We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Move C code for padding into it's own .c and .h files
See `constant_time` for the same idea.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cryptography/hazmat/primitives/padding.py`
Content:
```
1 # This file is dual licensed under the terms of the Apache License, Version
2 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
3 # for complete details.
4 
5 from __future__ import absolute_import, division, print_function
6 
7 import abc
8 
9 import six
10 
11 from cryptography import utils
12 from cryptography.exceptions import AlreadyFinalized
13 from cryptography.hazmat.bindings.utils import LazyLibrary, build_ffi
14 
15 
16 TYPES = """
17 uint8_t Cryptography_check_pkcs7_padding(const uint8_t *, uint8_t);
18 """
19 
20 FUNCTIONS = """
21 /* Returns the value of the input with the most-significant-bit copied to all
22    of the bits. */
23 static uint8_t Cryptography_DUPLICATE_MSB_TO_ALL(uint8_t a) {
24     return (1 - (a >> (sizeof(uint8_t) * 8 - 1))) - 1;
25 }
26 
27 /* This returns 0xFF if a < b else 0x00, but does so in a constant time
28    fashion */
29 static uint8_t Cryptography_constant_time_lt(uint8_t a, uint8_t b) {
30     a -= b;
31     return Cryptography_DUPLICATE_MSB_TO_ALL(a);
32 }
33 
34 uint8_t Cryptography_check_pkcs7_padding(const uint8_t *data,
35                                          uint8_t block_len) {
36     uint8_t i;
37     uint8_t pad_size = data[block_len - 1];
38     uint8_t mismatch = 0;
39     for (i = 0; i < block_len; i++) {
40         unsigned int mask = Cryptography_constant_time_lt(i, pad_size);
41         uint8_t b = data[block_len - 1 - i];
42         mismatch |= (mask & (pad_size ^ b));
43     }
44 
45     /* Check to make sure the pad_size was within the valid range. */
46     mismatch |= ~Cryptography_constant_time_lt(0, pad_size);
47     mismatch |= Cryptography_constant_time_lt(block_len, pad_size);
48 
49     /* Make sure any bits set are copied to the lowest bit */
50     mismatch |= mismatch >> 4;
51     mismatch |= mismatch >> 2;
52     mismatch |= mismatch >> 1;
53     /* Now check the low bit to see if it's set */
54     return (mismatch & 1) == 0;
55 }
56 """
57 
58 
59 _ffi = build_ffi(cdef_source=TYPES, verify_source=FUNCTIONS)
60 _lib = LazyLibrary(_ffi)
61 
62 
63 @six.add_metaclass(abc.ABCMeta)
64 class PaddingContext(object):
65     @abc.abstractmethod
66     def update(self, data):
67         """
68         Pads the provided bytes and returns any available data as bytes.
69         """
70 
71     @abc.abstractmethod
72     def finalize(self):
73         """
74         Finalize the padding, returns bytes.
75         """
76 
77 
78 class PKCS7(object):
79     def __init__(self, block_size):
80         if not (0 <= block_size < 256):
81             raise ValueError("block_size must be in range(0, 256).")
82 
83         if block_size % 8 != 0:
84             raise ValueError("block_size must be a multiple of 8.")
85 
86         self.block_size = block_size
87 
88     def padder(self):
89         return _PKCS7PaddingContext(self.block_size)
90 
91     def unpadder(self):
92         return _PKCS7UnpaddingContext(self.block_size)
93 
94 
95 @utils.register_interface(PaddingContext)
96 class _PKCS7PaddingContext(object):
97     def __init__(self, block_size):
98         self.block_size = block_size
99         # TODO: more copies than necessary, we should use zero-buffer (#193)
100         self._buffer = b""
101 
102     def update(self, data):
103         if self._buffer is None:
104             raise AlreadyFinalized("Context was already finalized.")
105 
106         if not isinstance(data, bytes):
107             raise TypeError("data must be bytes.")
108 
109         self._buffer += data
110 
111         finished_blocks = len(self._buffer) // (self.block_size // 8)
112 
113         result = self._buffer[:finished_blocks * (self.block_size // 8)]
114         self._buffer = self._buffer[finished_blocks * (self.block_size // 8):]
115 
116         return result
117 
118     def finalize(self):
119         if self._buffer is None:
120             raise AlreadyFinalized("Context was already finalized.")
