rbsecp256k1 6.0.0 → 6.0.2

data/ext/rbsecp256k1/rbsecp256k1.c

@@ -20,7 +20,10 @@
 #endif // HAVE_SECP256K1_EXTRAKEYS_H
 
 #include <ruby.h>
+#include <ruby/missing.h>
+#include <string.h>
 #include <secp256k1.h>
+#include <secp256k1_preallocated.h>
 
 // Check for optional sub-modules. As a rule any secp256k1 submodule is
 // optional and so should be blocked off using these ifdefs.
@@ -113,6 +116,39 @@ static VALUE Secp256k1_SharedSecret_class;
 static VALUE Secp256k1_SchnorrSignature_class;
 #endif // HAVE_SECP256K1_SCHNORRSIG_H
 
+/* Ruby allocates an empty shell before initialize_copy. It must never be
+ * usable as a cryptographic value if a subclass skips the copy hook. */
+static void *
+CheckedTypedData_get(VALUE object, const rb_data_type_t *type)
+{
+  void *data = rb_check_typeddata(object, type);
+  if (data == NULL)
+  {
+    rb_raise(Secp256k1_Error_class, "native object is not initialized");
+  }
+  return data;
+}
+
+#define CheckedTypedData_Get_Struct(object, type, descriptor, result) \
+  ((result) = (type *)CheckedTypedData_get((object), (descriptor)))
+
+/* Failed factories remain discoverable through ObjectSpace until GC. Detach
+ * their invalid payload before raising, using the normal secret-wiping free
+ * callback. Subsequent access and copying then reject the empty shell. */
+static void
+NativeValue_invalidate(VALUE object)
+{
+  void *data = RTYPEDDATA_DATA(object);
+  const rb_data_type_t *type = RTYPEDDATA_TYPE(object);
+  RTYPEDDATA_DATA(object) = NULL;
+  if (data != NULL) { type->function.dfree(data); }
+}
+
+/* Binary inputs are checked as T_STRING before RSTRING_PTR is used. Borrow
+ * their bytes only after Ruby allocations; native calls need no NUL terminator.
+ * Native payloads do not move, but their Ruby owners must remain live across
+ * allocations. Keep RB_GC_GUARD after the last dependent pointer use. */
+
 // Forward definitions for all structures
 typedef struct Context_dummy {
   secp256k1_context *ctx; // Context used by libsecp256k1 library
@@ -158,25 +194,77 @@ typedef struct SchnorrSignature_dummy {
 #endif // HAVE_SECP256K1_SCHNORRSIG_H
 //
 // Typed data definitions
+// dsize reports owned native storage only; Ruby adds the object itself.
+// This is ObjectSpace reporting, not another charge against Ruby's allocator.
+// Context clone-size queries include the upstream allocation without allocator
+// overhead. No Ruby allocations or exceptions are permitted in these callbacks.
 //
 
 // Context
 static void
 Context_free(void* in_context)
 {
+  if (in_context == NULL) { return; }
   Context *context;
   context = (Context*)in_context;
-  secp256k1_context_destroy(context->ctx);
+  if (context->ctx != NULL) { secp256k1_context_destroy(context->ctx); }
   xfree(context);
 }
 
+static size_t
+Context_memsize(const void *data)
+{
+  if (data == NULL) { return 0; }
+  const Context *object = (const Context *)data;
+  return sizeof(*object) + (object->ctx == NULL ? 0 :
+    secp256k1_context_preallocated_clone_size(object->ctx));
+}
+
 static const rb_data_type_t Context_DataType = {
   "Context",
-  { 0, Context_free, 0 },
+  { 0, Context_free, Context_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
 
+/* Context.allocate and subclasses can bypass initialize. Never pass their
+ * NULL context pointers into libsecp256k1. */
+static Context *
+Context_get(VALUE self)
+{
+  Context *context;
+  CheckedTypedData_Get_Struct(self, Context, &Context_DataType, context);
+  if (context->ctx == NULL)
+  {
+    rb_raise(Secp256k1_Error_class, "context is not initialized");
+  }
+  return context;
+}
+
+static VALUE
+Context_initialize_copy(VALUE self, VALUE other)
+{
+  Context *context;
+  Context *source;
+
+  if (self == other)
+  {
+    return self;
+  }
+  rb_obj_init_copy(self, other);
+  source = Context_get(other);
+  CheckedTypedData_Get_Struct(self, Context, &Context_DataType, context);
+  if (context->ctx != NULL)
+  {
+    rb_raise(Secp256k1_Error_class, "context is already initialized");
+  }
+
+  // The copy must own a distinct native allocation so either Ruby object can
+  // be collected without invalidating the other or double-freeing its context.
+  context->ctx = secp256k1_context_clone(source->ctx);
+  return self;
+}
+
 // PublicKey
 static void
 PublicKey_free(void *in_public_key)
@@ -186,9 +274,15 @@ PublicKey_free(void *in_public_key)
   xfree(public_key);
 }
 
+static size_t
+PublicKey_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(PublicKey);
+}
+
 static const rb_data_type_t PublicKey_DataType = {
   "PublicKey",
-  { 0, PublicKey_free, 0 },
+  { 0, PublicKey_free, PublicKey_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -202,9 +296,15 @@ XOnlyPublicKey_free(void* in_xonly_pubkey)
   xfree(xonly_pubkey);
 }
 
+static size_t
+XOnlyPublicKey_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(XOnlyPublicKey);
+}
+
 static const rb_data_type_t XOnlyPublicKey_DataType = {
   "XOnlyPublicKey",
-  { 0, XOnlyPublicKey_free, 0 },
+  { 0, XOnlyPublicKey_free, XOnlyPublicKey_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -213,24 +313,26 @@ static const rb_data_type_t XOnlyPublicKey_DataType = {
 static void
 PrivateKey_free(void *in_private_key)
 {
+  if (in_private_key == NULL) { return; }
   PrivateKey *private_key;
   private_key = (PrivateKey*)in_private_key;
 
-  /* Take the best practice recommendation from the libsecp256k1 example and
-   * clear the secret from memory in case there are bugs that might allow an
-   * attacker to leak memory.
-   *
-   * That being said its not clear how much control we actually have over Ruby
-   * potentially copying the string version of this private key data.
-   */
-  memset(private_key->data, 0, 32);
+  // Ruby supplies a portable wipe that must not be optimized away. This does
+  // not erase Ruby strings or other copies previously returned to callers.
+  explicit_bzero(private_key->data, sizeof(private_key->data));
 
   xfree(private_key);
 }
 
+static size_t
+PrivateKey_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(PrivateKey);
+}
+
 static const rb_data_type_t PrivateKey_DataType = {
   "PrivateKey",
-  { 0, PrivateKey_free, 0 },
+  { 0, PrivateKey_free, PrivateKey_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -239,14 +341,22 @@ static const rb_data_type_t PrivateKey_DataType = {
 static void
 KeyPair_free(void *in_keypair)
 {
+  if (in_keypair == NULL) { return; }
   KeyPair *keypair;
   keypair = (KeyPair*)in_keypair;
+  explicit_bzero(keypair, sizeof(*keypair));
   xfree(keypair);
 }
 
+static size_t
+KeyPair_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(KeyPair);
+}
+
 static const rb_data_type_t KeyPair_DataType = {
   "KeyPair",
-  { 0, KeyPair_free, 0 },
+  { 0, KeyPair_free, KeyPair_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -259,9 +369,15 @@ Signature_free(void *in_signature)
   xfree(signature);
 }
 
