We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
scrypt bounds checking
```
[11:23:58]  <Alex_Gaynor>   reaperhulk: what happens if you pass a non-even n?
[11:24:10]  <Alex_Gaynor>   Or a negative value for any of the params?
```

Presumably it will fail with an assertion error on return from the call to `EVP_PBE_scrypt`, but we shouldn't allow those types of errors.

cc @Ayrx.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cryptography/hazmat/primitives/kdf/scrypt.py`
Content:
```
1 # This file is dual licensed under the terms of the Apache License, Version
2 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
3 # for complete details.
4 
5 from __future__ import absolute_import, division, print_function
6 
7 from cryptography import utils
8 from cryptography.exceptions import (
9     AlreadyFinalized, InvalidKey, UnsupportedAlgorithm, _Reasons
10 )
11 from cryptography.hazmat.backends.interfaces import ScryptBackend
12 from cryptography.hazmat.primitives import constant_time
13 from cryptography.hazmat.primitives.kdf import KeyDerivationFunction
14 
15 
16 @utils.register_interface(KeyDerivationFunction)
17 class Scrypt(object):
18     def __init__(self, salt, length, n, r, p, backend):
19         if not isinstance(backend, ScryptBackend):
20             raise UnsupportedAlgorithm(
21                 "Backend object does not implement ScryptBackend.",
22                 _Reasons.BACKEND_MISSING_INTERFACE
23             )
24 
25         self._length = length
26         if not isinstance(salt, bytes):
27             raise TypeError("salt must be bytes.")
28         self._used = False
29         self._salt = salt
30         self._n = n
31         self._r = r
32         self._p = p
33         self._backend = backend
34 
35     def derive(self, key_material):
36         if self._used:
37             raise AlreadyFinalized("Scrypt instances can only be used once.")
38         self._used = True
39 
40         if not isinstance(key_material, bytes):
41             raise TypeError("key_material must be bytes.")
42         return self._backend.derive_scrypt(
43             key_material, self._salt, self._length, self._n, self._r, self._p
44         )
45 
46     def verify(self, key_material, expected_key):
47         derived_key = self.derive(key_material)
48         if not constant_time.bytes_eq(derived_key, expected_key):
49             raise InvalidKey("Keys do not match.")
50
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cryptography/hazmat/primitives/kdf/scrypt.py b/src/cryptography/hazmat/primitives/kdf/scrypt.py
--- a/src/cryptography/hazmat/primitives/kdf/scrypt.py
+++ b/src/cryptography/hazmat/primitives/kdf/scrypt.py
@@ -25,6 +25,16 @@
         self._length = length
         if not isinstance(salt, bytes):
             raise TypeError("salt must be bytes.")
+
+        if n < 2 or (n & (n - 1)) != 0:
+            raise ValueError("n must be greater than 1 and be a power of 2.")
+
+        if r < 1:
+            raise ValueError("r must be greater than or equal to 1.")
+
+        if p < 1:
+            raise ValueError("p must be greater than or equal to 1.")
