prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  scrypt bounds checking
  ```
  [11:23:58]  <Alex_Gaynor>   reaperhulk: what happens if you pass a non-even n?
  [11:24:10]  <Alex_Gaynor>   Or a negative value for any of the params?
  ```
  
  Presumably it will fail with an assertion error on return from the call to `EVP_PBE_scrypt`, but we shouldn't allow those types of errors.
  
  cc @Ayrx.
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `src/cryptography/hazmat/primitives/kdf/scrypt.py`
  Content:
  ```
  1 # This file is dual licensed under the terms of the Apache License, Version
  2 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
  3 # for complete details.
  4 
  5 from __future__ import absolute_import, division, print_function
  6 
  7 from cryptography import utils
  8 from cryptography.exceptions import (
  9     AlreadyFinalized, InvalidKey, UnsupportedAlgorithm, _Reasons
  10 )
  11 from cryptography.hazmat.backends.interfaces import ScryptBackend
  12 from cryptography.hazmat.primitives import constant_time
  13 from cryptography.hazmat.primitives.kdf import KeyDerivationFunction
  14 
  15 
  16 @utils.register_interface(KeyDerivationFunction)
  17 class Scrypt(object):
  18     def __init__(self, salt, length, n, r, p, backend):
  19         if not isinstance(backend, ScryptBackend):
  20             raise UnsupportedAlgorithm(
  21                 "Backend object does not implement ScryptBackend.",
  22                 _Reasons.BACKEND_MISSING_INTERFACE
  23             )
  24 
  25         self._length = length
  26         if not isinstance(salt, bytes):
  27             raise TypeError("salt must be bytes.")
  28         self._used = False
  29         self._salt = salt
  30         self._n = n
  31         self._r = r
  32         self._p = p
  33         self._backend = backend
  34 
  35     def derive(self, key_material):
  36         if self._used:
  37             raise AlreadyFinalized("Scrypt instances can only be used once.")
  38         self._used = True
  39 
  40         if not isinstance(key_material, bytes):
  41             raise TypeError("key_material must be bytes.")
  42         return self._backend.derive_scrypt(
  43             key_material, self._salt, self._length, self._n, self._r, self._p
  44         )
  45 
  46     def verify(self, key_material, expected_key):
  47         derived_key = self.derive(key_material)
  48         if not constant_time.bytes_eq(derived_key, expected_key):
  49             raise InvalidKey("Keys do not match.")
  50
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/src/cryptography/hazmat/primitives/kdf/scrypt.py b/src/cryptography/hazmat/primitives/kdf/scrypt.py
  --- a/src/cryptography/hazmat/primitives/kdf/scrypt.py
  +++ b/src/cryptography/hazmat/primitives/kdf/scrypt.py
  @@ -25,6 +25,16 @@
           self._length = length
           if not isinstance(salt, bytes):
               raise TypeError("salt must be bytes.")
  +
  +        if n < 2 or (n & (n - 1)) != 0:
  +            raise ValueError("n must be greater than 1 and be a power of 2.")
  +
  +        if r < 1:
  +            raise ValueError("r must be greater than or equal to 1.")
  +
  +        if p < 1:
  +            raise ValueError("p must be greater than or equal to 1.")