121 
122         pad_size = self.block_size // 8 - len(self._buffer)
123         result = self._buffer + six.int2byte(pad_size) * pad_size
124         self._buffer = None
125         return result
126 
127 
128 @utils.register_interface(PaddingContext)
129 class _PKCS7UnpaddingContext(object):
130     def __init__(self, block_size):
131         self.block_size = block_size
132         # TODO: more copies than necessary, we should use zero-buffer (#193)
133         self._buffer = b""
134 
135     def update(self, data):
136         if self._buffer is None:
137             raise AlreadyFinalized("Context was already finalized.")
138 
139         if not isinstance(data, bytes):
140             raise TypeError("data must be bytes.")
141 
142         self._buffer += data
143 
144         finished_blocks = max(
145             len(self._buffer) // (self.block_size // 8) - 1,
146             0
147         )
148 
149         result = self._buffer[:finished_blocks * (self.block_size // 8)]
150         self._buffer = self._buffer[finished_blocks * (self.block_size // 8):]
151 
152         return result
153 
154     def finalize(self):
155         if self._buffer is None:
156             raise AlreadyFinalized("Context was already finalized.")
157 
158         if len(self._buffer) != self.block_size // 8:
159             raise ValueError("Invalid padding bytes.")
160 
161         valid = _lib.Cryptography_check_pkcs7_padding(
162             self._buffer, self.block_size // 8
163         )
164 
165         if not valid:
166             raise ValueError("Invalid padding bytes.")
167 
168         pad_size = six.indexbytes(self._buffer, -1)
169         res = self._buffer[:-pad_size]
170         self._buffer = None
171         return res
172
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cryptography/hazmat/primitives/padding.py b/src/cryptography/hazmat/primitives/padding.py
--- a/src/cryptography/hazmat/primitives/padding.py
+++ b/src/cryptography/hazmat/primitives/padding.py
@@ -6,6 +6,8 @@
 
 import abc
 
+import os
+
 import six
 
 from cryptography import utils
@@ -13,47 +15,11 @@
 from cryptography.hazmat.bindings.utils import LazyLibrary, build_ffi
 
 
-TYPES = """
-uint8_t Cryptography_check_pkcs7_padding(const uint8_t *, uint8_t);
-"""
-
-FUNCTIONS = """
-/* Returns the value of the input with the most-significant-bit copied to all
-   of the bits. */
-static uint8_t Cryptography_DUPLICATE_MSB_TO_ALL(uint8_t a) {
-    return (1 - (a >> (sizeof(uint8_t) * 8 - 1))) - 1;
-}
-
-/* This returns 0xFF if a < b else 0x00, but does so in a constant time
-   fashion */
-static uint8_t Cryptography_constant_time_lt(uint8_t a, uint8_t b) {
-    a -= b;
-    return Cryptography_DUPLICATE_MSB_TO_ALL(a);
-}
-
-uint8_t Cryptography_check_pkcs7_padding(const uint8_t *data,
-                                         uint8_t block_len) {
-    uint8_t i;
-    uint8_t pad_size = data[block_len - 1];
-    uint8_t mismatch = 0;
-    for (i = 0; i < block_len; i++) {
-        unsigned int mask = Cryptography_constant_time_lt(i, pad_size);
-        uint8_t b = data[block_len - 1 - i];
-        mismatch |= (mask & (pad_size ^ b));
-    }
-
-    /* Check to make sure the pad_size was within the valid range. */
-    mismatch |= ~Cryptography_constant_time_lt(0, pad_size);
-    mismatch |= Cryptography_constant_time_lt(block_len, pad_size);
-
-    /* Make sure any bits set are copied to the lowest bit */
-    mismatch |= mismatch >> 4;
-    mismatch |= mismatch >> 2;
-    mismatch |= mismatch >> 1;
-    /* Now check the low bit to see if it's set */
-    return (mismatch & 1) == 0;
-}
-"""
+with open(os.path.join(os.path.dirname(__file__), "src/padding.h")) as f:
+    TYPES = f.read()
+
+with open(os.path.join(os.path.dirname(__file__), "src/padding.c")) as f:
