow`, that will be fixed with this PR; see the test
file. Because Lean's kernel is relatively small, there are third-party
kernel implementations such as `lean4lean` and `nanoda`. `lean4lean`
catches the bogus proof, and looking at its code `nanoda` will, too, but
I haven't tried it yet.
2025-04-23 13:55:20 +00:00
..
abstract.cpp feat: generalize Expr.abstractRange 2022-03-08 18:19:17 -08:00
abstract.h chore: remove Expr.localE constructor 2020-11-01 09:37:48 -08:00
CMakeLists.txt perf: add lean_instantiate_level_mvars (#4910) 2024-08-04 18:31:44 +00:00
declaration.cpp fix: RecursorVal.getInduct to return name of major argument’s type (#5679) 2024-10-21 08:45:18 +00:00
declaration.h fix: RecursorVal.getInduct to return name of major argument’s type (#5679) 2024-10-21 08:45:18 +00:00
environment.cpp feat: split Lean.Kernel.Environment from Lean.Environment (#5145) 2025-01-18 18:42:57 +00:00
environment.h feat: split Lean.Kernel.Environment from Lean.Environment (#5145) 2025-01-18 18:42:57 +00:00
equiv_manager.cpp chore: reduce src/include/lean 2021-09-07 08:24:54 -07:00
equiv_manager.h chore(*): rename expr_struct_* to expr_* 2018-04-09 12:55:48 -07:00
expr.cpp perf: has_univ_mvar, has_univ_mvar, and has_fvar in C++ (#5793) 2024-10-21 16:56:30 +00:00
expr.h perf: optimize sorry detection in unused variables linter (#7129) 2025-02-22 16:43:39 +00:00
expr_cache.cpp refactor(kernel/expr): implement expr using runtime/object 2018-06-21 16:05:33 -07:00
expr_cache.h
expr_eq_fn.cpp chore: fix typo in hash code for Expr equality test (#4990) 2024-08-12 00:47:08 +00:00
expr_eq_fn.h feat(library/type_context): allow us to control whether binder information is taken into account or not when caching type information 2016-08-01 16:34:07 -07:00
expr_maps.h chore(*): rename expr_struct_* to expr_* 2018-04-09 12:55:48 -07:00
expr_sets.h chore: reduce src/include/lean 2021-09-07 08:24:54 -07:00
find_fn.h
for_each_fn.cpp perf: optimize sorry detection in unused variables linter (#7129) 2025-02-22 16:43:39 +00:00
for_each_fn.h perf: for_each with precise cache (#4794) 2024-07-20 00:18:55 +00:00
inductive.cpp refactor: InductiveVal.numNested instead of .isNested 2024-07-08 21:18:50 +02:00
inductive.h fix: RecursorVal.getInduct to return name of major argument’s type (#5679) 2024-10-21 08:45:18 +00:00
init_module.cpp fix: Windows needs more LEAN_EXPORTs 2024-08-12 14:14:42 +02:00
init_module.h fix: Windows needs more LEAN_EXPORTs 2024-08-12 14:14:42 +02:00
instantiate.cpp perf: instantiateExprMVars (#4915) 2024-08-05 17:15:22 +00:00
instantiate.h perf: instantiateExprMVars (#4915) 2024-08-05 17:15:22 +00:00
instantiate_mvars.cpp chore: fix spelling mistakes in non-Lean files (#5430) 2024-09-23 21:11:20 +00:00
kernel_exception.h feat: split Lean.Kernel.Environment from Lean.Environment (#5145) 2025-01-18 18:42:57 +00:00
level.cpp chore: remove remnants of C++ format 2022-11-18 06:11:24 -08:00
level.h perf: add lean_instantiate_level_mvars (#4910) 2024-08-04 18:31:44 +00:00
local_ctx.cpp chore: reduce src/include/lean 2021-09-07 08:24:54 -07:00
local_ctx.h perf: fix implementation of move constructors and move assignment ope… (#4700) 2024-08-02 17:55:03 +00:00
quot.cpp fix: binder name 2021-08-26 11:11:37 -07:00
quot.h fix: quot reduction bug 2023-10-11 21:25:34 -07:00
replace_fn.cpp perf: use mimalloc with important C++ hash maps (#7868) 2025-04-11 16:23:33 +00:00
replace_fn.h chore: reduce src/include/lean 2021-09-07 08:24:54 -07:00
trace.cpp feat: split Lean.Kernel.Environment from Lean.Environment (#5145) 2025-01-18 18:42:57 +00:00
trace.h feat: split Lean.Kernel.Environment from Lean.Environment (#5145) 2025-01-18 18:42:57 +00:00
type_checker.cpp fix: reducing Nat.pow, kernel interprets constant as Nat literal (#8060) 2025-04-23 13:55:20 +00:00
type_checker.h feat: split Lean.Kernel.Environment from Lean.Environment (#5145) 2025-01-18 18:42:57 +00:00