  +
           self._used = False
           self._salt = salt
           self._n = n
  
verification_info: {"golden_diff": "diff --git a/src/cryptography/hazmat/primitives/kdf/scrypt.py b/src/cryptography/hazmat/primitives/kdf/scrypt.py\n--- a/src/cryptography/hazmat/primitives/kdf/scrypt.py\n+++ b/src/cryptography/hazmat/primitives/kdf/scrypt.py\n@@ -25,6 +25,16 @@\n         self._length = length\n         if not isinstance(salt, bytes):\n             raise TypeError(\"salt must be bytes.\")\n+\n+        if n < 2 or (n & (n - 1)) != 0:\n+            raise ValueError(\"n must be greater than 1 and be a power of 2.\")\n+\n+        if r < 1:\n+            raise ValueError(\"r must be greater than or equal to 1.\")\n+\n+        if p < 1:\n+            raise ValueError(\"p must be greater than or equal to 1.\")\n+\n         self._used = False\n         self._salt = salt\n         self._n = n\n", "issue": "scrypt bounds checking\n```\n[11:23:58]  <Alex_Gaynor>   reaperhulk: what happens if you pass a non-even n?\n[11:24:10]  <Alex_Gaynor>   Or a negative value for any of the params?\n```\n\nPresumably it will fail with an assertion error on return from the call to `EVP_PBE_scrypt`, but we shouldn't allow those types of errors.\n\ncc @Ayrx.\n\n", "before_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nfrom cryptography import utils\nfrom cryptography.exceptions import (\n    AlreadyFinalized, InvalidKey, UnsupportedAlgorithm, _Reasons\n)\nfrom cryptography.hazmat.backends.interfaces import ScryptBackend\nfrom cryptography.hazmat.primitives import constant_time\nfrom cryptography.hazmat.primitives.kdf import KeyDerivationFunction\n\n\n@utils.register_interface(KeyDerivationFunction)\nclass Scrypt(object):\n    def __init__(self, salt, length, n, r, p, backend):\n        if not isinstance(backend, ScryptBackend):\n            raise UnsupportedAlgorithm(\n                \"Backend object does not implement ScryptBackend.\",\n                _Reasons.BACKEND_MISSING_INTERFACE\n            )\n\n        self._length = length\n        if not isinstance(salt, bytes):\n            raise TypeError(\"salt must be bytes.\")\n        self._used = False\n        self._salt = salt\n        self._n = n\n        self._r = r\n        self._p = p\n        self._backend = backend\n\n    def derive(self, key_material):\n        if self._used:\n            raise AlreadyFinalized(\"Scrypt instances can only be used once.\")\n        self._used = True\n\n        if not isinstance(key_material, bytes):\n            raise TypeError(\"key_material must be bytes.\")\n        return self._backend.derive_scrypt(\n            key_material, self._salt, self._length, self._n, self._r, self._p\n        )\n\n    def verify(self, key_material, expected_key):\n        derived_key = self.derive(key_material)\n        if not constant_time.bytes_eq(derived_key, expected_key):\n            raise InvalidKey(\"Keys do not match.\")\n", "path": "src/cryptography/hazmat/primitives/kdf/scrypt.py"}], "after_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nfrom cryptography import utils\nfrom cryptography.exceptions import (\n    AlreadyFinalized, InvalidKey, UnsupportedAlgorithm, _Reasons\n)\nfrom cryptography.hazmat.backends.interfaces import ScryptBackend\nfrom cryptography.hazmat.primitives import constant_time\nfrom cryptography.hazmat.primitives.kdf import KeyDerivationFunction\n\n\n@utils.register_interface(KeyDerivationFunction)\nclass Scrypt(object):\n    def __init__(self, salt, length, n, r, p, backend):\n        if not isinstance(backend, ScryptBackend):\n            raise UnsupportedAlgorithm(\n                \"Backend object does not implement ScryptBackend.\",\n                _Reasons.BACKEND_MISSING_INTERFACE\n            )\n\n        self._length = length\n        if not isinstance(salt, bytes):\n            raise TypeError(\"salt must be bytes.\")\n\n        if n < 2 or (n & (n - 1)) != 0:\n            raise ValueError(\"n must be greater than 1 and be a power of 2.\")\n\n        if r < 1:\n            raise ValueError(\"r must be greater than or equal to 1.\")\n\n        if p < 1:\n            raise ValueError(\"p must be greater than or equal to 1.\")\n\n        self._used = False\n        self._salt = salt\n        self._n = n\n        self._r = r\n        self._p = p\n        self._backend = backend\n\n    def derive(self, key_material):\n        if self._used:\n            raise AlreadyFinalized(\"Scrypt instances can only be used once.\")\n        self._used = True\n\n        if not isinstance(key_material, bytes):\n            raise TypeError(\"key_material must be bytes.\")\n        return self._backend.derive_scrypt(\n            key_material, self._salt, self._length, self._n, self._r, self._p\n        )\n\n    def verify(self, key_material, expected_key):\n        derived_key = self.derive(key_material)\n        if not constant_time.bytes_eq(derived_key, expected_key):\n            raise InvalidKey(\"Keys do not match.\")\n", "path": "src/cryptography/hazmat/primitives/kdf/scrypt.py"}]}