cipher[31] and cipher_mode[31] buffers were passed to crypt_parse_name_and_mode() routine where sscanf(s, "%31[^-]-%31s", cipher, cipher_mode) was called. In corner case it could cause terminating 0 byte written beyond respective arrays.