[Vulnerability Report] phosphor-logging / openpower-pels: Daemon Crash via Unhandled Exception in UserHeader parsing

Hi OpenBMC Security Team,

I would like to report a Denial of Service (DoS) vulnerability in the
UserHeader parsing logic of the openpower-pels extension.

Overview of the Vulnerability:
An unprivileged local caller with D-Bus event log creation access can crash
the `phosphor-log-manager` daemon by supplying a malformed or non-numeric
event log subsystem value. Since the daemon is a core system logging
service, crashing it halts general event log generation, tracking, and
notifications across the entire BMC platform.

Affected File and Location:
File: extensions/openpower-pels/user_header.cpp
Line: 51

Root Cause:
When constructing a `UserHeader` from the untrusted `AdditionalData`
dictionary (parsed from incoming D-Bus event arguments), the constructor
retrieves the `PEL_SUBSYSTEM` field and attempts to parse it:
  auto ss = additionalData.getValue("PEL_SUBSYSTEM");
  if (ss)
  {
      auto eventSubsystem = std::stoul(*ss, nullptr, 16);
  }

The `std::stoul` call is executed without any surrounding try-catch block.
If a client supplies an invalid, non-hexadecimal, or non-numeric string
(such as arbitrary text or a JSON block), `std::stoul` will throw a
`std::invalid_argument` exception. As no bounding component catches this
exception, the process aborts and crashes the daemon.

Proof of Concept:
1. Use D-Bus to trigger an event log creation request, injecting a
malformed non-hex payload inside the `PEL_SUBSYSTEM` property:
   busctl call xyz.openbmc_project.Logging /xyz/openbmc_project/logging
xyz.openbmc_project.Logging.Create Create ssa{ss} 'message' 'severity' 1
'PEL_SUBSYSTEM' 'not-a-number'
2. Inspect the system logs:
   journalctl -u phosphor-log-manager
3. Observe that the daemon has immediately terminated due to an unhandled
`std::invalid_argument` exception.

Proposed Patch:
Wrap the `std::stoul` call in a standard try-catch block, catch any parsing
errors, log a warning, and fallback to a generic subsystem code (0x70 for
others):

try
{
    auto eventSubsystem = std::stoul(*ss, nullptr, 16);
}
catch (const std::exception& e)
{
    lg2::error("Invalid PEL_SUBSYSTEM format: {ERROR}", "ERROR", e.what());
    eventSubsystem = 0x70; // Fallback to safe generic subsystem 'others'
}

Legal Name for Attribution: Bhargava Naidu Gulla