[Vulnerability Report] phosphor-logging / openpower-pels: Stack Buffer Overflow in PHAL createDeconfigRecords via std::copy

Hi OpenBMC Security Team,

I would like to report a stack buffer overflow vulnerability inside the
PHAL service actions of the openpower-pels extension.

Overview of the Vulnerability:
An unprivileged local D-Bus user can trigger a stack-based buffer overflow
inside the core phosphor-logging daemon by submitting a malformed event log
featuring a long PHAL callout. This results in stack corruption and crashes
the event-logging manager daemon (Denial of Service).

Affected File and Location:
File: extensions/openpower-pels/phal_service_actions.cpp
Line: 188

Root Cause:
The `createDeconfigRecords` function parses callout metadata from
user-supplied JSON and extracts the dynamically-sized `EntityPath` byte
vector. It then attempts to copy the entire vector directly into a
fixed-size stack array `physBinPath` (of type `ATTR_PHYS_BIN_PATH_Type`)
using the `std::copy` algorithm:
  ATTR_PHYS_BIN_PATH_Type physBinPath;
  std::copy(entityPath.begin(), entityPath.end(), physBinPath);

Because the code performs no length verification or bounds checks before
executing the copy, a payload with an `EntityPath` vector larger than the
`physBinPath` array capacity will overflow the stack array boundary,
corrupting adjacent stack variables.

Proof of Concept:
1. Issue an event log creation request over D-Bus containing a PHAL callout
JSON structure.
2. Inside the callout payload, define the `EntityPath` array containing a
list of bytes whose total size exceeds the bounds of
`sizeof(ATTR_PHYS_BIN_PATH_Type)`.
3. The logging daemon parses the log, triggers `createDeconfigRecords()`,
and immediately crashes with a stack overflow segmentation fault.

Proposed Patch:
Add a boundary check before copying to ensure the source vector length does
not exceed the target buffer capacity:

  auto entityPath = _callout.at("EntityPath").get<EntityPath>();
  if (entityPath.size() > sizeof(ATTR_PHYS_BIN_PATH_Type))
  {
      lg2::error("Deconfig: EntityPath size ({SIZE}) exceeds target buffer
capacity ({CAP}",
                 "SIZE", entityPath.size(), "CAP",
sizeof(ATTR_PHYS_BIN_PATH_Type));
      continue;
  }
  ATTR_PHYS_BIN_PATH_Type physBinPath;
  std::copy(entityPath.begin(), entityPath.end(), physBinPath);

Legal Name for Attribution: Bhargava Naidu Gulla