+static size_t
+Signature_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(Signature);
+}
+
 static const rb_data_type_t Signature_DataType = {
   "Signature",
-  { 0, Signature_free, 0 },
+  { 0, Signature_free, Signature_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -271,17 +387,29 @@ static const rb_data_type_t Signature_DataType = {
 static void
 RecoverableSignature_free(void *in_recoverable_signature)
 {
+  if (in_recoverable_signature == NULL) { return; }
   RecoverableSignature *recoverable_signature = (
     (RecoverableSignature*)in_recoverable_signature
   );
 
-  secp256k1_context_destroy(recoverable_signature->ctx);
+  if (recoverable_signature->ctx != NULL) {
+    secp256k1_context_destroy(recoverable_signature->ctx);
+  }
   xfree(recoverable_signature);
 }
 
+static size_t
+RecoverableSignature_memsize(const void *data)
+{
+  if (data == NULL) { return 0; }
+  const RecoverableSignature *object = (const RecoverableSignature *)data;
+  return sizeof(*object) + (object->ctx == NULL ? 0 :
+    secp256k1_context_preallocated_clone_size(object->ctx));
+}
+
 static const rb_data_type_t RecoverableSignature_DataType = {
   "RecoverableSignature",
-  { 0, RecoverableSignature_free, 0 },
+  { 0, RecoverableSignature_free, RecoverableSignature_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -292,15 +420,23 @@ static const rb_data_type_t RecoverableSignature_DataType = {
 static void
 SharedSecret_free(void *in_shared_secret)
 {
+  if (in_shared_secret == NULL) { return; }
   SharedSecret *shared_secret;
 
   shared_secret = (SharedSecret*)in_shared_secret;
+  explicit_bzero(shared_secret->data, sizeof(shared_secret->data));
   xfree(shared_secret);
 }
 
+static size_t
+SharedSecret_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(SharedSecret);
+}
+
 static const rb_data_type_t SharedSecret_DataType = {
   "SharedSecret",
-  { 0, SharedSecret_free, 0 },
+  { 0, SharedSecret_free, SharedSecret_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -317,9 +453,15 @@ SchnorrSignature_free(void *in_schnorr_sig)
   xfree(schnorr_sig);
 }
 
+static size_t
+SchnorrSignature_memsize(const void *data)
+{
+  return data == NULL ? 0 : sizeof(SchnorrSignature);
+}
+
 static const rb_data_type_t SchnorrSignature_DataType = {
   "SchnorrSignature",
-  { 0, SchnorrSignature_free, 0 },
+  { 0, SchnorrSignature_free, SchnorrSignature_memsize },
   0, 0,
   RUBY_TYPED_FREE_IMMEDIATELY
 };
@@ -419,27 +561,22 @@ RecoverableSignData(secp256k1_context *in_context,
 static VALUE
 XOnlyPublicKey_alloc(VALUE klass)
 {
-  VALUE result;
-  XOnlyPublicKey* xonly_pubkey;
-
-  xonly_pubkey = ALLOC(XOnlyPublicKey);
-  MEMZERO(xonly_pubkey, XOnlyPublicKey, 1);
-  result = TypedData_Wrap_Struct(klass, &XOnlyPublicKey_DataType, xonly_pubkey);
-
-  return result;
+  // Allocate the Ruby owner first; a failed wrapper allocation must not leak.
+  return rb_data_typed_object_zalloc(klass, sizeof(XOnlyPublicKey), &XOnlyPublicKey_DataType);
 }
 
 static VALUE
-XOnlyPublicKey_create_from_data(unsigned char *in_xonly_pubkey32)
+XOnlyPublicKey_create_from_data(VALUE in_data)
 {
   XOnlyPublicKey *xonly_pubkey;
   VALUE result;
 
   result = XOnlyPublicKey_alloc(Secp256k1_XOnlyPublicKey_class);
-  TypedData_Get_Struct(result, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
+  CheckedTypedData_Get_Struct(result, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
 
-  if (secp256k1_xonly_pubkey_parse(secp256k1_context_static, &xonly_pubkey->pubkey, in_xonly_pubkey32) != 1)
+  if (secp256k1_xonly_pubkey_parse(secp256k1_context_static, &xonly_pubkey->pubkey, (unsigned char*)RSTRING_PTR(in_data)) != 1)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_DeserializationError_class, "invalid x-only public key data");
     return Qnil;
   }
@@ -458,8 +595,6 @@ XOnlyPublicKey_create_from_data(unsigned char *in_xonly_pubkey32)
 static VALUE
 XOnlyPublicKey_from_data(VALUE klass, VALUE in_xonly_public_key_serialized)
 {
-  unsigned char *xonly_pubkey_data;
-
   Check_Type(in_xonly_public_key_serialized, T_STRING);
   if (RSTRING_LEN(in_xonly_public_key_serialized) != 32)
   {
@@ -467,8 +602,7 @@ XOnlyPublicKey_from_data(VALUE klass, VALUE in_xonly_public_key_serialized)
     return Qnil;
   }
 
-  xonly_pubkey_data = (unsigned char*)StringValuePtr(in_xonly_public_key_serialized);
-  return XOnlyPublicKey_create_from_data(xonly_pubkey_data);
+  return XOnlyPublicKey_create_from_data(in_xonly_public_key_serialized);
 }
 
 /**
@@ -483,7 +617,7 @@ XOnlyPublicKey_serialized(VALUE self)
   XOnlyPublicKey* xonly_pubkey;
   unsigned char out[SERIALIZED_XONLY_PUBKEY_SIZE_BYTES];
 
-  TypedData_Get_Struct(self, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
+  CheckedTypedData_Get_Struct(self, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
 
   if (secp256k1_xonly_pubkey_serialize(secp256k1_context_static, out, &xonly_pubkey->pubkey) != 1)
   {
@@ -506,8 +640,8 @@ XOnlyPublicKey_equals(VALUE self, VALUE other)
   XOnlyPublicKey *lhs;
   XOnlyPublicKey *rhs;
 
-  TypedData_Get_Struct(self, XOnlyPublicKey, &XOnlyPublicKey_DataType, lhs);
-  TypedData_Get_Struct(other, XOnlyPublicKey, &XOnlyPublicKey_DataType, rhs);
+  CheckedTypedData_Get_Struct(self, XOnlyPublicKey, &XOnlyPublicKey_DataType, lhs);
+  CheckedTypedData_Get_Struct(other, XOnlyPublicKey, &XOnlyPublicKey_DataType, rhs);
 
   if (secp256k1_xonly_pubkey_cmp(secp256k1_context_static, &lhs->pubkey, &rhs->pubkey) == 0)
   {
@@ -524,31 +658,24 @@ XOnlyPublicKey_equals(VALUE self, VALUE other)
 static VALUE
 PublicKey_alloc(VALUE klass)
 {
-  VALUE result;
-  PublicKey *public_key;
-
-  public_key = ALLOC(PublicKey);
-  MEMZERO(public_key, PublicKey, 1);
-  result = TypedData_Wrap_Struct(klass, &PublicKey_DataType, public_key);
-
-  return result;
+  return rb_data_typed_object_zalloc(klass, sizeof(PublicKey), &PublicKey_DataType);
 }
 
 static VALUE
-PublicKey_create_from_data(unsigned char *in_public_key_data,
-                           unsigned int in_public_key_data_len)
+PublicKey_create_from_data(VALUE in_data)
 {
   PublicKey *public_key;
   VALUE result;
 
   result = PublicKey_alloc(Secp256k1_PublicKey_class);
-  TypedData_Get_Struct(result, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(result, PublicKey, &PublicKey_DataType, public_key);
 
   if (secp256k1_ec_pubkey_parse(secp256k1_context_static,
                                 &(public_key->pubkey),
-                                in_public_key_data,
-                                in_public_key_data_len) != 1)
+                                (unsigned char*)RSTRING_PTR(in_data),
+                                (size_t)RSTRING_LEN(in_data)) != 1)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_DeserializationError_class, "invalid public key data");
     return Qnil;
   }
@@ -567,15 +694,8 @@ PublicKey_create_from_data(unsigned char *in_public_key_data,
 static VALUE
 PublicKey_from_data(VALUE klass, VALUE in_public_key_data)
 {
-  unsigned char *public_key_data;
-
   Check_Type(in_public_key_data, T_STRING);
-
-  public_key_data = (unsigned char*)StringValuePtr(in_public_key_data);
-  return PublicKey_create_from_data(
-    public_key_data,
-    (int)RSTRING_LEN(in_public_key_data)
-  );
+  return PublicKey_create_from_data(in_public_key_data);
 }
 
