sha256: smoke-test caller-supplied compression function

[real-or-random]

Extended version of #1904. I'd say if we get enough reviews/confidence before the release, let's merge this here. Otherwise, let's stick with the simpler #1904 and leave this here for after the release.

[real-or-random]

Differences:

• This tests multiple alignments of the message, namely aligned to 64 bytes (but not to 128), aligned to 32 bytes (but not to 64), ...., down to no alignment at all. (Since alignment is always a power of 2, this should be equal to @furszy's first proposal in coverage, but more efficient because we need the loop only log(64)+1=7 times, instead of 64 times).
• This skips the test if we know that we're dealing with the internal function (as @furszy's initial proposal). This keeps context creation to ~1.5 us on my machine (instead of ~75 us).
• A few cleanups suggested by @theStack. (I kept the hash_ctx_init call because it's in principle correct. A hash context may have more stuff to init in the future. Anyway, the compiler will figure out the dead store and optimize it away.)
• Renamed the function to smoke_test (equiv isn't a great any longer since it doesn't run the built-in anymore).
• Adjust the commit message.

[Copilot]

Pull request overview

This PR strengthens validation of caller-supplied SHA256 compression callbacks by adding a multi-case “smoke test” that cross-checks behavior across message lengths and input alignments, and integrating it into the existing SHA256 selftest pathway. This helps catch subtle but dangerous misimplementations (e.g., multi-block handling, state handling, or alignment assumptions) early when installing a custom compression function.

Changes:

• Add secp256k1_sha256_smoke_test() to validate supplied SHA256 compression callbacks against a precomputed accumulated digest.
• Extend secp256k1_selftest_sha256() to run the smoke test for non-default compression functions after the existing known-digest check.
• Add unit tests covering several intentionally broken compression callbacks plus a known-good callback wrapper.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/tests.c	Adds targeted unit tests exercising the new smoke test against good/bad compression callbacks.
src/selftest.h	Extends SHA256 selftest to run the new smoke test for non-default compression functions.
src/hash_impl.h	Introduces the new SHA256 compression smoke test implementation.
include/secp256k1.h	Documents the new behavior when installing a custom SHA256 compression function.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[theStack]

ACK c1c6365

Being thorough with alignment checks seems the right approach, even though it adds quite a bit of complexity to the code (it LGTM, but it's very easy to get something wrong there or overlook something as reviewer).

The following Copilot suggestions seem to make sense to tackle:

• #1905 (comment)
• #1905 (comment)

[theStack]

nit: an alternative here and for MAX_ALIGNMENT below would be

Suggested change

	#define LONGEST 576 /* local macro, undef'd below */
	enum { LONGEST = 576 };

for not having to #undef below, leading to a smaller patch; but not sure if that's strictly better or if we even have a preference in the project (we seem to use both)

[real-or-random]

I tend to think that enum is better in this case. I always forget that it's a compile-time constant that can be used in array sizes.

[theStack]

nit-like (?): uintptr_t does not seem to be part of C89; it was introduced in C99 and is optional even there. Not sure how strict we want to be about this level of portability, though, given that we already rely on stdint.h being available.

[real-or-random]

Hm, yes. Almost all architectures have an uintptr_t, but some don't.

The reason not to provide one is that there is no integer type large enough to hold a pointer value so that it can be converted back without loss. We don't need to conversion back, but we still can't just cast to any unsigned integer type because C99 says: If the result cannot be represented in the integer type, the behavior is undefined.

We could ignore the problem and simply require uintptr_t. We could wrap the offset calculation into a preprocessor check that checks for the presence of the type (#ifdef UINTPTR_MAX) and fall back if it's not present (e.g., simply set offset = 0, effectively not doing alignment checks) for these rare architectures.

[1] CHERI archs can't provide it it according to https://www.ralfj.de/blog/2022/04/11/provenance-exposed.html. edit: I was wrong here. CHERI-C has it, and it's 64 bits long. According to https://www.open-std.org/JTC1/SC22/WG14/www/docs/n2873.htm, there are at least two other architectures, but they're not mentioned explicitly in the document.

[furszy]

Simple coverage for the introduced changes:

diff --git a/src/tests.c b/src/tests.c
--- a/src/tests.c
+++ b/src/tests.c
@@ -517,12 +517,28 @@
     s[0] ^= 1;
 }
 
+/* Wrong when input is 64-byte aligned, like a broken SIMD fast path. */
+static void sha256_transform_aligned_fail(uint32_t *s, const unsigned char *chunk, size_t blocks) {
+    int aligned = ((uintptr_t)chunk % 64) == 0;
+    secp256k1_sha256_transform(s, chunk, blocks);
+    if (aligned) s[0] ^= 1;
+}
+
+/* Wrong on any unaligned input. */
+static void sha256_transform_unaligned_fail(uint32_t *s, const unsigned char *chunk, size_t blocks) {
+    int aligned = ((uintptr_t)chunk % 64) == 0;
+    secp256k1_sha256_transform(s, chunk, blocks);
+    if (!aligned) s[0] ^= 1;
+}
+
 static void run_sha256_compression_smoke_test_tests(void) {
     CHECK(secp256k1_sha256_smoke_test(sha256_transform_noadvance) == 0);
     CHECK(secp256k1_sha256_smoke_test(sha256_transform_short) == 0);
     CHECK(secp256k1_sha256_smoke_test(sha256_transform_ivreset) == 0);
     CHECK(secp256k1_sha256_smoke_test(sha256_transform_batch4) == 0);
     CHECK(secp256k1_sha256_smoke_test(sha256_transform_corrupt) == 0);
+    CHECK(secp256k1_sha256_smoke_test(sha256_transform_aligned_fail) == 0);
+    CHECK(secp256k1_sha256_smoke_test(sha256_transform_unaligned_fail) == 0);
     CHECK(secp256k1_sha256_smoke_test(good_sha256_compression) == 1);
 }