sha3 2.2.2 → 2.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d5da48a8f70ea2746484300e05125b21ab1fcd5837d0f194d8b12fac46a46602
-  data.tar.gz: 7be8cf46c2e1e4bc38dedb64b25654f70806d6c761427b062c171bf0df359caa
+  metadata.gz: 9efe4158e87ea949852977b7791cf56838a9fefdbe226ebf7fdb4c5e962e927b
+  data.tar.gz: 6f41a24a48b714a33f846e6458aad350be5168f33202c51a95bda7a364cffc5f
 SHA512:
-  metadata.gz: 57e70a0c38eb04f0aab1fe81f0c3ee60a6eb2bc7ea6c6f2e57f8712f23084139bd4a494cde70ad99eca7e20fe1534adb7f91b9986a4ad31ac1127ffa4a115d07
-  data.tar.gz: 0b7cdd43dc7167e3e92f4ec2adfb947c00f0b8827aaaeafb9383213bdd1bc09771c0b17efec3d28667b1bb383646f006360496abf3dfd43a2a6cd54f8e1dd4c2
+  metadata.gz: 21086756d157c20bd8f74fde996cabfc8c2a8975b913cab0da03a311d41eb3d44427e344419344e7d8729b21edf0c1d550732c583df8a1f2797b700b64468464
+  data.tar.gz: fd6dacfcb827ecbdf8d3d60cd1b9dfacd6f50fc9c4440100890fbac7302d26f8119da33f95b67c270c73b6f75789a7b5e569e04c638a834dce9ff99a5b2050a7

data/.rubocop.yml

@@ -6,8 +6,74 @@ AllCops:
   NewCops: enable
   TargetRubyVersion: 2.7
 
+  Exclude:
+    - ext/**/*.rb
+
 Layout/LineLength:
   Max: 120
 
+# Metrics
+
+Metrics/AbcSize:
+  Exclude:
+    - spec/**/*_spec.rb
+
+Metrics/CyclomaticComplexity:
+  Exclude:
+    - spec/**/*_spec.rb
+
+Metrics/PerceivedComplexity:
+  Exclude:
+    - spec/**/*_spec.rb
+
+Metrics/MethodLength:
+  Max: 15
+  Exclude:
+    - spec/**/*_spec.rb
+
+# Naming
+
+Naming/ClassAndModuleCamelCase:
+  Enabled: false
+
 Naming/VariableNumber:
   EnforcedStyle: snake_case
+  Exclude:
+    - spec/**/*.rb
+
+# Security
+
+# Allow URI.open for test vector downloads
+Security/Open:
+  Exclude:
+    - spec/sha3_digest_vectors_spec.rb
+
+# RSpec configuration
+
+RSpec/ExampleLength:
+  Max: 15
+  CountAsOne:
+    - array
+    - hash
+    - heredoc
+
+RSpec/MultipleExpectations:
+  Max: 8
+
+RSpec/SpecFilePathFormat:
+  Enabled: false
+
+RSpec/LeakyConstantDeclaration:
+  Enabled: false
+
+RSpec/BeforeAfterAll:
+  Enabled: false
+
+RSpec/MultipleDescribes:
+  Enabled: false
+
+RSpec/NamedSubject:
+  Enabled: false
+
+RSpec/DescribeClass:
+  Enabled: false

data/ext/sha3/common.h

@@ -0,0 +1,118 @@
+// Copyright (c) 2025 Johanns Gregorian <io+sha3@jsg.io>
+
+#ifndef _SHA3_COMMON_H_
+#define _SHA3_COMMON_H_
+
+#include <ruby.h>
+
+#include "sp800_185.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Common macros for SP800-185 based implementations (CSHAKE, KMAC) */
+
+/* Define a simple method that just calls an sp800_185 function */
+#define DEFINE_SP800_185_SIMPLE_METHOD(method_name, sp_func, get_ctx_func) \
+    static VALUE method_name(VALUE self, VALUE data) {                     \
+        sp800_185_context_t *context;                                      \
+        get_ctx_func(self, &context);                                      \
+        sp_func(context, data);                                            \
+        return self;                                                       \
+    }
+
+/* Define a method that returns a value from sp800_185 function */
+#define DEFINE_SP800_185_RETURN_METHOD(method_name, sp_func, get_ctx_func) \
+    static VALUE method_name(VALUE self) {                                 \
+        sp800_185_context_t *context;                                      \
+        get_ctx_func(self, &context);                                      \
+        return sp_func(context);                                           \
+    }
+
+/* Define a method with single VALUE parameter that returns VALUE */
+#define DEFINE_SP800_185_VALUE_METHOD(method_name, sp_func, get_ctx_func) \
+    static VALUE method_name(VALUE self, VALUE param) {                   \
+        sp800_185_context_t *context;                                     \
+        get_ctx_func(self, &context);                                     \
+        return sp_func(context, param);                                   \
+    }
+
+/* Define a method with variable arguments */
+#define DEFINE_SP800_185_VARARGS_METHOD(method_name, sp_func, get_ctx_func) \
+    static VALUE method_name(int argc, VALUE *argv, VALUE self) {           \
+        sp800_185_context_t *context;                                       \
+        get_ctx_func(self, &context);                                       \
+        VALUE param = argc > 0 ? argv[0] : Qnil;                            \
+        return sp_func(context, param);                                     \
+    }
+
+/* Define common memory management functions */
+#define DEFINE_SP800_185_MEMORY_FUNCS(prefix, context_type)                                              \
+    static void prefix##_free_context(void *ptr) { sp800_185_free_context((sp800_185_context_t *)ptr); } \
+                                                                                                         \
+    static size_t prefix##_context_size(const void *ptr) {                                               \
+        return sp800_185_context_size((const sp800_185_context_t *)ptr, sizeof(context_type));           \
+    }
+
+/* Define common allocation function */
+#define DEFINE_SP800_185_ALLOC(prefix, context_type, instance_type, error_class)                                      \
+    static VALUE rb_##prefix##_alloc(VALUE klass) {                                                                   \
+        context_type *context = (context_type *)sp800_185_alloc_context(sizeof(context_type), sizeof(instance_type)); \
+                                                                                                                      \
+        if (!context) {                                                                                               \
+            rb_raise(error_class, "failed to allocate memory");                                                       \
+        }                                                                                                             \
+                                                                                                                      \
+        VALUE obj = TypedData_Wrap_Struct(klass, &prefix##_data_type, context);                                       \
+        return obj;                                                                                                   \
+    }
+
+/* Define common copy method */
+#define DEFINE_SP800_185_COPY_METHOD(method_name, context_type, data_type, class_var)                    \
+    static VALUE method_name(VALUE self, VALUE other) {                                                  \
+        context_type *context, *other_context;                                                           \
+                                                                                                         \
+        rb_check_frozen(self);                                                                           \
+        if (self == other) {                                                                             \
+            return self;                                                                                 \
+        }                                                                                                \
+                                                                                                         \
+        if (!rb_obj_is_kind_of(other, class_var)) {                                                      \
+            rb_raise(rb_eTypeError, "wrong argument (%s)! (expected %s)", rb_obj_classname(other),       \
+                     rb_class2name(class_var));                                                          \
+        }                                                                                                \
+                                                                                                         \
+        TypedData_Get_Struct(other, context_type, &data_type, other_context);                            \
+        TypedData_Get_Struct(self, context_type, &data_type, context);                                   \
+                                                                                                         \
+        /* Copy the base context attributes */                                                           \
+        context->base.functions = other_context->base.functions;                                         \
+        context->base.output_length = other_context->base.output_length;                                 \
+        context->base.error_class = other_context->base.error_class;                                     \
+                                                                                                         \
+        /* Copy the algorithm-specific state */                                                          \
+        if (context->base.functions && other_context->base.state) {                                      \
+            memcpy(context->base.state, other_context->base.state, context->base.functions->state_size); \
+        }                                                                                                \
+                                                                                                         \
+        return self;                                                                                     \
+    }
+
+/* Ruby wrapper functions for SP800-185 operations */
+VALUE sp800_185_rb_update(sp800_185_context_t *context, VALUE data);
+VALUE sp800_185_rb_name(sp800_185_context_t *context);
+VALUE sp800_185_rb_finish(sp800_185_context_t *context, VALUE output);
+VALUE sp800_185_rb_digest(sp800_185_context_t *context, VALUE data);
+VALUE sp800_185_rb_hexdigest(sp800_185_context_t *context, VALUE data);
+VALUE sp800_185_rb_squeeze(sp800_185_context_t *context, VALUE length);
+VALUE sp800_185_rb_hex_squeeze(sp800_185_context_t *context, VALUE length);
+
+/* Helper function to register common methods */
+void register_sp800_185_common_methods(VALUE klass);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _SHA3_COMMON_H_ */