 /**
@@ -590,7 +710,7 @@ PublicKey_uncompressed(VALUE self)
   size_t serialized_pubkey_len = UNCOMPRESSED_PUBKEY_SIZE_BYTES;
   unsigned char serialized_pubkey[UNCOMPRESSED_PUBKEY_SIZE_BYTES];
 
-  TypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, public_key);
 
   secp256k1_ec_pubkey_serialize(secp256k1_context_static,
                                 serialized_pubkey,
@@ -613,7 +733,7 @@ PublicKey_compressed(VALUE self)
   size_t serialized_pubkey_len = COMPRESSED_PUBKEY_SIZE_BYTES;
   unsigned char serialized_pubkey[COMPRESSED_PUBKEY_SIZE_BYTES];
 
-  TypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, public_key);
 
   secp256k1_ec_pubkey_serialize(secp256k1_context_static,
                                 serialized_pubkey,
@@ -636,20 +756,22 @@ PublicKey_to_xonly(VALUE self)
   XOnlyPublicKey *xonly_pubkey;
   VALUE result;
 
-  TypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, public_key);
 
   result = XOnlyPublicKey_alloc(Secp256k1_XOnlyPublicKey_class);
-  TypedData_Get_Struct(result, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
+  CheckedTypedData_Get_Struct(result, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
 
   if (secp256k1_xonly_pubkey_from_pubkey(secp256k1_context_static,
                                          &xonly_pubkey->pubkey,
                                          NULL,
                                          &public_key->pubkey) != 1)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_Error_class, "failed to convert pubkey to x-only pubkey");
     return Qnil;
   }
 
+  RB_GC_GUARD(self);
   return result;
 }
 
@@ -674,8 +796,8 @@ PublicKey_equals(VALUE self, VALUE other)
   lhs_len = 33;
   rhs_len = 33;
 
-  TypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, lhs);
-  TypedData_Get_Struct(other, PublicKey, &PublicKey_DataType, rhs);
+  CheckedTypedData_Get_Struct(self, PublicKey, &PublicKey_DataType, lhs);
+  CheckedTypedData_Get_Struct(other, PublicKey, &PublicKey_DataType, rhs);
 
   secp256k1_ec_pubkey_serialize(
     secp256k1_context_static,
@@ -708,33 +830,26 @@ PublicKey_equals(VALUE self, VALUE other)
 static VALUE
 PrivateKey_alloc(VALUE klass)
 {
-  VALUE new_instance;
-  PrivateKey *private_key;
-
-  private_key = ALLOC(PrivateKey);
-  MEMZERO(private_key, PrivateKey, 1);
-  new_instance = TypedData_Wrap_Struct(klass, &PrivateKey_DataType, private_key);
-
-  return new_instance;
+  return rb_data_typed_object_zalloc(klass, sizeof(PrivateKey), &PrivateKey_DataType);
 }
 
 /* Internal-only method for creating a private key from secret data */
 static VALUE
-PrivateKey_create(unsigned char *in_private_key_data)
+PrivateKey_create(VALUE in_private_key_data)
 {
   PrivateKey *private_key;
   VALUE result;
 
   if (secp256k1_ec_seckey_verify(secp256k1_context_static,
-                                 in_private_key_data) != 1)
+                                 (unsigned char*)RSTRING_PTR(in_private_key_data)) != 1)
   {
     rb_raise(Secp256k1_Error_class, "invalid private key data");
     return Qnil;
   }
 
   result = PrivateKey_alloc(Secp256k1_PrivateKey_class);
-  TypedData_Get_Struct(result, PrivateKey, &PrivateKey_DataType, private_key);
-  MEMCPY(private_key->data, in_private_key_data, char, 32);
+  CheckedTypedData_Get_Struct(result, PrivateKey, &PrivateKey_DataType, private_key);
+  MEMCPY(private_key->data, RSTRING_PTR(in_private_key_data), char, 32);
 
   return result;
 }
@@ -748,10 +863,13 @@ static VALUE
 PrivateKey_data(VALUE self)
 {
   PrivateKey *private_key;
+  VALUE result;
 
-  TypedData_Get_Struct(self, PrivateKey, &PrivateKey_DataType, private_key);
+  CheckedTypedData_Get_Struct(self, PrivateKey, &PrivateKey_DataType, private_key);
 
-  return(rb_str_new((char*)private_key->data, 32));
+  result = rb_str_new((char*)private_key->data, 32);
+  RB_GC_GUARD(self);
+  return result;
 }
 
 /**
@@ -765,8 +883,6 @@ PrivateKey_data(VALUE self)
 static VALUE
 PrivateKey_from_data(VALUE klass, VALUE in_private_key_data)
 {
-  unsigned char *private_key_data;
-
   Check_Type(in_private_key_data, T_STRING);
   if (RSTRING_LEN(in_private_key_data) != 32)
   {
@@ -777,8 +893,7 @@ PrivateKey_from_data(VALUE klass, VALUE in_private_key_data)
     return Qnil;
   }
 
-  private_key_data = (unsigned char*)StringValuePtr(in_private_key_data);
-  return PrivateKey_create(private_key_data);
+  return PrivateKey_create(in_private_key_data);
 }
 
 /**
@@ -795,8 +910,8 @@ PrivateKey_equals(VALUE self, VALUE other)
   PrivateKey *lhs;
   PrivateKey *rhs;
 
-  TypedData_Get_Struct(self, PrivateKey, &PrivateKey_DataType, lhs);
-  TypedData_Get_Struct(other, PrivateKey, &PrivateKey_DataType, rhs);
+  CheckedTypedData_Get_Struct(self, PrivateKey, &PrivateKey_DataType, lhs);
+  CheckedTypedData_Get_Struct(other, PrivateKey, &PrivateKey_DataType, rhs);
 
   if (memcmp(lhs->data, rhs->data, 32) == 0)
   {
@@ -813,11 +928,7 @@ PrivateKey_equals(VALUE self, VALUE other)
 static VALUE
 KeyPair_alloc(VALUE klass)
 {
-  KeyPair *key_pair;
-
-  key_pair = ALLOC(KeyPair);
-
-  return TypedData_Wrap_Struct(klass, &KeyPair_DataType, key_pair);
+  return rb_data_typed_object_zalloc(klass, sizeof(KeyPair), &KeyPair_DataType);
 }
 
 /**
@@ -832,17 +943,19 @@ KeyPair_public_key(VALUE self)
   VALUE result;
   PublicKey *public_key;
 
-  TypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, key_pair);
+  CheckedTypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, key_pair);
 
   result = PublicKey_alloc(Secp256k1_PublicKey_class);
-  TypedData_Get_Struct(result, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(result, PublicKey, &PublicKey_DataType, public_key);
 
   if (secp256k1_keypair_pub(secp256k1_context_static, &public_key->pubkey, &key_pair->keypair) == 0)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_Error_class, "failed to derive public key from keypair");
     return Qnil;
   }
 