+    FUNCTIONS = f.read()
 
 
 _ffi = build_ffi(cdef_source=TYPES, verify_source=FUNCTIONS)

{"golden_diff": "diff --git a/src/cryptography/hazmat/primitives/padding.py b/src/cryptography/hazmat/primitives/padding.py\n--- a/src/cryptography/hazmat/primitives/padding.py\n+++ b/src/cryptography/hazmat/primitives/padding.py\n@@ -6,6 +6,8 @@\n \n import abc\n \n+import os\n+\n import six\n \n from cryptography import utils\n@@ -13,47 +15,11 @@\n from cryptography.hazmat.bindings.utils import LazyLibrary, build_ffi\n \n \n-TYPES = \"\"\"\n-uint8_t Cryptography_check_pkcs7_padding(const uint8_t *, uint8_t);\n-\"\"\"\n-\n-FUNCTIONS = \"\"\"\n-/* Returns the value of the input with the most-significant-bit copied to all\n-   of the bits. */\n-static uint8_t Cryptography_DUPLICATE_MSB_TO_ALL(uint8_t a) {\n-    return (1 - (a >> (sizeof(uint8_t) * 8 - 1))) - 1;\n-}\n-\n-/* This returns 0xFF if a < b else 0x00, but does so in a constant time\n-   fashion */\n-static uint8_t Cryptography_constant_time_lt(uint8_t a, uint8_t b) {\n-    a -= b;\n-    return Cryptography_DUPLICATE_MSB_TO_ALL(a);\n-}\n-\n-uint8_t Cryptography_check_pkcs7_padding(const uint8_t *data,\n-                                         uint8_t block_len) {\n-    uint8_t i;\n-    uint8_t pad_size = data[block_len - 1];\n-    uint8_t mismatch = 0;\n-    for (i = 0; i < block_len; i++) {\n-        unsigned int mask = Cryptography_constant_time_lt(i, pad_size);\n-        uint8_t b = data[block_len - 1 - i];\n-        mismatch |= (mask & (pad_size ^ b));\n-    }\n-\n-    /* Check to make sure the pad_size was within the valid range. */\n-    mismatch |= ~Cryptography_constant_time_lt(0, pad_size);\n-    mismatch |= Cryptography_constant_time_lt(block_len, pad_size);\n-\n-    /* Make sure any bits set are copied to the lowest bit */\n-    mismatch |= mismatch >> 4;\n-    mismatch |= mismatch >> 2;\n-    mismatch |= mismatch >> 1;\n-    /* Now check the low bit to see if it's set */\n-    return (mismatch & 1) == 0;\n-}\n-\"\"\"\n+with open(os.path.join(os.path.dirname(__file__), \"src/padding.h\")) as f:\n+    TYPES = f.read()\n+\n+with open(os.path.join(os.path.dirname(__file__), \"src/padding.c\")) as f:\n+    FUNCTIONS = f.read()\n \n \n _ffi = build_ffi(cdef_source=TYPES, verify_source=FUNCTIONS)\n", "issue": "Move C code for padding into it's own .c and .h files\nSee `constant_time` for the same idea.\n\n", "before_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nimport abc\n\nimport six\n\nfrom cryptography import utils\nfrom cryptography.exceptions import AlreadyFinalized\nfrom cryptography.hazmat.bindings.utils import LazyLibrary, build_ffi\n\n\nTYPES = \"\"\"\nuint8_t Cryptography_check_pkcs7_padding(const uint8_t *, uint8_t);\n\"\"\"\n\nFUNCTIONS = \"\"\"\n/* Returns the value of the input with the most-significant-bit copied to all\n   of the bits. */\nstatic uint8_t Cryptography_DUPLICATE_MSB_TO_ALL(uint8_t a) {\n    return (1 - (a >> (sizeof(uint8_t) * 8 - 1))) - 1;\n}\n\n/* This returns 0xFF if a < b else 0x00, but does so in a constant time\n   fashion */\nstatic uint8_t Cryptography_constant_time_lt(uint8_t a, uint8_t b) {\n    a -= b;\n    return Cryptography_DUPLICATE_MSB_TO_ALL(a);\n}\n\nuint8_t Cryptography_check_pkcs7_padding(const uint8_t *data,\n                                         uint8_t block_len) {\n    uint8_t i;\n    uint8_t pad_size = data[block_len - 1];\n    uint8_t mismatch = 0;\n    for (i = 0; i < block_len; i++) {\n        unsigned int mask = Cryptography_constant_time_lt(i, pad_size);\n        uint8_t b = data[block_len - 1 - i];\n        mismatch |= (mask & (pad_size ^ b));\n    }\n\n    /* Check to make sure the pad_size was within the valid range. */\n    mismatch |= ~Cryptography_constant_time_lt(0, pad_size);\n    mismatch |= Cryptography_constant_time_lt(block_len, pad_size);\n\n    /* Make sure any bits set are copied to the lowest bit */\n    mismatch |= mismatch >> 4;\n    mismatch |= mismatch >> 2;\n    mismatch |= mismatch >> 1;\n    /* Now check the low bit to see if it's set */\n    return (mismatch & 1) == 0;\n}\n\"\"\"\n\n\n_ffi = build_ffi(cdef_source=TYPES, verify_source=FUNCTIONS)\n_lib = LazyLibrary(_ffi)\n\n\n@six.add_metaclass(abc.ABCMeta)\nclass PaddingContext(object):\n    @abc.abstractmethod\n    def update(self, data):\n        \"\"\"\n        Pads the provided bytes and returns any available data as bytes.\n        \"\"\"\n\n    @abc.abstractmethod\n    def finalize(self):\n        \"\"\"\n        Finalize the padding, returns bytes.\n        \"\"\"\n\n\nclass PKCS7(object):\n    def __init__(self, block_size):\n        if not (0 <= block_size < 256):\n            raise ValueError(\"block_size must be in range(0, 256).\")\n\n        if block_size % 8 != 0:\n            raise ValueError(\"block_size must be a multiple of 8.\")\n\n        self.block_size = block_size\n\n    def padder(self):\n        return _PKCS7PaddingContext(self.block_size)\n\n    def unpadder(self):\n        return _PKCS7UnpaddingContext(self.block_size)\n\n\n@utils.register_interface(PaddingContext)\nclass _PKCS7PaddingContext(object):\n    def __init__(self, block_size):\n        self.block_size = block_size\n        # TODO: more copies than necessary, we should use zero-buffer (#193)\n        self._buffer = b\"\"\n\n    def update(self, data):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        if not isinstance(data, bytes):\n            raise TypeError(\"data must be bytes.\")\n\n        self._buffer += data\n\n        finished_blocks = len(self._buffer) // (self.block_size // 8)\n\n        result = self._buffer[:finished_blocks * (self.block_size // 8)]\n        self._buffer = self._buffer[finished_blocks * (self.block_size // 8):]\n\n        return result\n\n    def finalize(self):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        pad_size = self.block_size // 8 - len(self._buffer)\n        result = self._buffer + six.int2byte(pad_size) * pad_size\n        self._buffer = None\n        return result\n\n\n@utils.register_interface(PaddingContext)\nclass _PKCS7UnpaddingContext(object):\n    def __init__(self, block_size):\n        self.block_size = block_size\n        # TODO: more copies than necessary, we should use zero-buffer (#193)\n        self._buffer = b\"\"\n\n    def update(self, data):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        if not isinstance(data, bytes):\n            raise TypeError(\"data must be bytes.\")\n\n        self._buffer += data\n\n        finished_blocks = max(\n            len(self._buffer) // (self.block_size // 8) - 1,\n            0\n        )\n\n        result = self._buffer[:finished_blocks * (self.block_size // 8)]\n        self._buffer = self._buffer[finished_blocks * (self.block_size // 8):]\n\n        return result\n\n    def finalize(self):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        if len(self._buffer) != self.block_size // 8:\n            raise ValueError(\"Invalid padding bytes.\")\n\n        valid = _lib.Cryptography_check_pkcs7_padding(\n            self._buffer, self.block_size // 8\n        )\n\n        if not valid:\n            raise ValueError(\"Invalid padding bytes.