data/ext/sha3/cshake.c

@@ -1,5 +1,6 @@
 #include "cshake.h"
 
+#include "common.h"
 #include "sha3.h"
 #include "sp800_185.h"
 
@@ -76,7 +77,7 @@ void Init_sha3_cshake(void) {
     /*
      * Document-class: SHA3::CSHAKE::Error
      *
-     * All KMAC methods raise this exception on error.
+     * All CSHAKE methods raise this exception on error.
      *
      * It is a subclass of the StandardError class -- see the Ruby documentation
      * for more information.
@@ -104,25 +105,11 @@ void Init_sha3_cshake(void) {
     return;
 }
 
-static void sha3_cshake_free_context(void *ptr) { sp800_185_free_context((sp800_185_context_t *)ptr); }
+/* Use common memory management functions */
+DEFINE_SP800_185_MEMORY_FUNCS(sha3_cshake, sha3_cshake_context_t)
 
-static size_t sha3_cshake_context_size(const void *ptr) {
-    return sp800_185_context_size((const sp800_185_context_t *)ptr, sizeof(sha3_cshake_context_t));
-}
-
-static VALUE rb_sha3_cshake_alloc(VALUE klass) {
-    sha3_cshake_context_t *context =
-        (sha3_cshake_context_t *)sp800_185_alloc_context(sizeof(sha3_cshake_context_t), sizeof(cSHAKE_Instance));
-
-    if (!context) {
-        rb_raise(_sha3_cshake_error_class, "failed to allocate memory");
-    }
-
-    // Create the Ruby object with TypedData - this will automatically handle freeing
-    VALUE obj = TypedData_Wrap_Struct(klass, &sha3_cshake_data_type, context);
-
-    return obj;
-}
+/* Use common allocation function */
+DEFINE_SP800_185_ALLOC(sha3_cshake, sha3_cshake_context_t, cSHAKE_Instance, _sha3_cshake_error_class)
 
 /*
  * :call-seq:
@@ -144,14 +131,14 @@ static VALUE rb_sha3_cshake_alloc(VALUE klass) {
  *   _optional_ The customization string to use
  *
  * = example
- *   # Initialize instance for fix-ed-length operation
+ *   # Initialize instance for fixed-length operation
  *   cshake = SHA3::CSHAKE.new(:cshake_128, 32, name: 'my-app')
  *   cshake << 'data...'
  *   cshake.hexdigest
  *
  *   # Initialize instance for XOF operation (arbitrary-long output)
  *   cshake = SHA3::CSHAKE.new(:cshake_256, 0, customization: 'Email Signature')
- *   cshask.update('data...')
+ *   cshake.update('data...')
  *   cshake.squeeze(64)
  */
 static VALUE rb_sha3_cshake_init(int argc, VALUE *argv, VALUE self) {
@@ -233,31 +220,7 @@ static VALUE rb_sha3_cshake_init(int argc, VALUE *argv, VALUE self) {
  * = example
  *  cshake2 = cshake.dup
  */
-static VALUE rb_sha3_cshake_copy(VALUE self, VALUE other) {
-    sha3_cshake_context_t *context, *other_context;
-
-    rb_check_frozen(self);
-    if (self == other) {
-        return self;
-    }
-
-    if (!rb_obj_is_kind_of(other, _sha3_cshake_class)) {
-        rb_raise(rb_eTypeError, "wrong argument (%s)! (expected %s)", rb_obj_classname(other),
-                 rb_class2name(_sha3_cshake_class));
-    }
-
-    TypedData_Get_Struct(other, sha3_cshake_context_t, &sha3_cshake_data_type, other_context);
-    TypedData_Get_Struct(self, sha3_cshake_context_t, &sha3_cshake_data_type, context);
-
-    // Copy the base context attributes
-    context->base.functions = other_context->base.functions;
-    context->base.output_length = other_context->base.output_length;
-
-    // Copy the algorithm-specific state
-    memcpy(context->base.state, other_context->base.state, context->base.functions->state_size);
-
-    return self;
-}
+DEFINE_SP800_185_COPY_METHOD(rb_sha3_cshake_copy, sha3_cshake_context_t, sha3_cshake_data_type, _sha3_cshake_class)
 