+  RB_GC_GUARD(self);
   return result;
 }
 
@@ -859,17 +972,19 @@ KeyPair_xonly_public_key(VALUE self)
   VALUE result;
   XOnlyPublicKey *xonly_pubkey;
 
-  TypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, key_pair);
+  CheckedTypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, key_pair);
 
   result = XOnlyPublicKey_alloc(Secp256k1_XOnlyPublicKey_class);
-  TypedData_Get_Struct(result, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
+  CheckedTypedData_Get_Struct(result, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
 
   if (secp256k1_keypair_xonly_pub(secp256k1_context_static, &xonly_pubkey->pubkey, NULL, &key_pair->keypair) == 0)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_Error_class, "failed to derive x-only public key from keypair");
     return Qnil;
   }
 
+  RB_GC_GUARD(self);
   return result;
 }
 
@@ -882,17 +997,31 @@ static VALUE
 KeyPair_private_key(VALUE self)
 {
   KeyPair *key_pair;
-  unsigned char private_key_data[32];
+  PrivateKey *private_key;
+  VALUE result;
 
-  TypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, key_pair);
+  // Validate the source before publishing an output object. Keep its owner
+  // live across allocation while extracting directly into owned secret storage.
+  CheckedTypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, key_pair);
+  result = PrivateKey_alloc(Secp256k1_PrivateKey_class);
+  CheckedTypedData_Get_Struct(result, PrivateKey, &PrivateKey_DataType, private_key);
 
-  if (secp256k1_keypair_sec(secp256k1_context_static, private_key_data, &key_pair->keypair) == 0)
+  if (secp256k1_keypair_sec(secp256k1_context_static, private_key->data, &key_pair->keypair) == 0)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_Error_class, "failed to derive private key from keypair");
     return Qnil;
   }
 
-  return PrivateKey_create(private_key_data);
+  if (secp256k1_ec_seckey_verify(secp256k1_context_static, private_key->data) != 1)
+  {
+    NativeValue_invalidate(result);
+    rb_raise(Secp256k1_Error_class, "invalid private key data");
+    return Qnil;
+  }
+
+  RB_GC_GUARD(self);
+  return result;
 }
 
 /**
@@ -910,8 +1039,8 @@ KeyPair_equals(VALUE self, VALUE other)
   KeyPair *lhs;
   KeyPair *rhs;
 
-  TypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, lhs);
-  TypedData_Get_Struct(other, KeyPair, &KeyPair_DataType, rhs);
+  CheckedTypedData_Get_Struct(self, KeyPair, &KeyPair_DataType, lhs);
+  CheckedTypedData_Get_Struct(other, KeyPair, &KeyPair_DataType, rhs);
 
   if (memcmp(&lhs->keypair, &rhs->keypair, sizeof(secp256k1_keypair)) == 0)
   {
@@ -928,14 +1057,7 @@ KeyPair_equals(VALUE self, VALUE other)
 static VALUE
 Signature_alloc(VALUE klass)
 {
-  VALUE new_instance;
-  Signature *signature;
-
-  signature = ALLOC(Signature);
-  MEMZERO(signature, Signature, 1);
-  new_instance = TypedData_Wrap_Struct(klass, &Signature_DataType, signature);
-
-  return new_instance;
+  return rb_data_typed_object_zalloc(klass, sizeof(Signature), &Signature_DataType);
 }
 
 /**
@@ -960,15 +1082,15 @@ Signature_from_compact(VALUE klass, VALUE in_compact_signature)
     rb_raise(Secp256k1_Error_class, "compact signature must be 64 bytes");
   }
 
-  signature_data = (unsigned char*)StringValuePtr(in_compact_signature);
-
   signature_result = Signature_alloc(Secp256k1_Signature_class);
-  TypedData_Get_Struct(signature_result, Signature, &Signature_DataType, signature);
+  CheckedTypedData_Get_Struct(signature_result, Signature, &Signature_DataType, signature);
+  signature_data = (unsigned char*)RSTRING_PTR(in_compact_signature);
 
   if (secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static,
                                               &(signature->sig),
                                               signature_data) != 1)
   {
+    NativeValue_invalidate(signature_result);
     rb_raise(Secp256k1_DeserializationError_class, "invalid compact signature");
     return Qnil;
   }
@@ -994,16 +1116,16 @@ Signature_from_der_encoded(VALUE klass, VALUE in_der_encoded_signature)
 
   Check_Type(in_der_encoded_signature, T_STRING);
 
-  signature_data = (unsigned char*)StringValuePtr(in_der_encoded_signature);
-
   signature_result = Signature_alloc(Secp256k1_Signature_class);
-  TypedData_Get_Struct(signature_result, Signature, &Signature_DataType, signature);
+  CheckedTypedData_Get_Struct(signature_result, Signature, &Signature_DataType, signature);
+  signature_data = (unsigned char*)RSTRING_PTR(in_der_encoded_signature);
 
   if (secp256k1_ecdsa_signature_parse_der(secp256k1_context_static,
                                           &(signature->sig),
                                           signature_data,
                                           RSTRING_LEN(in_der_encoded_signature)) != 1)
   {
+    NativeValue_invalidate(signature_result);
     rb_raise(Secp256k1_DeserializationError_class, "invalid DER encoded signature");
     return Qnil;
   }
@@ -1021,12 +1143,11 @@ Signature_der_encoded(VALUE self)
 {
   // TODO: Cache value after first computation
   Signature *signature;
-  unsigned long der_signature_len;
   unsigned char der_signature[72];
+  size_t der_signature_len = sizeof(der_signature);
 
-  TypedData_Get_Struct(self, Signature, &Signature_DataType, signature);
+  CheckedTypedData_Get_Struct(self, Signature, &Signature_DataType, signature);
 
-  der_signature_len = 72;
   if (secp256k1_ecdsa_signature_serialize_der(secp256k1_context_static,
                                               der_signature,
                                               &der_signature_len,
@@ -1039,7 +1160,8 @@ Signature_der_encoded(VALUE self)
     return Qnil;
   }
 
-  return rb_str_new((char*)der_signature, der_signature_len);
+  // The serializer's output length is bounded by the 72-byte stack buffer.
+  return rb_str_new((char*)der_signature, (long)der_signature_len);
 }
 
 /**
@@ -1054,7 +1176,7 @@ Signature_compact(VALUE self)
   Signature *signature;
   unsigned char compact_signature[COMPACT_SIG_SIZE_BYTES];
 
-  TypedData_Get_Struct(self, Signature, &Signature_DataType, signature);
+  CheckedTypedData_Get_Struct(self, Signature, &Signature_DataType, signature);
 
   if (secp256k1_ecdsa_signature_serialize_compact(secp256k1_context_static,
                                                   compact_signature,
@@ -1090,9 +1212,9 @@ Signature_normalized(VALUE self)
   Signature *signature;
   Signature *normalized_signature;
 
-  TypedData_Get_Struct(self, Signature, &Signature_DataType, signature);
+  CheckedTypedData_Get_Struct(self, Signature, &Signature_DataType, signature);
   result_sig = Signature_alloc(Secp256k1_Signature_class);
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     result_sig, Signature, &Signature_DataType, normalized_signature
   );
 
@@ -1105,6 +1227,7 @@ Signature_normalized(VALUE self)
     was_normalized = Qtrue;
   }
 
+  RB_GC_GUARD(self);
   result = rb_ary_new2(2);
   rb_ary_push(result, was_normalized);
   rb_ary_push(result, result_sig);
@@ -1128,8 +1251,8 @@ Signature_equals(VALUE self, VALUE other)
   unsigned char lhs_compact[64];
   unsigned char rhs_compact[64];
 
