[LinuxJedi]

An object handle is the object id with the onToken flag in bit 28 (OBJ_HANDLE(on, i)), but nothing bounded the id. Session and token objects shared one counter, token->nextObjId, which is stored with the token and never goes back. Once it passed 0x0FFFFFFF the id spilled into the flag. Reproduced on master 427a22c with a debug + ASAN build:

• A session object got the handle of an existing token object (OBJ_HANDLE(0, 0x10000001) == OBJ_HANDLE(1, 1)), so C_GetAttributeValue on it read the token object.
• C_DestroyObject on that handle deleted the token object and its store files.
• A session object whose handle did not collide returned CKR_OBJECT_HANDLE_INVALID.
• C_CloseSession, C_CloseAllSessions and C_Finalize hit a heap-use-after-free. WP11_Session_RemoveObject picks the list from the handle (since Match the handle when removing an object by handle #252), so it missed the session object and left it linked, and wp11_Session_Final freed it and looped back onto it.
• At 2^31, nextObjId++ was signed overflow.

This takes about 268M objects. Because every session object used up a stored id for good, a long-running server creating keys per connection could get there.

Commits

Cap object ids so handles stay unique

• Adds OBJ_ID_MAX (0x0FFFFFFF). WP11_Session_AddObject fails with OBJ_COUNT_E (CKR_FUNCTION_FAILED) once the counter is past it, for both token and session objects.
• wp11_Token_Load rejects a stored counter that is negative or above OBJ_ID_MAX + 1 (replaced by the third commit). OBJ_ID_MAX + 1 itself is accepted, because that is what a token that has used every id stores.

Give session objects their own id counter

• Session handles have no onToken flag, so they cannot clash with token handles and do not need ids from the stored counter. Session objects now take ids from slot->nextSessObjId, next to the slot's session list. It is guarded by the token lock and starts at 1 in wp11_Slot_Init, so it starts again on each C_Initialize, when no session objects exist.
• The stored counter now only moves for token objects, each of which is a token store. Running out of session ids in one process no longer locks the token out of creating objects until it is reinitialised.

Recover the token object counter from the loaded objects

• Rejecting an out of range counter broke storage-upgrade-test-tpm. v1.3.0 stored neither the token flags nor the counter. With file storage the read runs out of data and falls back, but a TPM NV index is fixed size, so the read returned whatever followed the token data and C_Initialize failed.
• That counter was never usable anyway. v1.3.0 gave token objects the ids 1, 2, ... and stored them in the objects, while master fell back to 1 (file storage) or took the bytes that followed (TPM storage), so after an upgrade new token objects could get the handles of existing ones.
• A stored counter outside 1..OBJ_ID_MAX + 1 is now treated like a missing one, and on load the counter is raised above the id of every token object.

Give the test hook declaration C linkage

• wolfpkcs11/internal.h declares the hook inside extern "C". The test's own declaration did not, so a CC=g++ --enable-debug build would fail to link (Copilot review).

Behaviour changes

• Once ids run out, object creation returns CKR_FUNCTION_FAILED. Token ids only come back through C_InitToken. Session ids come back on the next C_Initialize.
• On load, the token object counter is never below the highest stored token object id + 1, whatever was stored. A token upgraded from v1.3.0 no longer reuses the handles of its existing objects.
• Session object handles start at 1 after each C_Initialize instead of continuing from the token's stored counter.

Tests

Reaching the limit through the API takes hundreds of millions of objects, so this adds a DEBUG_WOLFPKCS11-only hook, WP11_Test_SetNextObjId(slotId, onToken, nextObjId), and tests/object_handle_limit_test.c. The test:

• fills the token ids and checks the last handle, that the next token object fails, and that session objects can still be created;
• fills the session ids and checks the handles have no token flag, and that the next session object fails;
• checks that an EC key pair whose private key does not get an id leaves no public key behind (rollback at the limit);
• reloads the token with every token id used and checks that its objects are there, token creation still fails and session creation works again;
• stores an out of range counter, reloads, and checks that the next token object gets the id after the remaining object's, then resets the token so nothing is left in storage.

It runs in --enable-debug builds (the unit-test.yml debug and TPM debug jobs) and skips otherwise.

Testing:

• With the first commit's version of the test, removing the cap fails 8 checks and ASAN reports the same use-after-free in wp11_Session_Final. Putting session objects back on the shared counter fails 9 checks. Removing the counter recovery on load fails 2 checks: the new token object gets the remaining object's handle and shadows it.
• All 49 checks pass under ASAN. The non-ECC branch also passes (47 checks). The test also compiles as C and C++ with WOLFPKCS11_NO_STORE, WOLFPKCS11_TPM_STORE and WOLFPKCS11_NO_ENV.
• Pre-commit hook make test passes on every commit (debug + ASAN and default configs). The TPM store path of the test and the v1.3.0 TPM upgrade have not been run locally. CI covers them.

[Copilot]

🟡 Changes recommended

The regression test has a C++ linkage defect and can leave corrupted token storage behind in no-environment builds.

2 open findings

• Add extern C guard to match library hook linkage · New
• Avoid corrupting uncleaned default token in no-environment builds · New

What changed in this PR

Prevents object-ID exhaustion from producing invalid or colliding PKCS#11 handles.

Changes:

• Bounds object IDs and validates persisted counters.
• Separates session IDs from persistent token IDs.
• Adds debug-only regression coverage for exhaustion, rollback, and reload behavior.

File	Description
wolfpkcs11/​internal.h	Declares the debug counter-setting hook.
tests/​object_handle_limit_test.c	Tests handle limits and persistence behavior.
tests/​include.am	Registers and links the regression test.
src/​internal.c	Enforces ID limits and separates session allocation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Frauschi]

The cap, the separate session id counter and the counter recovery on load all look right to me. Two small doc comment nits inline.