 /*
  * :call-seq:
@@ -272,13 +235,7 @@ static VALUE rb_sha3_cshake_copy(VALUE self, VALUE other) {
  *   cshake.update("more data")
  *   cshake << "more data"  # alias for update
  */
-static VALUE rb_sha3_cshake_update(VALUE self, VALUE data) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-    sp800_185_update(context, data);
-
-    return self;
-}
+DEFINE_SP800_185_SIMPLE_METHOD(rb_sha3_cshake_update, sp800_185_rb_update, get_cshake_context)
 
 /*
  * :call-seq:
@@ -286,12 +243,7 @@ static VALUE rb_sha3_cshake_update(VALUE self, VALUE data) {
  *
  * Returns the name of the CSHAKE instance.
  */
-static VALUE rb_sha3_cshake_name(VALUE self) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-
-    return rb_str_new2(sp800_185_name(context));
-}
+DEFINE_SP800_185_RETURN_METHOD(rb_sha3_cshake_name, sp800_185_rb_name, get_cshake_context)
 
 /*
  * :call-seq:
@@ -305,13 +257,7 @@ static VALUE rb_sha3_cshake_name(VALUE self) {
  * = example
  *   cshake.finish
  */
-static VALUE rb_sha3_cshake_finish(int argc, VALUE *argv, VALUE self) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-
-    VALUE output = argc > 0 ? argv[0] : Qnil;
-    return sp800_185_finish(context, output);
-}
+DEFINE_SP800_185_VARARGS_METHOD(rb_sha3_cshake_finish, sp800_185_rb_finish, get_cshake_context)
 
 /*
  * :call-seq:
@@ -326,14 +272,7 @@ static VALUE rb_sha3_cshake_finish(int argc, VALUE *argv, VALUE self) {
  *   cshake.digest
  *   cshake.digest("final chunk")
  */
-static VALUE rb_sha3_cshake_digest(int argc, VALUE *argv, VALUE self) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-
-    VALUE data = argc > 0 ? argv[0] : Qnil;
-
-    return sp800_185_digest(context, data);
-}
+DEFINE_SP800_185_VARARGS_METHOD(rb_sha3_cshake_digest, sp800_185_rb_digest, get_cshake_context)
 
 /*
  * :call-seq:
@@ -348,14 +287,7 @@ static VALUE rb_sha3_cshake_digest(int argc, VALUE *argv, VALUE self) {
  *   cshake.hexdigest
  *   cshake.hexdigest("final chunk")
  */
-static VALUE rb_sha3_cshake_hexdigest(int argc, VALUE *argv, VALUE self) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-
-    VALUE data = argc > 0 ? argv[0] : Qnil;
-
-    return sp800_185_hexdigest(context, data);
-}
+DEFINE_SP800_185_VARARGS_METHOD(rb_sha3_cshake_hexdigest, sp800_185_rb_hexdigest, get_cshake_context)
 
 /*
  * :call-seq:
@@ -369,12 +301,7 @@ static VALUE rb_sha3_cshake_hexdigest(int argc, VALUE *argv, VALUE self) {
  * = example
  *   cshake.squeeze(32)
  */
-static VALUE rb_sha3_cshake_squeeze(VALUE self, VALUE length) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-
-    return sp800_185_squeeze(context, length);
-}
+DEFINE_SP800_185_VALUE_METHOD(rb_sha3_cshake_squeeze, sp800_185_rb_squeeze, get_cshake_context)
 
 /*
  * :call-seq:
@@ -388,9 +315,4 @@ static VALUE rb_sha3_cshake_squeeze(VALUE self, VALUE length) {
  * = example
  *   cshake.hex_squeeze(32)
  */
-static VALUE rb_sha3_cshake_hex_squeeze(VALUE self, VALUE length) {
-    sp800_185_context_t *context;
-    get_cshake_context(self, &context);
-
-    return sp800_185_hex_squeeze(context, length);
-}
+DEFINE_SP800_185_VALUE_METHOD(rb_sha3_cshake_hex_squeeze, sp800_185_rb_hex_squeeze, get_cshake_context)

data/ext/sha3/digest.c

@@ -79,15 +79,16 @@ static ID _shake_128_id;
 static ID _shake_256_id;
 
 /* TypedData structure for sha3_digest_context_t */
-const rb_data_type_t sha3_digest_data_type_t = {"SHA3::Digest",
-                                                {
-                                                    NULL,
-                                                    sha3_digest_free_context,
-                                                    sha3_digest_context_size,
-                                                },
-                                                NULL,
-                                                NULL,
-                                                RUBY_TYPED_FREE_IMMEDIATELY};
+const rb_data_type_t sha3_digest_data_type = {"SHA3::Digest",
+                                              {
+                                                  NULL,
+                                                  sha3_digest_free_context,
+                                                  sha3_digest_context_size,
+                                                  NULL,
+                                              },
+                                              NULL,
+                                              NULL,
+                                              RUBY_TYPED_FREE_IMMEDIATELY};
 
 void Init_sha3_digest(void) {
     rb_require("digest");
@@ -154,10 +155,14 @@ void Init_sha3_digest(void) {
 