-  TypedData_Get_Struct(self, Signature, &Signature_DataType, lhs);
-  TypedData_Get_Struct(other, Signature, &Signature_DataType, rhs);
+  CheckedTypedData_Get_Struct(self, Signature, &Signature_DataType, lhs);
+  CheckedTypedData_Get_Struct(other, Signature, &Signature_DataType, rhs);
 
   secp256k1_ecdsa_signature_serialize_compact(
     secp256k1_context_static, lhs_compact, &(lhs->sig)
@@ -1155,16 +1278,7 @@ Signature_equals(VALUE self, VALUE other)
 static VALUE
 RecoverableSignature_alloc(VALUE klass)
 {
-  VALUE new_instance;
-  RecoverableSignature *recoverable_signature;
-
-  recoverable_signature = ALLOC(RecoverableSignature);
-  MEMZERO(recoverable_signature, RecoverableSignature, 1);
-  new_instance = TypedData_Wrap_Struct(
-    klass, &RecoverableSignature_DataType, recoverable_signature
-  );
-
-  return new_instance;
+  return rb_data_typed_object_zalloc(klass, sizeof(RecoverableSignature), &RecoverableSignature_DataType);
 }
 
 /**
@@ -1182,7 +1296,7 @@ RecoverableSignature_compact(VALUE self)
   int recovery_id;
   VALUE result;
 
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     self,
     RecoverableSignature,
     &RecoverableSignature_DataType,
@@ -1223,7 +1337,7 @@ RecoverableSignature_to_signature(VALUE self)
   Signature *signature;
   VALUE result;
 
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     self,
     RecoverableSignature,
     &RecoverableSignature_DataType,
@@ -1231,7 +1345,7 @@ RecoverableSignature_to_signature(VALUE self)
   );
 
   result = Signature_alloc(Secp256k1_Signature_class);
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     result,
     Signature,
     &Signature_DataType,
@@ -1244,6 +1358,7 @@ RecoverableSignature_to_signature(VALUE self)
     &(signature->sig),
     &(recoverable_signature->sig));
 
+  RB_GC_GUARD(self);
   return result;
 }
 
@@ -1271,25 +1386,27 @@ RecoverableSignature_recover_public_key(VALUE self, VALUE in_hash32)
     return Qnil;
   }
 
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     self,
     RecoverableSignature,
     &RecoverableSignature_DataType,
     recoverable_signature
   );
-  hash32 = (unsigned char*)StringValuePtr(in_hash32);
 
   result = PublicKey_alloc(Secp256k1_PublicKey_class);
-  TypedData_Get_Struct(result, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(result, PublicKey, &PublicKey_DataType, public_key);
+  hash32 = (unsigned char*)RSTRING_PTR(in_hash32);
 
   if (secp256k1_ecdsa_recover(recoverable_signature->ctx,
                               &(public_key->pubkey),
                               &(recoverable_signature->sig),
                               hash32) == 1)
   {
+    RB_GC_GUARD(self);
     return result;
   }
 
+  NativeValue_invalidate(result);
   rb_raise(Secp256k1_DeserializationError_class, "unable to recover public key");
 }
 
@@ -1310,10 +1427,10 @@ RecoverableSignature_equals(VALUE self, VALUE other)
   RecoverableSignature *lhs;
   RecoverableSignature *rhs;
 
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     self, RecoverableSignature, &RecoverableSignature_DataType, lhs
   );
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     other, RecoverableSignature, &RecoverableSignature_DataType, rhs
   );
 
@@ -1340,16 +1457,7 @@ RecoverableSignature_equals(VALUE self, VALUE other)
 static VALUE
 SharedSecret_alloc(VALUE klass)
 {
-  VALUE new_instance;
-  SharedSecret *shared_secret;
-
-  shared_secret = ALLOC(SharedSecret);
-  MEMZERO(shared_secret, SharedSecret, 1);
-  new_instance = TypedData_Wrap_Struct(
-  klass, &SharedSecret_DataType, shared_secret
-  );
-
-  return new_instance;
+  return rb_data_typed_object_zalloc(klass, sizeof(SharedSecret), &SharedSecret_DataType);
 }
 
 #endif // HAVE_SECP256K1_ECDH_H
@@ -1363,14 +1471,7 @@ SharedSecret_alloc(VALUE klass)
 static VALUE
 SchnorrSignature_alloc(VALUE klass)
 {
-  VALUE new_instance;
-  SchnorrSignature *schnorr_sig;
-
-  schnorr_sig = ALLOC(SchnorrSignature);
-  MEMZERO(schnorr_sig, SchnorrSignature, 1);
-  new_instance = TypedData_Wrap_Struct(klass, &SchnorrSignature_DataType, schnorr_sig);
-
-  return new_instance;
+  return rb_data_typed_object_zalloc(klass, sizeof(SchnorrSignature), &SchnorrSignature_DataType);
 }
 
 static VALUE
@@ -1387,10 +1488,9 @@ SchnorrSignature_from_data(VALUE klass, VALUE in_data)
     return Qnil;
   }
 
-  schnorr_data = (unsigned char*)StringValuePtr(in_data);
-
   result = SchnorrSignature_alloc(Secp256k1_SchnorrSignature_class);
-  TypedData_Get_Struct(result, SchnorrSignature, &SchnorrSignature_DataType, sig);
+  CheckedTypedData_Get_Struct(result, SchnorrSignature, &SchnorrSignature_DataType, sig);
+  schnorr_data = (unsigned char*)RSTRING_PTR(in_data);
 
   memcpy(sig->sig, schnorr_data, SCHNORR_SIG_SIZE_BYTES);
 
@@ -1401,10 +1501,13 @@ static VALUE
 SchnorrSignature_serialized(VALUE self)
 {
   SchnorrSignature *schnorr_sig;
+  VALUE result;
 
-  TypedData_Get_Struct(self, SchnorrSignature, &SchnorrSignature_DataType, schnorr_sig);
+  CheckedTypedData_Get_Struct(self, SchnorrSignature, &SchnorrSignature_DataType, schnorr_sig);
 
-  return rb_str_new((char*)schnorr_sig->sig, SCHNORR_SIG_SIZE_BYTES);
+  result = rb_str_new((char*)schnorr_sig->sig, SCHNORR_SIG_SIZE_BYTES);
+  RB_GC_GUARD(self);
+  return result;
 }
 
 static VALUE
@@ -1414,11 +1517,11 @@ SchnorrSignature_verify(VALUE self, VALUE in_message, VALUE in_xonly_pubkey)
   SchnorrSignature *schnorr_sig;
   unsigned char* msg;
 
-  TypedData_Get_Struct(self, SchnorrSignature, &SchnorrSignature_DataType, schnorr_sig);
-  TypedData_Get_Struct(in_xonly_pubkey, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
+  CheckedTypedData_Get_Struct(self, SchnorrSignature, &SchnorrSignature_DataType, schnorr_sig);
+  CheckedTypedData_Get_Struct(in_xonly_pubkey, XOnlyPublicKey, &XOnlyPublicKey_DataType, xonly_pubkey);
   Check_Type(in_message, T_STRING);
 
-  msg = (unsigned char*)StringValuePtr(in_message);
+  msg = (unsigned char*)RSTRING_PTR(in_message);
   if (secp256k1_schnorrsig_verify(secp256k1_context_static, schnorr_sig->sig, msg, RSTRING_LEN(in_message), &xonly_pubkey->pubkey) != 1)
   {
     return Qfalse;
@@ -1433,8 +1536,8 @@ SchnorrSignature_equals(VALUE self, VALUE other)
   SchnorrSignature *lhs;
   SchnorrSignature *rhs;
 
