Fix cross-context blob handle validation

Include a per-context id in encoded blob handles so identical slot and generation values from different contexts cannot collide. Add an x64 static assertion for the token layout and document that target assumption. Strengthen the wrong-context test so both contexts own live blobs before the invalid release attempt.

Author: bboczula

source/runtime/AssetSuiteRuntimeState.cpp

@@ -8,23 +8,44 @@
 
 #include <fstream>
 #include <new>
+#include <atomic>
 #include <cstdint>
 #include <utility>
 
 namespace
 {
-	constexpr uintptr_t SLOT_INDEX_MASK = 0xffffffffu;
+	static_assert(sizeof(uintptr_t) >= 8, "BlobHandle token encoding requires a 64-bit target.");
+
+	constexpr uint32_t SLOT_INDEX_BITS = 24;
+	constexpr uint32_t GENERATION_BITS = 20;
+	constexpr uint32_t CONTEXT_ID_BITS = 20;
+	constexpr uintptr_t SLOT_INDEX_MASK = (uintptr_t{ 1 } << SLOT_INDEX_BITS) - 1u;
+	constexpr uintptr_t GENERATION_MASK = (uintptr_t{ 1 } << GENERATION_BITS) - 1u;
+	constexpr uintptr_t CONTEXT_ID_MASK = (uintptr_t{ 1 } << CONTEXT_ID_BITS) - 1u;
 	constexpr uint32_t INITIAL_BLOB_GENERATION = 1;
+	constexpr uint32_t INITIAL_BLOB_CONTEXT_ID = 1;
 
-	AssetSuite::BlobHandle EncodeBlobHandle(size_t slotIndex, uint32_t generation) noexcept
+	std::atomic<uint32_t> nextBlobContextId = INITIAL_BLOB_CONTEXT_ID;
+
+	AssetSuite::BlobHandle EncodeBlobHandle(size_t slotIndex, uint32_t generation, uint32_t contextId) noexcept
 	{
+		if (slotIndex >= SLOT_INDEX_MASK || generation == 0 || contextId == 0)
+		{
+			return nullptr;
+		}
+
 		const uintptr_t token =
-			(static_cast<uintptr_t>(generation) << 32) |
+			(static_cast<uintptr_t>(contextId) << (SLOT_INDEX_BITS + GENERATION_BITS)) |
+			(static_cast<uintptr_t>(generation) << SLOT_INDEX_BITS) |
 			(static_cast<uintptr_t>(slotIndex) + 1u);
 		return reinterpret_cast<AssetSuite::BlobHandle>(token);
 	}
 
-	bool DecodeBlobHandle(AssetSuite::BlobHandle handle, size_t& slotIndex, uint32_t& generation) noexcept
+	bool DecodeBlobHandle(
+		AssetSuite::BlobHandle handle,
+		size_t& slotIndex,
+		uint32_t& generation,
+		uint32_t& contextId) noexcept
 	{
 		const uintptr_t token = reinterpret_cast<uintptr_t>(handle);
 		const uintptr_t encodedSlotIndex = token & SLOT_INDEX_MASK;
@@ -33,8 +54,9 @@ namespace
 			return false;
 		}
 
-		generation = static_cast<uint32_t>(token >> 32);
-		if (generation == 0)
+		generation = static_cast<uint32_t>((token >> SLOT_INDEX_BITS) & GENERATION_MASK);
+		contextId = static_cast<uint32_t>((token >> (SLOT_INDEX_BITS + GENERATION_BITS)) & CONTEXT_ID_MASK);
+		if (generation == 0 || contextId == 0)
 		{
 			return false;
 		}
@@ -43,9 +65,15 @@ namespace
 		return true;
 	}
 
+	uint32_t AllocateBlobContextId() noexcept
+	{
+		uint32_t contextId = nextBlobContextId.fetch_add(1, std::memory_order_relaxed) & static_cast<uint32_t>(CONTEXT_ID_MASK);
+		return contextId == 0 ? INITIAL_BLOB_CONTEXT_ID : contextId;
+	}
+
 	uint32_t NextBlobGeneration(uint32_t generation) noexcept
 	{
-		++generation;
+		generation = (generation + 1u) & static_cast<uint32_t>(GENERATION_MASK);
 		return generation == 0 ? INITIAL_BLOB_GENERATION : generation;
 	}
 }
@@ -156,6 +184,11 @@ AssetSuite::ErrorCode AssetSuite::Internal::RuntimeState::FileLoader::LoadToMemo
 	return ErrorCode::OK;
 }
 
+AssetSuite::Internal::RuntimeState::BlobStorage::BlobStorage()
+	: contextId(AllocateBlobContextId())
+{
+}
+
 AssetSuite::BlobHandle AssetSuite::Internal::RuntimeState::BlobStorage::Create(Blob blob)
 {
 	size_t slotIndex = 0;
@@ -171,7 +204,7 @@ AssetSuite::BlobHandle AssetSuite::Internal::RuntimeState::BlobStorage::Create(B
 	}
 
 	slots[slotIndex].blob = std::make_unique<Blob>(std::move(blob));
-	return EncodeBlobHandle(slotIndex, slots[slotIndex].generation);
+	return EncodeBlobHandle(slotIndex, slots[slotIndex].generation, contextId);
 }
 