 // Static inline functions replacing macros
 static inline void get_sha3_digest_context(VALUE obj, sha3_digest_context_t **context) {
-    TypedData_Get_Struct((obj), sha3_digest_context_t, &sha3_digest_data_type_t, (*context));
+    TypedData_Get_Struct((obj), sha3_digest_context_t, &sha3_digest_data_type, (*context));
     if (!(*context)) {
         rb_raise(rb_eRuntimeError, "Digest data not initialized!");
     }
+
+    if (!(*context)->state) {
+        rb_raise(rb_eRuntimeError, "Digest state not initialized!");
+    }
 }
 
 static inline void safe_get_sha3_digest_context(VALUE obj, sha3_digest_context_t **context) {
@@ -170,36 +175,36 @@ static inline void safe_get_sha3_digest_context(VALUE obj, sha3_digest_context_t
 
 static inline int is_shake_algorithm(sha3_digest_algorithms alg) { return alg == SHAKE_128 || alg == SHAKE_256; }
 
-int get_hashbit_length(VALUE obj, sha3_digest_algorithms *algorithm) {
-    if (TYPE(obj) == T_SYMBOL) {
-        ID symid = SYM2ID(obj);
-
-        if (symid == _sha3_224_id) {
-            *algorithm = SHA3_224;
-            return 224;
-        } else if (symid == _sha3_256_id) {
-            *algorithm = SHA3_256;
-            return 256;
-        } else if (symid == _sha3_384_id) {
-            *algorithm = SHA3_384;
-            return 384;
-        } else if (symid == _sha3_512_id) {
-            *algorithm = SHA3_512;
-            return 512;
-        } else if (symid == _shake_128_id) {
-            *algorithm = SHAKE_128;
-            return 128;
-        } else if (symid == _shake_256_id) {
-            *algorithm = SHAKE_256;
-            return 256;
-        }
-
-        rb_raise(rb_eArgError,
-                 "invalid hash algorithm symbol (should be: :sha3_224, "
-                 ":sha3_256, :sha3_384, :sha3_512, :shake_128, or :shake_256)");
-    }
-
-    rb_raise(_sha3_digest_error_class, "unknown type value");
+static int get_hashbit_length(VALUE obj, sha3_digest_algorithms *algorithm) {
+    if (TYPE(obj) != T_SYMBOL) {
+        rb_raise(_sha3_digest_error_class, "hash algorithm must be a symbol");
+    }
+
+    ID symid = SYM2ID(obj);
+
+    if (symid == _sha3_224_id) {
+        *algorithm = SHA3_224;
+        return 224;
+    } else if (symid == _sha3_256_id) {
+        *algorithm = SHA3_256;
+        return 256;
+    } else if (symid == _sha3_384_id) {
+        *algorithm = SHA3_384;
+        return 384;
+    } else if (symid == _sha3_512_id) {
+        *algorithm = SHA3_512;
+        return 512;
+    } else if (symid == _shake_128_id) {
+        *algorithm = SHAKE_128;
+        return 128;
+    } else if (symid == _shake_256_id) {
+        *algorithm = SHAKE_256;
+        return 256;
+    }
+
+    rb_raise(rb_eArgError,
+             "invalid hash algorithm symbol (should be: :sha3_224, "
+             ":sha3_256, :sha3_384, :sha3_512, :shake_128, or :shake_256)");
 
     return 0;  // Never reached, but silences compiler warnings
 }
@@ -208,9 +213,10 @@ static void sha3_digest_free_context(void *ptr) {
     sha3_digest_context_t *context = (sha3_digest_context_t *)ptr;
     if (context) {
         if (context->state) {
-            free(context->state);
+            ruby_xfree(context->state);
+            context->state = NULL;
         }
-        free(context);
+        ruby_xfree(context);
     }
 }
 
@@ -245,21 +251,22 @@ static HashReturn keccak_hash_initialize(sha3_digest_context_t *context) {
 }
 
 static VALUE rb_sha3_digest_alloc(VALUE klass) {
-    sha3_digest_context_t *context = (sha3_digest_context_t *)malloc(sizeof(sha3_digest_context_t));
+    sha3_digest_context_t *context = RB_ALLOC(sha3_digest_context_t);
     if (!context) {
         rb_raise(_sha3_digest_error_class, "failed to allocate object memory");
     }
 
-    context->state = (Keccak_HashInstance *)calloc(1, sizeof(Keccak_HashInstance));
+    context->state = RB_ALLOC(Keccak_HashInstance);
     if (!context->state) {
-        sha3_digest_free_context(context);
+        ruby_xfree(context);
         rb_raise(_sha3_digest_error_class, "failed to allocate state memory");
     }
+    memset(context->state, 0, sizeof(*context->state));
 
-    VALUE obj = TypedData_Wrap_Struct(klass, &sha3_digest_data_type_t, context);
     context->hashbitlen = 0;
-    context->algorithm = SHA3_256;  // Default algorithm
+    context->algorithm = SHA3_256;
 
+    VALUE obj = TypedData_Wrap_Struct(klass, &sha3_digest_data_type, context);
     return obj;
 }
 
@@ -342,7 +349,13 @@ static VALUE rb_sha3_digest_update(VALUE self, VALUE data) {
         rb_raise(_sha3_digest_error_class, "cannot update with NULL data");
     }
 
-    dlen = (RSTRING_LEN(data) * 8);
+    // Prevent integer overflow and validate size
+    size_t data_len = RSTRING_LEN(data);
+    if (data_len > SIZE_MAX / 8) {
+        rb_raise(_sha3_digest_error_class, "data too large (exceeds maximum size)");
+    }
+
+    dlen = (data_len * 8);
 
     if (Keccak_HashUpdate(context->state, (BitSequence *)RSTRING_PTR(data), dlen) != KECCAK_SUCCESS) {
         rb_raise(_sha3_digest_error_class, "failed to update hash data");
@@ -374,6 +387,10 @@ static VALUE rb_sha3_digest_reset(VALUE self) {
 }
 
 static int compare_contexts(const sha3_digest_context_t *context1, const sha3_digest_context_t *context2) {
+    if (!context1 || !context2 || !context1->state || !context2->state) {
+        return 0;
+    }
+
     // First check the hashbitlen and algorithm
     if (context1->hashbitlen != context2->hashbitlen || context1->algorithm != context2->algorithm) {
         return 0;
@@ -429,7 +446,11 @@ static VALUE rb_sha3_digest_copy(VALUE self, VALUE other) {
     }
 