-  TypedData_Get_Struct(self, SchnorrSignature, &SchnorrSignature_DataType, lhs);
-  TypedData_Get_Struct(other, SchnorrSignature, &SchnorrSignature_DataType, rhs);
+  CheckedTypedData_Get_Struct(self, SchnorrSignature, &SchnorrSignature_DataType, lhs);
+  CheckedTypedData_Get_Struct(other, SchnorrSignature, &SchnorrSignature_DataType, rhs);
 
   if (memcmp(lhs->sig, rhs->sig, SCHNORR_SIG_SIZE_BYTES) == 0)
   {
@@ -1454,15 +1557,7 @@ SchnorrSignature_equals(VALUE self, VALUE other)
 static VALUE
 Context_alloc(VALUE klass)
 {
-  VALUE new_instance;
-  Context *context;
-
-  context = ALLOC(Context);
-  MEMZERO(context, Context, 1);
-
-  new_instance = TypedData_Wrap_Struct(klass, &Context_DataType, context);
-
-  return new_instance;
+  return rb_data_typed_object_zalloc(klass, sizeof(Context), &Context_DataType);
 }
 
 /**
@@ -1481,6 +1576,7 @@ static VALUE
 Context_initialize(int argc, const VALUE* argv, VALUE self)
 {
   Context *context;
+  secp256k1_context *new_context;
   unsigned char *seed32;
   VALUE context_randomization_bytes;
   VALUE opts;
@@ -1492,11 +1588,12 @@ Context_initialize(int argc, const VALUE* argv, VALUE self)
     CONST_ID(kwarg_ids, "context_randomization_bytes");
   }
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
-
-  context->ctx = secp256k1_context_create(
-    SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY
-  );
+  rb_check_frozen(self);
+  CheckedTypedData_Get_Struct(self, Context, &Context_DataType, context);
+  if (context->ctx != NULL)
+  {
+    rb_raise(Secp256k1_Error_class, "context is already initialized");
+  }
 
   // Handle optional second argument containing random bytes to use for
   // randomization. We pass ":" to rb_scan_args to say that we expect keyword
@@ -1523,13 +1620,21 @@ Context_initialize(int argc, const VALUE* argv, VALUE self)
         "context_randomization_bytes must be 32 bytes in length"
       );
     }
+  }
 
-    seed32 = (unsigned char*)StringValuePtr(context_randomization_bytes);
+  new_context = secp256k1_context_create(
+    SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY
+  );
+
+  if (!NIL_P(context_randomization_bytes))
+  {
+    seed32 = (unsigned char*)RSTRING_PTR(context_randomization_bytes);
 
     // Randomize the context at initialization time rather than before calls so
     // the same context can be used across threads safely.
-    if (secp256k1_context_randomize(context->ctx, seed32) != 1)
+    if (secp256k1_context_randomize(new_context, seed32) != 1)
     {
+      secp256k1_context_destroy(new_context);
       rb_raise(
         Secp256k1_Error_class,
         "context randomization failed"
@@ -1537,6 +1642,7 @@ Context_initialize(int argc, const VALUE* argv, VALUE self)
     }
   }
 
+  context->ctx = new_context;
   return self;
 }
 
@@ -1557,7 +1663,7 @@ Context_key_pair_from_private_key(VALUE self, VALUE in_private_key_data)
   unsigned char *private_key_data;
 
   Check_Type(in_private_key_data, T_STRING);
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
+  context = Context_get(self);
 
   if (RSTRING_LEN(in_private_key_data) != 32)
   {
@@ -1566,15 +1672,17 @@ Context_key_pair_from_private_key(VALUE self, VALUE in_private_key_data)
   }
 
   result = KeyPair_alloc(Secp256k1_KeyPair_class);
-  TypedData_Get_Struct(result, KeyPair, &KeyPair_DataType, keypair);
+  CheckedTypedData_Get_Struct(result, KeyPair, &KeyPair_DataType, keypair);
 
-  private_key_data = (unsigned char*)StringValuePtr(in_private_key_data);
+  private_key_data = (unsigned char*)RSTRING_PTR(in_private_key_data);
 
   if (secp256k1_keypair_create(context->ctx, &keypair->keypair, private_key_data) == 0)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_Error_class, "invalid secret when attempting to create keypair");
   }
 
+  RB_GC_GUARD(self);
   return result;
 }
 
@@ -1605,12 +1713,12 @@ Context_sign(VALUE self, VALUE in_private_key, VALUE in_hash32)
     return Qnil;
   }
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
-  TypedData_Get_Struct(in_private_key, PrivateKey, &PrivateKey_DataType, private_key);
-  hash32 = (unsigned char*)StringValuePtr(in_hash32);
+  context = Context_get(self);
+  CheckedTypedData_Get_Struct(in_private_key, PrivateKey, &PrivateKey_DataType, private_key);
 
   signature_result = Signature_alloc(Secp256k1_Signature_class);
-  TypedData_Get_Struct(signature_result, Signature, &Signature_DataType, signature);
+  CheckedTypedData_Get_Struct(signature_result, Signature, &Signature_DataType, signature);
+  hash32 = (unsigned char*)RSTRING_PTR(in_hash32);
  
   // Attempt to sign the hash of the given data
   if (SUCCESS(SignData(context->ctx,
@@ -1618,9 +1726,12 @@ Context_sign(VALUE self, VALUE in_private_key, VALUE in_hash32)
                        private_key->data,
                        &(signature->sig))))
   {
+    RB_GC_GUARD(self);
+    RB_GC_GUARD(in_private_key);
     return signature_result;
   }
 
+  NativeValue_invalidate(signature_result);
   rb_raise(Secp256k1_Error_class, "unable to compute signature");
   return Qnil;
 }
@@ -1643,10 +1754,10 @@ Context_tagged_sha256(VALUE self, VALUE in_tag, VALUE in_message)
   Check_Type(in_tag, T_STRING);
   Check_Type(in_message, T_STRING);
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
+  context = Context_get(self);
 
-  tag = (unsigned char*)StringValuePtr(in_tag);
-  msg = (unsigned char*)StringValuePtr(in_message);
+  tag = (unsigned char*)RSTRING_PTR(in_tag);
+  msg = (unsigned char*)RSTRING_PTR(in_message);
 
   if (secp256k1_tagged_sha256(context->ctx, hash32, tag, RSTRING_LEN(in_tag), msg, RSTRING_LEN(in_message)) != 1)
   {
@@ -1683,11 +1794,11 @@ Context_verify(VALUE self, VALUE in_signature, VALUE in_pubkey, VALUE in_hash32)
     rb_raise(Secp256k1_Error_class, "in_hash32 is not 32-bytes in length");
   }
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
-  TypedData_Get_Struct(in_pubkey, PublicKey, &PublicKey_DataType, public_key);
-  TypedData_Get_Struct(in_signature, Signature, &Signature_DataType, signature);
+  context = Context_get(self);
+  CheckedTypedData_Get_Struct(in_pubkey, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(in_signature, Signature, &Signature_DataType, signature);
 
-  hash32 = (unsigned char*)StringValuePtr(in_hash32);
+  hash32 = (unsigned char*)RSTRING_PTR(in_hash32);
   
   if (secp256k1_ecdsa_verify(context->ctx,
                              &(signature->sig),
@@ -1729,19 +1840,19 @@ Context_sign_recoverable(VALUE self, VALUE in_private_key, VALUE in_hash32)
     return Qnil;
   }
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
-  TypedData_Get_Struct(
+  context = Context_get(self);
+  CheckedTypedData_Get_Struct(
     in_private_key, PrivateKey, &PrivateKey_DataType, private_key
   );
-  hash32 = (unsigned char*)StringValuePtr(in_hash32);
 
   result = RecoverableSignature_alloc(Secp256k1_RecoverableSignature_class);
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     result,
     RecoverableSignature,
     &RecoverableSignature_DataType,
     recoverable_signature
   );
+  hash32 = (unsigned char*)RSTRING_PTR(in_hash32);
 
   if (SUCCESS(RecoverableSignData(context->ctx,
                                   hash32,
@@ -1749,9 +1860,12 @@ Context_sign_recoverable(VALUE self, VALUE in_private_key, VALUE in_hash32)
                                   &(recoverable_signature->sig))))
   {
     recoverable_signature->ctx = secp256k1_context_clone(context->ctx);
+    RB_GC_GUARD(self);
+    RB_GC_GUARD(in_private_key);
     return result;
   }
 
