Patched code sample

import hashlib

# This code represents the fix for CVE-2023-25194 (mislabeled in the prompt).
# The vulnerability was that a broker-controlled 'iteration_count' was passed
# directly to `hashlib.pbkdf2_hmac` without validation. A large number would
# cause excessive CPU usage, freezing the client.

class KafkaError(Exception):
    """A generic error class for the example."""
    pass

class ScramClient:
    def __init__(self, password, sasl_mechanism='SCRAM-SHA-256'):
        self._password = password.encode('utf-8')
        self._sasl_mechanism_name = sasl_mechanism.split('-', 1)[1].lower() # e.g., 'sha-256'
        self._hash_name = self._sasl_mechanism_name.replace('-', '') # e.g., 'sha256'

        # --- THE FIX: Define safe boundaries for the iteration count ---
        # RFC 5802 requires a minimum of 4096 iterations.
        self.MIN_ITERATION_COUNT = 4096
        # A reasonable upper bound to prevent CPU-exhaustion (Denial-of-Service).
        self.MAX_ITERATION_COUNT = 16777216
        # --- END OF FIX ---

    def _process_server_first_message(self, server_message_data):
        """
        A simplified representation of the method containing the fix.
        `server_message_data` is a dictionary parsed from the broker's response.
        """
        try:
            iteration_count = int(server_message_data['i'])
            salt = server_message_data['s'].encode('utf-8')
        except (KeyError, ValueError) as e:
            raise KafkaError(f"Invalid SCRAM server-first-message: {e}")

        # --- THE FIX: Validate the iteration count against the defined boundaries ---
        if not (self.MIN_ITERATION_COUNT <= iteration_count <= self.MAX_ITERATION_COUNT):
            # This check prevents the DoS by rejecting an excessively large number
            # before it reaches the expensive pbkdf2_hmac function.
            raise KafkaError(
                f"Invalid SCRAM iteration count '{iteration_count}' from broker. "
                f"Must be within [{self.MIN_ITERATION_COUNT}-{self.MAX_ITERATION_COUNT}]."
            )
        # --- END OF FIX ---

        # The vulnerable code passed the unvalidated 'iteration_count' directly here.
        # Now, the operation is safe because the count has been validated.
        salted_password = hashlib.pbkdf2_hmac(
            self._hash_name,
            self._password,
            salt,
            iteration_count
        )
        return salted_password