     safe_get_sha3_digest_context(other, &other_context);
-    get_sha3_digest_context(self, &context);
+    safe_get_sha3_digest_context(self, &context);
+
+    if (!context || !other_context) {
+        rb_raise(_sha3_digest_error_class, "invalid context for copy");
+    }
 
     context->hashbitlen = other_context->hashbitlen;
     context->algorithm = other_context->algorithm;
@@ -489,17 +510,17 @@ static VALUE rb_sha3_digest_name(VALUE self) {
 
     switch (context->algorithm) {
         case SHA3_224:
-            return rb_str_new2("SHA3-224");
+            return rb_str_new_cstr("SHA3-224");
         case SHA3_256:
-            return rb_str_new2("SHA3-256");
+            return rb_str_new_cstr("SHA3-256");
         case SHA3_384:
-            return rb_str_new2("SHA3-384");
+            return rb_str_new_cstr("SHA3-384");
         case SHA3_512:
-            return rb_str_new2("SHA3-512");
+            return rb_str_new_cstr("SHA3-512");
         case SHAKE_128:
-            return rb_str_new2("SHAKE128");
+            return rb_str_new_cstr("SHAKE128");
         case SHAKE_256:
-            return rb_str_new2("SHAKE256");
+            return rb_str_new_cstr("SHAKE256");
         default:
             rb_raise(_sha3_digest_error_class, "unknown algorithm");
     }
@@ -560,15 +581,19 @@ static VALUE rb_sha3_digest_finish(int argc, VALUE *argv, VALUE self) {
 static VALUE rb_sha3_digest_squeeze(VALUE self, VALUE length) {
     sha3_digest_context_t *context;
     VALUE str, copy;
-    int output_bytes;
+    long output_bytes;
 
     Check_Type(length, T_FIXNUM);
-    output_bytes = NUM2INT(length);
+    output_bytes = NUM2LONG(length);
 
     if (output_bytes <= 0) {
         rb_raise(_sha3_digest_error_class, "output length must be positive");
     }
 
+    if (output_bytes > (1L << 20)) {  // Limit to 1MB output
+        rb_raise(_sha3_digest_error_class, "output length too large (max 1MB)");
+    }
+
     get_sha3_digest_context(self, &context);
 
     // Only SHAKE algorithms support arbitrary-length output
@@ -578,6 +603,9 @@ static VALUE rb_sha3_digest_squeeze(VALUE self, VALUE length) {
 
     // Create a copy of the digest object to avoid modifying the original
     copy = rb_obj_clone(self);
+    if (NIL_P(copy)) {
+        rb_raise(_sha3_digest_error_class, "failed to clone digest object");
+    }
 
     // Get the sha3_digest_context_t struct from the copy
     sha3_digest_context_t *context_copy;
@@ -615,7 +643,7 @@ static VALUE rb_sha3_digest_hex_squeeze(VALUE self, VALUE length) {
     // Get the binary output using the existing squeeze function
     VALUE bin_str = rb_sha3_digest_squeeze(self, length);
     // Use Ruby's built-in unpack method to convert to hex
-    return rb_funcall(bin_str, rb_intern("unpack1"), 1, rb_str_new2("H*"));
+    return rb_funcall(bin_str, rb_intern("unpack1"), 1, rb_str_new_cstr("H*"));
 }
 
 static VALUE prepare_shake_output(VALUE self, int argc, VALUE *argv, int hex_output) {
@@ -800,32 +828,26 @@ static VALUE rb_sha3_digest_self_digest(VALUE klass, VALUE name, VALUE data) {
  * To squeeze a different length, use #hex_squeeze instance method.
  */
 static VALUE rb_sha3_digest_self_hexdigest(VALUE klass, VALUE name, VALUE data) {
-    VALUE args[2];
+    VALUE digest;
 
-    // Need to add type checking for the data parameter
-    StringValue(data);
+    if (NIL_P(name) || NIL_P(data)) {
+        rb_raise(_sha3_digest_error_class, "algorithm name and data cannot be nil");
+    }
 
-    /* For SHAKE algorithms, we need to handle them differently */
-    if (TYPE(name) == T_SYMBOL) {
-        ID symid = SYM2ID(name);
-        if (symid == _shake_128_id || symid == _shake_256_id) {
-            /* Create a new digest instance with the specified algorithm */
-            VALUE digest = rb_class_new_instance(1, &name, klass);
+    if (TYPE(name) != T_SYMBOL) {
+        rb_raise(_sha3_digest_error_class, "algorithm name must be a symbol");
+    }
 
-            /* Update it with the data */
-            rb_sha3_digest_update(digest, data);
+    StringValue(data);
 
-            /* For SHAKE algorithms, use a default output length based on the security strength */
-            int output_length = (symid == _shake_128_id) ? 16 : 32; /* 128/8 or 256/8 */
+    ID symid = SYM2ID(name);
+    digest = rb_class_new_instance(1, &name, klass);
+    rb_sha3_digest_update(digest, data);
 
-            /* Return the hexadecimal representation of the squeezed output */
-            return rb_sha3_digest_hex_squeeze(digest, INT2NUM(output_length));
-        }
+    if (symid == _shake_128_id || symid == _shake_256_id) {
+        int output_length = (symid == _shake_128_id) ? 16 : 32;
+        return rb_sha3_digest_hex_squeeze(digest, INT2NUM(output_length));
     }
 
-    /* Call the superclass method with arguments in reverse order */
-    args[0] = data;
-    args[1] = name;
-
-    return rb_call_super(2, args);
+    return rb_funcall(digest, rb_intern("hexdigest"), 0);
 }

data/ext/sha3/kmac.c

@@ -1,5 +1,6 @@
 #include "kmac.h"
 
+#include "common.h"
 #include "sha3.h"
 #include "sp800_185.h"
 
@@ -42,7 +43,7 @@ static ID _kmac_128_id;
 static ID _kmac_256_id;
 