+  NativeValue_invalidate(result);
   rb_raise(Secp256k1_Error_class, "unable to compute recoverable signature");
   return Qnil;
 }
@@ -1780,9 +1894,8 @@ Context_recoverable_signature_from_compact(
 
   Check_Type(in_compact_sig, T_STRING);
   Check_Type(in_recovery_id, T_FIXNUM);
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
+  context = Context_get(self);
 
-  compact_sig = (unsigned char*)StringValuePtr(in_compact_sig);
   recovery_id = FIX2INT(in_recovery_id);
 
   if (RSTRING_LEN(in_compact_sig) != 64)
@@ -1798,12 +1911,13 @@ Context_recoverable_signature_from_compact(
   }
 
   result = RecoverableSignature_alloc(Secp256k1_RecoverableSignature_class);
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     result,
     RecoverableSignature,
     &RecoverableSignature_DataType,
     recoverable_signature
   );
+  compact_sig = (unsigned char*)RSTRING_PTR(in_compact_sig);
 
   if (secp256k1_ecdsa_recoverable_signature_parse_compact(
         context->ctx,
@@ -1812,9 +1926,11 @@ Context_recoverable_signature_from_compact(
         recovery_id) == 1)
   {
     recoverable_signature->ctx = secp256k1_context_clone(context->ctx);
+    RB_GC_GUARD(self);
     return result;
   }
   
+  NativeValue_invalidate(result);
   rb_raise(Secp256k1_DeserializationError_class, "unable to parse recoverable signature");
   return Qnil;
 }
@@ -1843,12 +1959,12 @@ Context_ecdh(VALUE self, VALUE point, VALUE scalar)
   SharedSecret *shared_secret;
   VALUE result;
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
-  TypedData_Get_Struct(point, PublicKey, &PublicKey_DataType, public_key);
-  TypedData_Get_Struct(scalar, PrivateKey, &PrivateKey_DataType, private_key);
+  context = Context_get(self);
+  CheckedTypedData_Get_Struct(point, PublicKey, &PublicKey_DataType, public_key);
+  CheckedTypedData_Get_Struct(scalar, PrivateKey, &PrivateKey_DataType, private_key);
 
   result = SharedSecret_alloc(Secp256k1_SharedSecret_class);
-  TypedData_Get_Struct(
+  CheckedTypedData_Get_Struct(
     result, SharedSecret, &SharedSecret_DataType, shared_secret
   );
 
@@ -1859,12 +1975,16 @@ Context_ecdh(VALUE self, VALUE point, VALUE scalar)
                      NULL,
                      NULL) != 1)
   {
+    NativeValue_invalidate(result);
     rb_raise(Secp256k1_Error_class, "invalid scalar provided to ecdh");
     return Qnil;
   }
 
   rb_iv_set(result, "@data", rb_str_new((char*)shared_secret->data, 32));
 
+  RB_GC_GUARD(self);
+  RB_GC_GUARD(point);
+  RB_GC_GUARD(scalar);
   return result;
 }
 
@@ -1879,19 +1999,14 @@ Context_sign_schnorr_custom(VALUE self, VALUE in_keypair, VALUE in_message, VALU
   KeyPair* keypair;
   SchnorrSignature* schnorr_sig;
   unsigned char* msg;
-  unsigned char* auxrand;
+  secp256k1_schnorrsig_extraparams extraparams = SECP256K1_SCHNORRSIG_EXTRAPARAMS_INIT;
   unsigned char sig[64];
   VALUE result;
 
-  TypedData_Get_Struct(self, Context, &Context_DataType, context);
-  TypedData_Get_Struct(in_keypair, KeyPair, &KeyPair_DataType, keypair);
+  context = Context_get(self);
+  CheckedTypedData_Get_Struct(in_keypair, KeyPair, &KeyPair_DataType, keypair);
 
   Check_Type(in_message, T_STRING);
-  if (RSTRING_LEN(in_message) != 32)
-  {
-    rb_raise(Secp256k1_Error_class, "schnorr signing message must be 32-bytes in length");
-    return Qnil;
-  }
 
   if (!NIL_P(in_auxrand))
   {
@@ -1903,17 +2018,17 @@ Context_sign_schnorr_custom(VALUE self, VALUE in_keypair, VALUE in_message, VALU
     }
   }
 
-  msg = (unsigned char*)StringValuePtr(in_message);
-  auxrand = (unsigned char*)StringValuePtr(in_auxrand);
+  msg = (unsigned char*)RSTRING_PTR(in_message);
+  extraparams.ndata = NIL_P(in_auxrand) ? NULL : (void*)RSTRING_PTR(in_auxrand);
 
-  if (secp256k1_schnorrsig_sign32(context->ctx, sig, msg, &keypair->keypair, auxrand) != 1)
+  if (secp256k1_schnorrsig_sign_custom(context->ctx, sig, msg, (size_t)RSTRING_LEN(in_message), &keypair->keypair, &extraparams) != 1)
   {
     rb_raise(Secp256k1_Error_class, "schnorr signing failed");
     return Qnil;
   }
 
   result = SchnorrSignature_alloc(Secp256k1_SchnorrSignature_class);
-  TypedData_Get_Struct(result, SchnorrSignature, &SchnorrSignature_DataType, schnorr_sig);
+  CheckedTypedData_Get_Struct(result, SchnorrSignature, &SchnorrSignature_DataType, schnorr_sig);
   memcpy(schnorr_sig->sig, sig, SCHNORR_SIG_SIZE_BYTES);
 
   return result;
@@ -1922,6 +2037,84 @@ Context_sign_schnorr_custom(VALUE self, VALUE in_keypair, VALUE in_message, VALU
 #endif // HAVE_SECP256K1_SCHNORRSIG_H
 