 bool AssetSuite::Internal::RuntimeState::BlobStorage::Owns(BlobHandle blob) const noexcept
@@ -189,7 +222,13 @@ AssetSuite::Internal::RuntimeState::BlobStorage::Get(BlobHandle blob) const noex
 {
 	size_t slotIndex = 0;
 	uint32_t generation = 0;
-	if (!DecodeBlobHandle(blob, slotIndex, generation))
+	uint32_t decodedContextId = 0;
+	if (!DecodeBlobHandle(blob, slotIndex, generation, decodedContextId))
+	{
+		return nullptr;
+	}
+
+	if (decodedContextId != contextId)
 	{
 		return nullptr;
 	}
@@ -212,7 +251,13 @@ AssetSuite::Result AssetSuite::Internal::RuntimeState::BlobStorage::Release(Blob
 {
 	size_t slotIndex = 0;
 	uint32_t generation = 0;
-	if (!blob || !DecodeBlobHandle(*blob, slotIndex, generation))
+	uint32_t decodedContextId = 0;
+	if (!blob || !DecodeBlobHandle(*blob, slotIndex, generation, decodedContextId))
+	{
+		return Result::ErrorInvalidHandle;
+	}
+
+	if (decodedContextId != contextId)
 	{
 		return Result::ErrorInvalidHandle;
 	}

source/runtime/AssetSuiteRuntimeState.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <array>
+#include <cstdint>
 #include <cstddef>
 #include <filesystem>
 #include <memory>
@@ -64,6 +65,8 @@ namespace AssetSuite::Internal
 
 		struct BlobStorage
 		{
+			BlobStorage();
+
 			BlobHandle Create(Blob blob);
 			bool Owns(BlobHandle blob) const noexcept;
 			bool IsLive(BlobHandle blob) const noexcept;
@@ -79,6 +82,7 @@ namespace AssetSuite::Internal
 				uint32_t generation = 1;
 			};
 
+			uint32_t contextId = 0;
 			std::vector<Slot> slots;
 			std::vector<size_t> freeSlots;
 		};

source/runtime/README.md

@@ -36,9 +36,9 @@ The public SDK surface is guarded by `PublicHeaderCompile`, `PublicHeaderHygiene
 
 `Internal::Blob` stores raw asset bytes in runtime-owned memory and copies minimal source metadata into the runtime object. The metadata currently tracks the original source path, source extension, and best-known public `AssetFormat` derived from the extension when possible.
 
-`BlobHandle` is treated as an opaque slot/generation token by the runtime. The public type remains pointer-shaped for ABI opacity, but blob validation decodes the token and never dereferences the handle value directly.
+`BlobHandle` is treated as an opaque context/slot/generation token by the runtime. The public type remains pointer-shaped for ABI opacity, but blob validation decodes the token and never dereferences the handle value directly. This token encoding requires a 64-bit target and is guarded by a compile-time assertion.
 
-`RuntimeState::BlobStorage` owns reusable blob slots for one context. `ReleaseBlob` clears the blob payload, advances the slot generation, returns the slot to the free list, and nulls the caller's handle. Copied stale handles are rejected by generation mismatch, and handles from another context are rejected because each context validates against only its own slot table.
+`RuntimeState::BlobStorage` owns reusable blob slots for one context. `ReleaseBlob` clears the blob payload, advances the slot generation, returns the slot to the free list, and nulls the caller's handle. Copied stale handles are rejected by generation mismatch, and handles from another context are rejected by context-id mismatch before slot lookup.
 
 ## Deferred Scope
 

unit_tests/GeneralUnitTests.cpp

@@ -458,19 +458,23 @@ namespace GeneralUnitTests
 		{
 			AssetSuite::ContextHandle firstContext = nullptr;
 			AssetSuite::ContextHandle secondContext = nullptr;
-			AssetSuite::BlobHandle blob = nullptr;
+			AssetSuite::BlobHandle firstBlob = nullptr;
+			AssetSuite::BlobHandle secondBlob = nullptr;
 			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::CreateContext(nullptr, &firstContext));
 			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::CreateContext(nullptr, &secondContext));
-			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::LoadFile(firstContext, "test_file.xyz", &blob));
+			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::LoadFile(firstContext, "test_file.xyz", &firstBlob));
+			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::LoadFile(secondContext, "test_file.xyz", &secondBlob));
+			Assert::IsFalse(firstBlob == secondBlob);
 
-			const auto result = AssetSuite::ReleaseBlob(secondContext, &blob);
+			const auto result = AssetSuite::ReleaseBlob(secondContext, &firstBlob);
 
 			Assert::AreEqual(true, AssetSuite::Result::ErrorInvalidHandle == result);
-			Assert::IsNotNull(blob);
+			Assert::IsNotNull(firstBlob);
 			Assert::AreEqual(static_cast<size_t>(1), firstContext->Runtime().BlobStorage().LiveCount());
-			Assert::AreEqual(static_cast<size_t>(0), secondContext->Runtime().BlobStorage().LiveCount());
+			Assert::AreEqual(static_cast<size_t>(1), secondContext->Runtime().BlobStorage().LiveCount());
 
-			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::ReleaseBlob(firstContext, &blob));
+			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::ReleaseBlob(secondContext, &secondBlob));
+			Assert::AreEqual(true, AssetSuite::Result::Success == AssetSuite::ReleaseBlob(firstContext, &firstBlob));
 			DestroyContextForCleanup(secondContext);
 			DestroyContextForCleanup(firstContext);
 		}