\")\n\n        pad_size = six.indexbytes(self._buffer, -1)\n        res = self._buffer[:-pad_size]\n        self._buffer = None\n        return res\n", "path": "src/cryptography/hazmat/primitives/padding.py"}], "after_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nfrom __future__ import absolute_import, division, print_function\n\nimport abc\n\nimport os\n\nimport six\n\nfrom cryptography import utils\nfrom cryptography.exceptions import AlreadyFinalized\nfrom cryptography.hazmat.bindings.utils import LazyLibrary, build_ffi\n\n\nwith open(os.path.join(os.path.dirname(__file__), \"src/padding.h\")) as f:\n    TYPES = f.read()\n\nwith open(os.path.join(os.path.dirname(__file__), \"src/padding.c\")) as f:\n    FUNCTIONS = f.read()\n\n\n_ffi = build_ffi(cdef_source=TYPES, verify_source=FUNCTIONS)\n_lib = LazyLibrary(_ffi)\n\n\n@six.add_metaclass(abc.ABCMeta)\nclass PaddingContext(object):\n    @abc.abstractmethod\n    def update(self, data):\n        \"\"\"\n        Pads the provided bytes and returns any available data as bytes.\n        \"\"\"\n\n    @abc.abstractmethod\n    def finalize(self):\n        \"\"\"\n        Finalize the padding, returns bytes.\n        \"\"\"\n\n\nclass PKCS7(object):\n    def __init__(self, block_size):\n        if not (0 <= block_size < 256):\n            raise ValueError(\"block_size must be in range(0, 256).\")\n\n        if block_size % 8 != 0:\n            raise ValueError(\"block_size must be a multiple of 8.\")\n\n        self.block_size = block_size\n\n    def padder(self):\n        return _PKCS7PaddingContext(self.block_size)\n\n    def unpadder(self):\n        return _PKCS7UnpaddingContext(self.block_size)\n\n\n@utils.register_interface(PaddingContext)\nclass _PKCS7PaddingContext(object):\n    def __init__(self, block_size):\n        self.block_size = block_size\n        # TODO: more copies than necessary, we should use zero-buffer (#193)\n        self._buffer = b\"\"\n\n    def update(self, data):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        if not isinstance(data, bytes):\n            raise TypeError(\"data must be bytes.\")\n\n        self._buffer += data\n\n        finished_blocks = len(self._buffer) // (self.block_size // 8)\n\n        result = self._buffer[:finished_blocks * (self.block_size // 8)]\n        self._buffer = self._buffer[finished_blocks * (self.block_size // 8):]\n\n        return result\n\n    def finalize(self):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        pad_size = self.block_size // 8 - len(self._buffer)\n        result = self._buffer + six.int2byte(pad_size) * pad_size\n        self._buffer = None\n        return result\n\n\n@utils.register_interface(PaddingContext)\nclass _PKCS7UnpaddingContext(object):\n    def __init__(self, block_size):\n        self.block_size = block_size\n        # TODO: more copies than necessary, we should use zero-buffer (#193)\n        self._buffer = b\"\"\n\n    def update(self, data):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        if not isinstance(data, bytes):\n            raise TypeError(\"data must be bytes.\")\n\n        self._buffer += data\n\n        finished_blocks = max(\n            len(self._buffer) // (self.block_size // 8) - 1,\n            0\n        )\n\n        result = self._buffer[:finished_blocks * (self.block_size // 8)]\n        self._buffer = self._buffer[finished_blocks * (self.block_size // 8):]\n\n        return result\n\n    def finalize(self):\n        if self._buffer is None:\n            raise AlreadyFinalized(\"Context was already finalized.\")\n\n        if len(self._buffer) != self.block_size // 8:\n            raise ValueError(\"Invalid padding bytes.\")\n\n        valid = _lib.Cryptography_check_pkcs7_padding(\n            self._buffer, self.block_size // 8\n        )\n\n        if not valid:\n            raise ValueError(\"Invalid padding bytes.\")\n\n        pad_size = six.indexbytes(self._buffer, -1)\n        res = self._buffer[:-pad_size]\n        self._buffer = None\n        return res\n", "path": "src/cryptography/hazmat/primitives/padding.py"}]}