5 files changed, 40 insertions, 17 deletions
diff --git a/ext/digest/defs.h b/ext/digest/defs.h
index 77a134f364..9b11f4eca9 100644
--- a/ext/digest/defs.h
+++ b/ext/digest/defs.h
@@ -16,4 +16,26 @@
 # define __END_DECLS
 #endif
 
+#define RB_DIGEST_DIAGNOSTIC(compiler, op, flag) _Pragma(STRINGIZE(compiler diagnostic op flag))
+#ifdef RBIMPL_WARNING_IGNORED
+# define RB_DIGEST_WARNING_IGNORED(flag) RBIMPL_WARNING_IGNORED(flag)
+# define RB_DIGEST_WARNING_PUSH() RBIMPL_WARNING_PUSH()
+# define RB_DIGEST_WARNING_POP() RBIMPL_WARNING_POP()
+#elif defined(__clang__)
+# define RB_DIGEST_WARNING_IGNORED(flag) RB_DIGEST_DIAGNOSTIC(clang, ignored, #flag)
+# define RB_DIGEST_WARNING_PUSH() _Pragma("clang diagnostic push")
+# define RB_DIGEST_WARNING_POP() _Pragma("clang diagnostic pop")
+#else /* __GNUC__ */
+# define RB_DIGEST_WARNING_IGNORED(flag) RB_DIGEST_DIAGNOSTIC(GCC, ignored, #flag)
+# define RB_DIGEST_WARNING_PUSH() _Pragma("GCC diagnostic push")
+# define RB_DIGEST_WARNING_POP() _Pragma("GCC diagnostic pop")
+#endif
+#ifdef RBIMPL_HAS_WARNING
+# define RB_DIGEST_HAS_WARNING(_) RBIMPL_HAS_WARNING(_)
+#elif defined(__has_warning)
+# define RB_DIGEST_HAS_WARNING(_) __has_warning(_)
+#else
+# define RB_DIGEST_HAS_WARNING(_) 0
+#endif
+
 #endif /* DEFS_H */
diff --git a/ext/digest/digest_conf.rb b/ext/digest/digest_conf.rb
index 36a7d75289..099d20fcbe 100644
--- a/ext/digest/digest_conf.rb
+++ b/ext/digest/digest_conf.rb
@@ -2,14 +2,16 @@
 
 def digest_conf(name)
   unless with_config("bundled-#{name}")
-    cc = with_config("common-digest")
-    if cc != false or /\b#{name}\b/ =~ cc
-      if File.exist?("#$srcdir/#{name}cc.h") and
-        have_header("CommonCrypto/CommonDigest.h")
-        $defs << "-D#{name.upcase}_USE_COMMONDIGEST"
-        $headers << "#{name}cc.h"
-        return :commondigest
-      end
+    case cc = with_config("common-digest", true)
+    when true, false
+    else
+      cc = cc.split(/[\s,]++/).any? {|pat| File.fnmatch?(pat, name)}
+    end
+    if cc and File.exist?("#$srcdir/#{name}cc.h") and
+      have_header("CommonCrypto/CommonDigest.h")
+      $defs << "-D#{name.upcase}_USE_COMMONDIGEST"
+      $headers << "#{name}cc.h"
+      return :commondigest
     end
   end
   $objs << "#{name}.#{$OBJEXT}"
diff --git a/ext/digest/md5/md5cc.h b/ext/digest/md5/md5cc.h
index 657f573f85..a002c17604 100644
--- a/ext/digest/md5/md5cc.h
+++ b/ext/digest/md5/md5cc.h
@@ -2,14 +2,6 @@
 #include <CommonCrypto/CommonDigest.h>
 
 #ifdef __GNUC__
-# define RB_DIGEST_DIAGNOSTIC(compiler, op, flag) _Pragma(STRINGIZE(compiler diagnostic op flag))
-# ifdef RBIMPL_WARNING_IGNORED
-#   define RB_DIGEST_WARNING_IGNORED(flag) RBIMPL_WARNING_IGNORED(flag)
-# elif defined(__clang__)
-#   define RB_DIGEST_WARNING_IGNORED(flag) RB_DIGEST_DIAGNOSTIC(clang, ignored, #flag)
-# else /* __GNUC__ */
-#   define RB_DIGEST_WARNING_IGNORED(flag) RB_DIGEST_DIAGNOSTIC(GCC, ignored, #flag)
-# endif
 RB_DIGEST_WARNING_IGNORED(-Wdeprecated-declarations)
 /* Suppress deprecation warnings of MD5 from Xcode 11.1 */
 /* Although we know MD5 is deprecated too, provide just for backward
diff --git a/ext/digest/md5/md5init.c b/ext/digest/md5/md5init.c
index b81fd94864..c919060587 100644
--- a/ext/digest/md5/md5init.c
+++ b/ext/digest/md5/md5init.c
@@ -3,6 +3,7 @@
 
 #include <ruby/ruby.h>
 #include "../digest.h"
+#include "../defs.h"
 #if defined(MD5_USE_COMMONDIGEST)
 #include "md5cc.h"
 #else
diff --git a/ext/digest/sha1/sha1.c b/ext/digest/sha1/sha1.c
index 5311227549..244fed7a3e 100644
--- a/ext/digest/sha1/sha1.c
+++ b/ext/digest/sha1/sha1.c
@@ -232,8 +232,14 @@ void SHA1_Update(SHA1_CTX *context, const uint8_t *data, size_t len)
     if ((j + len) > 63) {
 	(void)memcpy(&context->buffer[j], data, (i = 64-j));
 	SHA1_Transform(context->state, context->buffer);
-	for ( ; i + 63 < len; i += 64)
+	for ( ; i + 63 < len; i += 64) {
+	    RB_DIGEST_WARNING_PUSH();
+#if defined(__GNUC__) && !defined(__clang__)
+	    RB_DIGEST_WARNING_IGNORED(-Wstringop-overread);
+#endif
 	    SHA1_Transform(context->state, &data[i]);
+	    RB_DIGEST_WARNING_POP();
+	}
 	j = 0;
     } else {
 	i = 0;