+
         self._used = False
         self._salt = salt
         self._n = n

{"golden_diff": "diff --git a/src/cryptography/hazmat/primitives/kdf/scrypt.py b/src/cryptography/hazmat/primitives/kdf/scrypt.py\n--- a/src/cryptography/hazmat/primitives/kdf/scrypt.py\n+++ b/src/cryptography/hazmat/primitives/kdf/scrypt.py\n@@ -25,6 +25,16 @@\n         self._length = length\n         if not isinstance(salt, bytes):\n             raise TypeError(\"salt must be bytes.\")\n+\n+        if n < 2 or (n & (n - 1)) != 0:\n+            raise ValueError(\"n must be greater than 1 and be a power of 2.\")\n+\n+        if r < 1:\n+            raise ValueError(\"r must be greater than or equal to 1.\")\n+\n+        if p < 1:\n+            raise ValueError(\"p must be greater than or equal to 1.\")\n+\n         self._used = False\n         self._salt = salt\n         self._n = n\n", "issue": "scrypt bounds checking\n```\n[11:23:58]  <Alex_Gaynor>   reaperhulk: what happens if you pass a non-even n?\n[11:24:10]  <Alex_Gaynor>   Or a negative value for any of the params?\n```\n\nPresumably it will fail with an assertion error on return from the call to `EVP_PBE_scrypt`, but we shouldn't allow those types of errors.\n\ncc @Ayrx.\n\n", "before_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nfrom cryptography import utils\nfrom cryptography.exceptions import (\n    AlreadyFinalized, InvalidKey, UnsupportedAlgorithm, _Reasons\n)\nfrom cryptography.hazmat.backends.interfaces import ScryptBackend\nfrom cryptography.hazmat.primitives import constant_time\nfrom cryptography.hazmat.primitives.kdf import KeyDerivationFunction\n\n\n@utils.register_interface(KeyDerivationFunction)\nclass Scrypt(object):\n    def __init__(self, salt, length, n, r, p, backend):\n        if not isinstance(backend, ScryptBackend):\n            raise UnsupportedAlgorithm(\n                \"Backend object does not implement ScryptBackend.\",\n                _Reasons.BACKEND_MISSING_INTERFACE\n            )\n\n        self._length = length\n        if not isinstance(salt, bytes):\n            raise TypeError(\"salt must be bytes.\")\n        self._used = False\n        self._salt = salt\n        self._n = n\n        self._r = r\n        self._p = p\n        self._backend = backend\n\n    def derive(self, key_material):\n        if self._used:\n            raise AlreadyFinalized(\"Scrypt instances can only be used once.\")\n        self._used = True\n\n        if not isinstance(key_material, bytes):\n            raise TypeError(\"key_material must be bytes.\")\n        return self._backend.derive_scrypt(\n            key_material, self._salt, self._length, self._n, self._r, self._p\n        )\n\n    def verify(self, key_material, expected_key):\n        derived_key = self.derive(key_material)\n        if not constant_time.bytes_eq(derived_key, expected_key):\n            raise InvalidKey(\"Keys do not match.\")\n", "path": "src/cryptography/hazmat/primitives/kdf/scrypt.py"}], "after_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nfrom cryptography import utils\nfrom cryptography.exceptions import (\n    AlreadyFinalized, InvalidKey, UnsupportedAlgorithm, _Reasons\n)\nfrom cryptography.hazmat.backends.interfaces import ScryptBackend\nfrom cryptography.hazmat.primitives import constant_time\nfrom cryptography.hazmat.primitives.kdf import KeyDerivationFunction\n\n\n@utils.register_interface(KeyDerivationFunction)\nclass Scrypt(object):\n    def __init__(self, salt, length, n, r, p, backend):\n        if not isinstance(backend, ScryptBackend):\n            raise UnsupportedAlgorithm(\n                \"Backend object does not implement ScryptBackend.\",\n                _Reasons.BACKEND_MISSING_INTERFACE\n            )\n\n        self._length = length\n        if not isinstance(salt, bytes):\n            raise TypeError(\"salt must be bytes.\")\n\n        if n < 2 or (n & (n - 1)) != 0:\n            raise ValueError(\"n must be greater than 1 and be a power of 2.\")\n\n        if r < 1:\n            raise ValueError(\"r must be greater than or equal to 1.\")\n\n        if p < 1:\n            raise ValueError(\"p must be greater than or equal to 1.\")\n\n        self._used = False\n        self._salt = salt\n        self._n = n\n        self._r = r\n        self._p = p\n        self._backend = backend\n\n    def derive(self, key_material):\n        if self._used:\n            raise AlreadyFinalized(\"Scrypt instances can only be used once.\")\n        self._used = True\n\n        if not isinstance(key_material, bytes):\n            raise TypeError(\"key_material must be bytes.\")\n        return self._backend.derive_scrypt(\n            key_material, self._salt, self._length, self._n, self._r, self._p\n        )\n\n    def verify(self, key_material, expected_key):\n        derived_key = self.derive(key_material)\n        if not constant_time.bytes_eq(derived_key, expected_key):\n            raise InvalidKey(\"Keys do not match.\")\n", "path": "src/cryptography/hazmat/primitives/kdf/scrypt.py"}]}