Here are a couple quick and dirty ways to count these operators:
1. Compute the conformal block expansion of the four-point function $\langle \phi\phi\phi\phi\rangle$. This will only contain blocks with $\Delta-\ell=d-2$. This is done in http://arxiv.org/abs/1009.5985, equation 64.
2. Compute the character of the conformal group acting on operators in the theory. By decomposing this character into characters of irreducible representations of the conformal group, you can read off the conformal primaries. See http://arxiv.org/abs/hep-th/<PHONE_NUMBER> for an introduction to conformal characters.
However, the free theory is simple enough that we can just do the analysis from scratch.
An operator in the free theory is built from a string of derivatives $\partial_\mu$ and $\phi$'s. It's easy to see that the only operators appearing in the $\phi\times\phi$ OPE have $\phi$ number 0 (the unit operator) or 2. The case of $\phi$ number 2 is the most interesting. These are operators of the form $\partial\dots\partial\phi\partial\dots\partial\phi$.
Recall that any operator of the form $\partial_\mu \mathcal{O}$ (where $\mathcal{O}$ is any operator) is a descendant. Let us consider the space of all operators modulo descendant operators. 976
Equivalence classes in this space will be in 1 to 1 correspondence with conformal primaries.
In this quotient space, we have $\partial(A B) = \partial A B + A\partial B \sim 0$ (where $\sim$ means "is equivalent to"). Using this relation, we can move derivatives from one $\phi$ to the other, modulo descendants. Let us put all the derivatives on the right-hand $\phi$. We now have operators of the form
$\phi \partial_{\mu_1}\cdots\partial_{\mu_\ell}\partial^{2n}\phi$
However, the equation of motion says that $\partial^2 \phi=0$, so we're left with
$\phi\partial_{\mu_1}\cdots\partial_{\mu_\ell}\phi$
We're not quite done. The above operator could be equivalent to a primary modulo descendants, or it could be a descendant itself. It turns out that when $\ell$ is odd, it is a pure descendant (homework exercise!). When $\ell$ is even, there is a primary in the same equivalence class. To find it, we must solve the equation $K_\mu \mathcal{O}=0$, where $K_\mu$ is the special conformal generator. The solutions are
$\phi \partial^\leftrightarrow_{\mu_1}\cdots\partial^\leftrightarrow_{\mu_\ell}\phi$
where $A\partial^\leftrightarrow_\mu B=\partial_\mu A B - A\partial_\mu B$. You can see that this is indeed equivalent to the above modulo descendants when $\ell$ is even.
Finally, note that the above operator is traceless by the equations of motion, so it transforms in a spin-$\ell$ representation of the rotation group. It has $\Delta-\ell=2\Delta_\phi=d-2$ (where $d$ is the spacetime dimension), so it saturates the unitarity bound for $\ell>0$. 818