[Vulnerability Report] phosphor-logging / openpower-pels: Out-of-Bounds Heap Read in FRUIdentity String Extraction

Hi OpenBMC Security Team,

I would like to report an out-of-bounds heap read vulnerability inside the
FRU Identity parsing logic of the openpower-pels extension.

Overview of the Vulnerability:
A malformed or maliciously crafted Platform Event Log (PEL) record can
exploit a lack of null-termination validation in the FRU Identity parser.
This enables an attacker to leak sensitive adjacent heap memory contents
(information disclosure) over D-Bus and logs, or cause a daemon
segmentation fault (Denial of Service).

Affected File and Location:
File: extensions/openpower-pels/fru_identity.cpp
Lines: 121 & 133

Root Cause:
The `FRUIdentity` stream constructor reads exactly 8 bytes from the
untrusted incoming PEL stream into the fixed-size `_pnOrProcedureID`
character array:
  pel.read(_pnOrProcedureID.data(), _pnOrProcedureID.size());
This binary read does not append or enforce a trailing null-terminator
byte.

However, the getter methods (such as `getPN()` and `getMaintProc()`)
construct a C++ `std::string` using the raw pointer:
  std::string pn{_pnOrProcedureID.data()};

Because `std::string` assumes a null-terminated C-style string, it invokes
`strlen` internally. If a PEL payload features an 8-byte `_pnOrProcedureID`
filled entirely with non-null bytes, `strlen` will read out-of-bounds past
the array limit into adjacent memory structures (such as `_ccin` and `_sn`)
until a null byte is encountered.

Proof of Concept:
1. Craft a binary PEL stream featuring a `FRUIdentity` component block with
flags set to specify a Part Number is present (`pnSupplied`).
2. Populate the 8-byte `_pnOrProcedureID` block entirely with non-null
bytes (such as `AAAAAAAA`).
3. Fill contiguous adjacent payload blocks (`_ccin` and `_sn`) with
non-null bytes.
4. Query the log details via D-Bus. The returned string will leak the CCIN
and Serial Number fields alongside Part Number details because of the
un-bounded read.

Proposed Patch:
Construct the string using a safe bounded array range and explicitly handle
null search positions:

std::string pn{_pnOrProcedureID.data(), strnlen(_pnOrProcedureID.data(),
_pnOrProcedureID.size())};

Legal Name for Attribution: Bhargava Naidu Gulla