Validate stored object records and scrub key buffers on errors

[aidangarske]

F-4262 - 62cbe69 - Loading token objects now rejects a negative stored array length with BUFFER_E and resets the length to 0.

F-5078 - 1ed0eb9 - Stored arrays are read into a buffer that starts at 4096 bytes and doubles only as data is read, with intermediate buffers zeroized.

F-13814 - 1c75c54 - Data object lengths are now assigned only after the storage read succeeds.

F-4264 - ca75af9 - The RSA, ECC, ML-DSA and DH private key decoders now reject stored records no longer than the AES block size, and DH also rejects payloads above the maximum DH key size.

F-4733 - af2a161 - The DH key decoder now returns BUFFER_E when the stored public value is longer than the fixed key buffer.

F-3641 - cabe791 - The trust record decoder now returns an error unless the stored record is exactly the size of WP11_Trust, and callers propagate it.

F-3404 - 73f3994 - WP11_Object_EncodeTpmKey now writes into the keyData buffer it validated.

F-8643 - 9ef3b6e - The TPM RSA and ECC encoders now call WP11_Object_EncodeTpmKey only when earlier steps succeeded, so a MEMORY_E result is kept.

F-13813 - 483cefa - On failure, the DH and symmetric key encoders zeroize and free keyData and set its length to 0, so a later store re-encodes the key.

F-3017 - 1676647 - The RSA, ECC and ML-DSA encoders now zeroize keyData before freeing it on failure, matching the ML-KEM encoder.

F-3413 - 3c2a1c6 - The RSA, ECC and ML-DSA decoders now zeroize the decrypted buffer on every path, including failed decrypts.

F-8667 - 28d2ad2 - The symmetric and DH key decoders now zeroize the decrypt destination when decryption fails.

[Copilot]

🟡 Changes recommended

Malformed records can still be accepted, and unresolved object-lifetime and cleanup paths introduce security and concurrency risks.

7 open findings

• Object lookup returns a potentially freed object · New
• Negative issuer or email lengths are accepted as end-of-record · New
• Zero-length trust records bypass length validation · New
• Failed RSA decoding leaks initialized key resources · New
• Logout retains unbounded invalidated session objects · New
• Stored-key truncation test fails under non-file stores · New
• EC corruption test fails under non-file store configurations · New

What changed in this PR

Strengthens stored-object validation, sensitive-buffer cleanup, and login/logout state handling.

Changes:

• Validates stored record lengths and incrementally reads arrays.
• Scrubs key material on decode/encode failures.
• Adds storage, PIN, logout, and concurrency tests.

File	Description
wolfpkcs11/​internal.h	Declares lockout and debug helpers.
src/​internal.c	Implements validation, scrubbing, locking, and object retirement.
src/​slot.c	Applies PIN lockout checks consistently.
tests/​object_store_decode_test.c	Tests malformed records and buffer scrubbing.
tests/​login_pin_state_test.c	Tests login, logout, PIN, and concurrency state.
tests/​include.am	Registers the new tests.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.