 //
+/* Keep normal Ruby dup/clone machinery (ivars, subclass hooks, singleton
+ * methods and frozen state), while rejecting direct construction. The VM
+ * allocator exposes no native storage until initialize_copy succeeds. */
+static VALUE
+NativeValue_reject_construction(int argc, VALUE *argv, VALUE self)
+{
+  rb_raise(rb_eTypeError, "use a factory to create native objects");
+  return Qnil;
+}
+
+/* Upstream guarantees its key/signature value structs can be safely copied.
+ * These wrappers contain inline values only; owned pointers need a deep copy. */
+#define DEFINE_VALUE_COPY(Type) \
+static VALUE Type##_copy_alloc(VALUE klass) \
+{ \
+  return TypedData_Wrap_Struct(klass, &Type##_DataType, NULL); \
+} \
+static VALUE Type##_initialize_copy(VALUE self, VALUE other) \
+{ \
+  Type *source; \
+  Type *copy; \
+  if (self == other) { return self; } \
+  rb_obj_init_copy(self, other); \
+  CheckedTypedData_Get_Struct(other, Type, &Type##_DataType, source); \
+  if (rb_check_typeddata(self, &Type##_DataType) != NULL) \
+  { \
+    rb_raise(Secp256k1_Error_class, "native object is already initialized"); \
+  } \
+  copy = ALLOC(Type); \
+  *copy = *source; \
+  RB_GC_GUARD(other); \
+  RTYPEDDATA_DATA(self) = copy; \
+  return self; \
+}
+
+DEFINE_VALUE_COPY(PublicKey)
+DEFINE_VALUE_COPY(XOnlyPublicKey)
+DEFINE_VALUE_COPY(PrivateKey)
+DEFINE_VALUE_COPY(KeyPair)
+DEFINE_VALUE_COPY(Signature)
+#ifdef HAVE_SECP256K1_SCHNORRSIG_H
+DEFINE_VALUE_COPY(SchnorrSignature)
+#endif
+
+#ifdef HAVE_SECP256K1_RECOVERY_H
+static VALUE
+RecoverableSignature_copy_alloc(VALUE klass)
+{
+  return TypedData_Wrap_Struct(klass, &RecoverableSignature_DataType, NULL);
+}
+
+static VALUE
+RecoverableSignature_initialize_copy(VALUE self, VALUE other)
+{
+  RecoverableSignature *source;
+  RecoverableSignature *copy;
+  if (self == other) { return self; }
+  rb_obj_init_copy(self, other);
+  CheckedTypedData_Get_Struct(other, RecoverableSignature, &RecoverableSignature_DataType, source);
+  if (rb_check_typeddata(self, &RecoverableSignature_DataType) != NULL)
+  {
+    rb_raise(Secp256k1_Error_class, "native object is already initialized");
+  }
+  copy = ALLOC(RecoverableSignature);
+  copy->sig = source->sig;
+  copy->ctx = secp256k1_context_clone(source->ctx);
+  RB_GC_GUARD(other);
+  RTYPEDDATA_DATA(self) = copy;
+  return self;
+}
+#endif
+
+#define ENABLE_VALUE_COPY(Type) \
+  rb_define_alloc_func(Secp256k1_##Type##_class, Type##_copy_alloc); \
+  rb_define_singleton_method(Secp256k1_##Type##_class, "allocate", NativeValue_reject_construction, -1); \
+  rb_define_method(Secp256k1_##Type##_class, "initialize", NativeValue_reject_construction, -1); \
+  rb_define_method(Secp256k1_##Type##_class, "initialize_copy", Type##_initialize_copy, 1)
+
 // Secp256k1 module methods
 //
 
@@ -2020,6 +2213,7 @@ void Init_rbsecp256k1(void)
   );
   rb_undef_alloc_func(Secp256k1_Context_class);
   rb_define_alloc_func(Secp256k1_Context_class, Context_alloc);
+  rb_define_method(Secp256k1_Context_class, "initialize_copy", Context_initialize_copy, 1);
   rb_define_method(Secp256k1_Context_class,
                    "initialize",
                    Context_initialize,
@@ -2041,12 +2235,13 @@ void Init_rbsecp256k1(void)
                    Context_verify,
                    3);
 
+  // Factories wrap initialized storage directly. Copy allocators create empty,
+  // checked shells for Ruby dup/clone; direct construction is rejected.
   // Secp256k1::KeyPair
   Secp256k1_KeyPair_class = rb_define_class_under(Secp256k1_module,
                                                   "KeyPair",
                                                   rb_cObject);
-  rb_undef_alloc_func(Secp256k1_KeyPair_class);
-  rb_define_alloc_func(Secp256k1_KeyPair_class, KeyPair_alloc);
+  ENABLE_VALUE_COPY(KeyPair);
   rb_define_method(Secp256k1_KeyPair_class, "public_key", KeyPair_public_key, 0);
   rb_define_method(Secp256k1_KeyPair_class, "private_key", KeyPair_private_key, 0);
   rb_define_method(Secp256k1_KeyPair_class, "xonly_public_key", KeyPair_xonly_public_key, 0);
@@ -2056,8 +2251,7 @@ void Init_rbsecp256k1(void)
   Secp256k1_PublicKey_class = rb_define_class_under(Secp256k1_module,
                                                     "PublicKey",
                                                     rb_cObject);
-  rb_undef_alloc_func(Secp256k1_PublicKey_class);
-  rb_define_alloc_func(Secp256k1_PublicKey_class, PublicKey_alloc);
+  ENABLE_VALUE_COPY(PublicKey);
   rb_define_method(Secp256k1_PublicKey_class,
                    "compressed",
                    PublicKey_compressed,
@@ -2083,8 +2277,7 @@ void Init_rbsecp256k1(void)
                                                          "XOnlyPublicKey",
                                                          rb_cObject);
 
-  rb_undef_alloc_func(Secp256k1_XOnlyPublicKey_class);
-  rb_define_alloc_func(Secp256k1_XOnlyPublicKey_class, XOnlyPublicKey_alloc);
+  ENABLE_VALUE_COPY(XOnlyPublicKey);
   rb_define_method(Secp256k1_XOnlyPublicKey_class,
                    "serialized",
                    XOnlyPublicKey_serialized,
@@ -2100,8 +2293,7 @@ void Init_rbsecp256k1(void)
   Secp256k1_PrivateKey_class = rb_define_class_under(
     Secp256k1_module, "PrivateKey", rb_cObject
   );
-  rb_undef_alloc_func(Secp256k1_PrivateKey_class);
-  rb_define_alloc_func(Secp256k1_PrivateKey_class, PrivateKey_alloc);
+  ENABLE_VALUE_COPY(PrivateKey);
   rb_define_method(Secp256k1_PrivateKey_class, "data", PrivateKey_data, 0);
   rb_define_method(Secp256k1_PrivateKey_class, "==", PrivateKey_equals, 1);
   rb_define_singleton_method(
@@ -2115,8 +2307,7 @@ void Init_rbsecp256k1(void)
   Secp256k1_Signature_class = rb_define_class_under(Secp256k1_module,
                                                     "Signature",
                                                     rb_cObject);
-  rb_undef_alloc_func(Secp256k1_Signature_class);
-  rb_define_alloc_func(Secp256k1_Signature_class, Signature_alloc);
+  ENABLE_VALUE_COPY(Signature);
   rb_define_method(Secp256k1_Signature_class,
                    "der_encoded",
                    Signature_der_encoded,
@@ -2153,11 +2344,7 @@ void Init_rbsecp256k1(void)
     "RecoverableSignature",
     rb_cObject
   );
-  rb_undef_alloc_func(Secp256k1_RecoverableSignature_class);
-  rb_define_alloc_func(
-    Secp256k1_RecoverableSignature_class,
-    RecoverableSignature_alloc
-  );
+  ENABLE_VALUE_COPY(RecoverableSignature);
   rb_define_method(
     Secp256k1_RecoverableSignature_class,
     "compact",
@@ -2205,7 +2392,6 @@ void Init_rbsecp256k1(void)
     rb_cObject
   );
   rb_undef_alloc_func(Secp256k1_SharedSecret_class);
-  rb_define_alloc_func(Secp256k1_SharedSecret_class, SharedSecret_alloc);
   rb_define_attr(Secp256k1_SharedSecret_class, "data", 1, 0);
 
   // Context EC Diffie-Hellman methods
@@ -2222,8 +2408,7 @@ void Init_rbsecp256k1(void)
     Secp256k1_module,
     "SchnorrSignature",
     rb_cObject);
-  rb_undef_alloc_func(Secp256k1_SchnorrSignature_class);
-  rb_define_alloc_func(Secp256k1_SchnorrSignature_class, SchnorrSignature_alloc);
+  ENABLE_VALUE_COPY(SchnorrSignature);
   rb_define_method(Secp256k1_SchnorrSignature_class, "serialized", SchnorrSignature_serialized, 0);
   rb_define_method(Secp256k1_SchnorrSignature_class, "verify", SchnorrSignature_verify, 2);
   rb_define_method(Secp256k1_SchnorrSignature_class, "==", SchnorrSignature_equals, 1);