 /* TypedData structure for sha3_kmac_context_t */
-const rb_data_type_t sha3_kmac_data_type_t = {
+const rb_data_type_t sha3_kmac_data_type = {
     "SHA3::KMAC",
     {
         NULL, sha3_kmac_free_context, sha3_kmac_context_size, NULL, /* dcompact field */
@@ -55,7 +56,7 @@ const rb_data_type_t sha3_kmac_data_type_t = {
 // Helper function to extract context from a Ruby object
 void get_kmac_context(VALUE obj, sp800_185_context_t **context) {
     sha3_kmac_context_t *kmac_ctx;
-    TypedData_Get_Struct(obj, sha3_kmac_context_t, &sha3_kmac_data_type_t, kmac_ctx);
+    TypedData_Get_Struct(obj, sha3_kmac_context_t, &sha3_kmac_data_type, kmac_ctx);
     *context = &kmac_ctx->base;
 }
 
@@ -104,25 +105,11 @@ void Init_sha3_kmac(void) {
     return;
 }
 
-static void sha3_kmac_free_context(void *ptr) { sp800_185_free_context((sp800_185_context_t *)ptr); }
+/* Use common memory management functions */
+DEFINE_SP800_185_MEMORY_FUNCS(sha3_kmac, sha3_kmac_context_t)
 
-static size_t sha3_kmac_context_size(const void *ptr) {
-    return sp800_185_context_size((const sp800_185_context_t *)ptr, sizeof(sha3_kmac_context_t));
-}
-
-static VALUE rb_sha3_kmac_alloc(VALUE klass) {
-    sha3_kmac_context_t *context =
-        (sha3_kmac_context_t *)sp800_185_alloc_context(sizeof(sha3_kmac_context_t), sizeof(KMAC_Instance));
-
-    if (!context) {
-        rb_raise(_sha3_kmac_error_class, "failed to allocate memory");
-    }
-
-    // Create the Ruby object with TypedData - this will automatically handle freeing
-    VALUE obj = TypedData_Wrap_Struct(klass, &sha3_kmac_data_type_t, context);
-
-    return obj;
-}
+/* Use common allocation function */
+DEFINE_SP800_185_ALLOC(sha3_kmac, sha3_kmac_context_t, KMAC_Instance, _sha3_kmac_error_class)
 
 /*
  * :call-seq:
@@ -179,7 +166,7 @@ static VALUE rb_sha3_kmac_init(int argc, VALUE *argv, VALUE self) {
     }
 
     sha3_kmac_context_t *context;
-    TypedData_Get_Struct(self, sha3_kmac_context_t, &sha3_kmac_data_type_t, context);
+    TypedData_Get_Struct(self, sha3_kmac_context_t, &sha3_kmac_data_type, context);
 
     // Store the output length in bits
     context->base.output_length = NUM2ULONG(output_length) * 8;
@@ -229,31 +216,7 @@ static VALUE rb_sha3_kmac_init(int argc, VALUE *argv, VALUE self) {
  * = example
  *   new_kmac = kmac.dup
  */
-static VALUE rb_sha3_kmac_copy(VALUE self, VALUE other) {
-    sha3_kmac_context_t *context, *other_context;
-
-    rb_check_frozen(self);
-    if (self == other) {
-        return self;
-    }
-
-    if (!rb_obj_is_kind_of(other, _sha3_kmac_class)) {
-        rb_raise(rb_eTypeError, "wrong argument (%s)! (expected %s)", rb_obj_classname(other),
-                 rb_class2name(_sha3_kmac_class));
-    }
-
-    TypedData_Get_Struct(other, sha3_kmac_context_t, &sha3_kmac_data_type_t, other_context);
-    TypedData_Get_Struct(self, sha3_kmac_context_t, &sha3_kmac_data_type_t, context);
-
-    // Copy the base context attributes
-    context->base.functions = other_context->base.functions;
-    context->base.output_length = other_context->base.output_length;
-
-    // Copy the algorithm-specific state
-    memcpy(context->base.state, other_context->base.state, context->base.functions->state_size);
-
-    return self;
-}
+DEFINE_SP800_185_COPY_METHOD(rb_sha3_kmac_copy, sha3_kmac_context_t, sha3_kmac_data_type, _sha3_kmac_class)
 
 /*
  * :call-seq:
@@ -268,13 +231,7 @@ static VALUE rb_sha3_kmac_copy(VALUE self, VALUE other) {
  *   kmac.update("more data")
  *   kmac << "more data"  # alias for update
  */
-static VALUE rb_sha3_kmac_update(VALUE self, VALUE data) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-    sp800_185_update(context, data);
-
-    return self;
-}
+DEFINE_SP800_185_SIMPLE_METHOD(rb_sha3_kmac_update, sp800_185_rb_update, get_kmac_context)
 
 /*
  * :call-seq:
@@ -285,12 +242,7 @@ static VALUE rb_sha3_kmac_update(VALUE self, VALUE data) {
  * = example
  *   kmac.name  #=> "KMAC128" or "KMAC256"
  */
-static VALUE rb_sha3_kmac_name(VALUE self) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-
-    return rb_str_new2(sp800_185_name(context));
-}
+DEFINE_SP800_185_RETURN_METHOD(rb_sha3_kmac_name, sp800_185_rb_name, get_kmac_context)
 
 /*
  * :call-seq:
@@ -304,14 +256,7 @@ static VALUE rb_sha3_kmac_name(VALUE self) {
  * = example
  *   kmac.finish
  */
-static VALUE rb_sha3_kmac_finish(int argc, VALUE *argv, VALUE self) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-
-    VALUE output = argc > 0 ? argv[0] : Qnil;
-
-    return sp800_185_finish(context, output);
-}
+DEFINE_SP800_185_VARARGS_METHOD(rb_sha3_kmac_finish, sp800_185_rb_finish, get_kmac_context)
 
 /*
  * :call-seq:
@@ -329,14 +274,7 @@ static VALUE rb_sha3_kmac_finish(int argc, VALUE *argv, VALUE self) {
  *   kmac.digest
  *   kmac.digest('final chunk')
  */
-static VALUE rb_sha3_kmac_digest(int argc, VALUE *argv, VALUE self) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-
-    VALUE data = argc > 0 ? argv[0] : Qnil;
-
-    return sp800_185_digest(context, data);
-}
+DEFINE_SP800_185_VARARGS_METHOD(rb_sha3_kmac_digest, sp800_185_rb_digest, get_kmac_context)
 
