Reject AES encrypt and decrypt lengths that do not fit in 32 bits

[aidangarske]

F-6669 - 4f29806 - Single-part C_Encrypt and C_Decrypt for AES-CTR and AES-CTS now reject lengths above 32 bits and end the operation, using WP11_AesCtr_Final and the new WP11_AesCts_Final.

F-8671 - 488bf32 - C_Decrypt for AES key wrap and key wrap pad now returns CKR_ENCRYPTED_DATA_LEN_RANGE for ciphertext lengths above 32 bits and releases the context.

F-5156 - 2b2e1c2 - The AES-GCM C_DecryptFinal buffer length is now compared as a CK_ULONG without narrowing.

F-5153 - e1d5615 - C_EncryptFinal now compares CBC-PAD and GCM buffer lengths as CK_ULONG, and CTS caps the capacity at two blocks.

F-4801 - 2c098c4 - C_EncryptUpdate for AES-CTR, AES-GCM and AES-CTS now rejects parts that do not fit in 32 bits, and the new WP11_AesGcm_Final zeroizes and frees the GCM cache, AAD and stream object on that path.

F-5079 - 8ca9d97 - C_DecryptUpdate for AES-CTR now rejects parts above 32 bits and passes the input length as the output capacity.

F-4800 - d9cb167 - C_DecryptUpdate for AES-GCM now rejects a part that does not fit in 32 bits or would take the buffered length past INT_MAX, and WP11_AesGcm_DecryptUpdate refuses any append past INT_MAX.

F-10403 - 3a8a7ce - C_EncryptUpdate for AES-GCM now applies the same INT_MAX cap on buffered length, and wp11_AesGcm_BufferAppend refuses appends past INT_MAX.

[Copilot]

🟡 Changes recommended

GCM cleanup leaves AAD unwiped, and one unavailable-feature test reports success instead of skipped.

2 open findings

• Return skip status when storage decoding is unavailable · New
• Wipe copied AAD before freeing GCM state · New

What changed in this PR

Adds robust AES length validation and operation cleanup, alongside broader PKCS#11 correctness and persistence hardening.

Changes:

• Rejects oversized AES inputs and safely terminates affected operations.
• Improves token storage, attributes, mechanism metadata, and API behavior.
• Expands regression tests and CI configurations.

File	Description
.github/​workflows/​unit-test.yml	Adds TPM-debug and no-environment CI coverage.
src/​crypto.c	Validates AES lengths and output capacities.
src/​internal.c	Adds AES cleanup and cumulative-length protections.
src/​slot.c	Corrects token information and mechanism metadata.
src/​wolfpkcs11.c	Improves finalization and fixed-field padding.
wolfpkcs11/​internal.h	Declares new limits and cleanup helpers.
wolfpkcs11/​pkcs11.h	Adds the operation-cancellation error constant.
tests/​attribute_validation_test.c	Covers attribute validation and atomic updates.
tests/​encrypt_decrypt_params_test.c	Tests oversized AES lengths and cleanup.
tests/​include.am	Registers the expanded test suite.
tests/​info_mech_table_test.c	Tests information and mechanism consistency.
tests/​key_material_update_test.c	Tests immutable key material.
tests/​object_store_decode_test.c	Tests malformed persisted-object handling.
tests/​pkcs11mtt.c	Updates multithreaded behavioral expectations.
tests/​pkcs11test.c	Updates core API tests and expectations.
tests/​pkcs11v3test.c	Updates PKCS#11 v3 attribute expectations.
tests/​token_store_test.c	Tests persistence and storage failures.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.