[Vulnerability Report] phosphor-logging / openpower-pels: Integer Underflow and Heap OOB Read in SbeFFDC::parse

Hi OpenBMC Security Team,

I would like to report an integer underflow and out-of-bounds heap read
vulnerability inside the Self-Boot Engine (SBE) First Failure Data Capture
(FFDC) packet parsing logic of the openpower-pels extension.

Overview of the Vulnerability:
A malformed SBE FFDC file payload can trigger an integer underflow in
memory allocation and copy boundary calculations. This causes the logging
daemon to immediately crash due to an out-of-memory allocation failure
(Denial of Service) or triggers a massive out-of-bounds heap memory copy
via memcpy.

Affected File and Location:
File: extensions/openpower-pels/sbe_ffdc_handler.cpp
Line: 158

Root Cause:
In `SbeFFDC::parse`, the `lenWords` parameter is parsed directly from
unverified packet headers and used to determine memory allocations and
copies:
  uint32_t pktLenWords = lenWords - p10FfdcSkipWords;
  std::unique_ptr<uint32_t[]> ffdcData{new uint32_t[pktLenWords]()};
  ...
  std::memcpy(ffdcData.get(), ..., pktLenWords * sizeof(uint32_t));

If the packet contains a `lenWords` value that is smaller than the skipped
header words (`p10FfdcSkipWords` / `pozFfdcSkipWords`), the subtraction
underflows. Since the variables are unsigned 32-bit integers, `pktLenWords`
becomes a massive number.

This causes `new uint32_t` to request roughly 17 GB of memory, throwing
`std::bad_alloc` and crashing the daemon. If the integer wraps around
differently or a large value is parsed, `memcpy` will read beyond the
source buffer bounds, leaking memory or causing a segmentation fault.

Proof of Concept:
1. Forge a raw SBE FFDC telemetry payload bearing a valid P10 or P0Z header
signature.
2. In the packet header, set the `lengthinWords` field to `0` (to trigger
the subtraction underflow).
3. Pass this telemetry file to the PEL parser process.
4. Observe the daemon terminating immediately with a `std::bad_alloc`
memory allocation failure.

Proposed Patch:
Verify that `lenWords` is greater than or equal to the header skip sizes,
and ensure that the copy bounds do not exceed the size of the input
telemetry data:

if (lenWords < p10FfdcSkipWords || ffdcBufOffset + lenWords *
sizeof(uint32_t) > ffdcData.size())
{
    lg2::error("Malformed SBE packet: length exceeds input buffer size
limits");
    return;
}
uint32_t pktLenWords = lenWords - p10FfdcSkipWords;

Legal Name for Attribution: Bhargava Naidu Gulla