 /*
  * :call-seq:
@@ -354,14 +292,7 @@ static VALUE rb_sha3_kmac_digest(int argc, VALUE *argv, VALUE self) {
  *   kmac.hexdigest
  *   kmac.hexdigest('final chunk')
  */
-static VALUE rb_sha3_kmac_hexdigest(int argc, VALUE *argv, VALUE self) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-
-    VALUE data = argc > 0 ? argv[0] : Qnil;
-
-    return sp800_185_hexdigest(context, data);
-}
+DEFINE_SP800_185_VARARGS_METHOD(rb_sha3_kmac_hexdigest, sp800_185_rb_hexdigest, get_kmac_context)
 
 /*
  * :call-seq:
@@ -377,12 +308,7 @@ static VALUE rb_sha3_kmac_hexdigest(int argc, VALUE *argv, VALUE self) {
  * = example
  *   kmac.squeeze(128)
  */
-static VALUE rb_sha3_kmac_squeeze(VALUE self, VALUE length) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-
-    return sp800_185_squeeze(context, length);
-}
+DEFINE_SP800_185_VALUE_METHOD(rb_sha3_kmac_squeeze, sp800_185_rb_squeeze, get_kmac_context)
 
 /*
  * :call-seq:
@@ -398,12 +324,7 @@ static VALUE rb_sha3_kmac_squeeze(VALUE self, VALUE length) {
  * = example
  *   kmac.hex_squeeze(128)
  */
-static VALUE rb_sha3_kmac_hex_squeeze(VALUE self, VALUE length) {
-    sp800_185_context_t *context;
-    get_kmac_context(self, &context);
-
-    return sp800_185_hex_squeeze(context, length);
-}
+DEFINE_SP800_185_VALUE_METHOD(rb_sha3_kmac_hex_squeeze, sp800_185_rb_hex_squeeze, get_kmac_context)
 
 /*
  * :call-seq:
@@ -432,7 +353,7 @@ static VALUE rb_sha3_kmac_self_digest(int argc, VALUE *argv, VALUE klass) {
     rb_scan_args(argc, argv, "41", &algorithm, &data, &output_length, &key, &customization);
 
     Check_Type(output_length, T_FIXNUM);
-    if (!NIL_P(output_length) && output_length <= INT2FIX(0)) {
+    if (!NIL_P(output_length) && NUM2INT(output_length) <= 0) {
         rb_raise(rb_eArgError, "class method digest does not support XOF mode");
     }
 
@@ -468,7 +389,7 @@ static VALUE rb_sha3_kmac_self_hexdigest(int argc, VALUE *argv, VALUE klass) {
     rb_scan_args(argc, argv, "41", &algorithm, &data, &output_length, &key, &customization);
 
     Check_Type(output_length, T_FIXNUM);
-    if (!NIL_P(output_length) && output_length <= INT2FIX(0)) {
+    if (!NIL_P(output_length) && NUM2INT(output_length) <= 0) {
         rb_raise(rb_eArgError, "class method hexdigest does not support XOF mode");
     }
 

data/ext/sha3/sp800_185.c

@@ -74,12 +74,12 @@ const sp800_185_function_table_t *sp800_185_get_algorithm_by_name(const char *na
 
 // Generic context allocation function
 sp800_185_context_t *sp800_185_alloc_context(size_t context_size, size_t state_size) {
-    sp800_185_context_t *context = (sp800_185_context_t *)malloc(context_size);
+    sp800_185_context_t *context = (sp800_185_context_t *)ruby_xmalloc(context_size);
     if (!context) return NULL;
 
-    context->state = calloc(1, state_size);
+    context->state = ruby_xcalloc(1, state_size);
     if (!context->state) {
-        free(context);
+        ruby_xfree(context);
         return NULL;
     }
 
@@ -92,9 +92,9 @@ sp800_185_context_t *sp800_185_alloc_context(size_t context_size, size_t state_s
 void sp800_185_free_context(sp800_185_context_t *context) {
     if (context) {
         if (context->state) {
-            free(context->state);
+            ruby_xfree(context->state);
         }
-        free(context);
+        ruby_xfree(context);
     }
 }
 
@@ -112,7 +112,7 @@ void *sp800_185_copy_state(sp800_185_context_t *context) {
     if (context->functions->state_size <= 0) {
         rb_raise(context->error_class, "invalid state size");
     }
-    void *state_copy = malloc(context->functions->state_size);
+    void *state_copy = ruby_xmalloc(context->functions->state_size);
 
     if (!state_copy) {
         rb_raise(rb_eNoMemError, "failed to allocate memory for state copy");
@@ -125,6 +125,12 @@ void *sp800_185_copy_state(sp800_185_context_t *context) {
 
 VALUE sp800_185_update(sp800_185_context_t *context, VALUE data) {
     StringValue(data);
+
+    // Check for NULL data pointer
+    if (RSTRING_PTR(data) == NULL && RSTRING_LEN(data) > 0) {
+        rb_raise(context->error_class, "cannot update with NULL data");
+    }
+
     size_t data_len = (RSTRING_LEN(data) * 8);
 
     if (data_len == 0) {
@@ -172,7 +178,7 @@ VALUE sp800_185_digest(sp800_185_context_t *context, VALUE data) {
     }
 
     // Create a copy of the state for processing
-    void *state_copy = malloc(context->functions->state_size);
+    void *state_copy = ruby_xmalloc(context->functions->state_size);
     if (!state_copy) {
         rb_raise(rb_eNoMemError, "failed to allocate memory for state copy");
     }
@@ -190,7 +196,7 @@ VALUE sp800_185_digest(sp800_185_context_t *context, VALUE data) {
             result = context->functions->update(state_copy, (const BitSequence *)RSTRING_PTR(data), data_len);
 
             if (result != 0) {
-                free(state_copy);
+                ruby_xfree(state_copy);
                 rb_raise(context->error_class, "failed to update %s state", context->functions->name);
             }
         }
@@ -201,7 +207,7 @@ VALUE sp800_185_digest(sp800_185_context_t *context, VALUE data) {
 
     result = context->functions->final(state_copy, (BitSequence *)RSTRING_PTR(output));
 
-    free(state_copy);
+    ruby_xfree(state_copy);
 
     if (result != 0) {
         rb_raise(context->error_class, "failed to finalize %s state", context->functions->name);
@@ -220,18 +226,23 @@ VALUE sp800_185_squeeze(sp800_185_context_t *context, VALUE length) {
         rb_raise(context->error_class, "use digest methods for fixed-length output");
     }
 
-    size_t output_byte_len;
+    long output_byte_len;
     VALUE str;
 
     Check_Type(length, T_FIXNUM);
-    output_byte_len = NUM2ULONG(length);
+    output_byte_len = NUM2LONG(length);
 
     if (output_byte_len <= 0) {
-        rb_raise(context->error_class, "output length must be specified");
+        rb_raise(context->error_class, "output length must be positive");
+    }
+
+    // Limit output to 1MB for safety
+    if (output_byte_len > (1L << 20)) {
+        rb_raise(context->error_class, "output length too large (max 1MB)");
     }
 
     // Create a copy of the state for processing
-    void *state_copy = malloc(context->functions->state_size);
+    void *state_copy = ruby_xmalloc(context->functions->state_size);
     if (!state_copy) {
         rb_raise(rb_eNoMemError, "failed to allocate memory for state copy");
     }
@@ -245,7 +256,7 @@ VALUE sp800_185_squeeze(sp800_185_context_t *context, VALUE length) {
     result = context->functions->final(state_copy, (BitSequence *)RSTRING_PTR(dummy_output));
 
     if (result != 0) {
-        free(state_copy);
+        ruby_xfree(state_copy);
         rb_raise(context->error_class, "failed to finalize %s state", context->functions->name);
     }
 
@@ -255,7 +266,7 @@ VALUE sp800_185_squeeze(sp800_185_context_t *context, VALUE length) {
     // Use the function table to call the appropriate squeeze function
     result = context->functions->squeeze(state_copy, (BitSequence *)RSTRING_PTR(str), output_byte_len * 8);
 
-    free(state_copy);
+    ruby_xfree(state_copy);
 
     if (result != 0) {
         rb_raise(context->error_class, "failed to squeeze %s", context->functions->name);
@@ -268,3 +279,24 @@ VALUE sp800_185_hex_squeeze(sp800_185_context_t *context, VALUE length) {
     VALUE binary_result = sp800_185_squeeze(context, length);
     return rb_funcall(binary_result, rb_intern("unpack1"), 1, rb_str_new2("H*"));
 }
+
+/* Ruby wrapper functions for common method patterns */
+
+VALUE sp800_185_rb_update(sp800_185_context_t *context, VALUE data) {
+    sp800_185_update(context, data);
+    return Qnil;  // Caller will return self
+}
+
+VALUE sp800_185_rb_name(sp800_185_context_t *context) { return rb_str_new2(sp800_185_name(context)); }
+
+VALUE sp800_185_rb_finish(sp800_185_context_t *context, VALUE output) { return sp800_185_finish(context, output); }
+
+VALUE sp800_185_rb_digest(sp800_185_context_t *context, VALUE data) { return sp800_185_digest(context, data); }
+
+VALUE sp800_185_rb_hexdigest(sp800_185_context_t *context, VALUE data) { return sp800_185_hexdigest(context, data); }
+
+VALUE sp800_185_rb_squeeze(sp800_185_context_t *context, VALUE length) { return sp800_185_squeeze(context, length); }
+
+VALUE sp800_185_rb_hex_squeeze(sp800_185_context_t *context, VALUE length) {
+    return sp800_185_hex_squeeze(context, length);
+}

data/lib/constants.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SHA3
-  VERSION = '2.2.2'
+  VERSION = '2.2.3'
 end

data/sha3.gemspec

@@ -9,11 +9,11 @@ Gem::Specification.new do |spec|
   spec.authors = ['Johanns Gregorian']
   spec.email = ['io+sha3@jsg.io']
 
-  spec.description = <<~EOF
+  spec.description = <<~DESC
     A high-performance native binding to the SHA3 (FIPS 202) cryptographic hashing algorithms, based on the XKCP - eXtended Keccak Code Package.
     This gem provides support for the standard SHA-3 fixed-length functions (224, 256, 384, and 512 bits),
     as well as the SHAKE128/SHAKE256 extendable-output functions (XOFs), cSHAKE128/256, and KMAC as specified in NIST SP 800-185.'
-  EOF
+  DESC
   spec.summary = 'SHA-3 (FIPS 202), SHAKE128/SHAKE256, cSHAKE128/cSHAKE256, and KMAC (NIST SP 800-185), powered by XKCP.'
 
   spec.homepage = 'https://github.com/johanns/sha3'
@@ -24,11 +24,11 @@ Gem::Specification.new do |spec|
   spec.metadata['homepage_uri'] = spec.homepage
   spec.metadata['documentation_uri'] = 'https://docs.jsg.io/sha3/index.html'
 
-  spec.post_install_message = <<-EOF
+  spec.post_install_message = <<-NOTICE
     [NOTICE] SHA3 version 2.0 introduces breaking changes to the API.
     Please review the changelog and ensure compatibility with your application.
     If you need the previous behavior, lock your Gemfile to version '~> 1.0'."
-  EOF
+  NOTICE
 
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject do |f|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sha3
 version: !ruby/object:Gem::Version
-  version: 2.2.2
+  version: 2.2.3
 platform: ruby
 authors:
 - Johanns Gregorian
@@ -62,6 +62,7 @@ files:
 - Rakefile
 - certs/io+sha3@jsg.io.pem
 - doc/sha3.rb
+- ext/sha3/common.h
 - ext/sha3/config.h
 - ext/sha3/cshake.c
 - ext/sha3/cshake.h
@@ -130,7 +131,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.7.1
 specification_version: 4
 summary: SHA-3 (FIPS 202), SHAKE128/SHAKE256, cSHAKE128/cSHAKE256, and KMAC (NIST
   SP 800-185), powered by XKCP.