test failure because of a global-buffer-overflow

Our Gentoo Tinderbox reported a test failure at bug 914171

By looking at build.log I can see:

==26==ERROR: AddressSanitizer: global-buffer-overflow on address 0x5643cdb3e067 at pc 0x5643cda7f4d9 bp 0x7ffc641ecb90 sp 0x7ffc641ecb88
READ of size 8 at 0x5643cdb3e067 thread T0
    #0 0x5643cda7f4d8 in DES_std_set_key /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/DES_std.c:663:15
    #1 0x5643cdab5fa0 in set_key /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/BSDI_fmt.c:266:2
    #2 0x5643cdafac74 in fmt_self_test_body /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/formats.c:138:3
    #3 0x5643cdafac74 in fmt_self_test /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/formats.c:227:11
    #4 0x5643cdae58b2 in benchmark_format /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/bench.c:155:15
    #5 0x5643cdae6bd9 in benchmark_all /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/bench.c:323:17
    #6 0x5643cdb032e4 in john_run /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/john.c:565:17
    #7 0x5643cdb032e4 in main /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/john.c:708:2
    #8 0x7f06d4823c89  (/lib64/libc.so.6+0x23c89)
    #9 0x7f06d4823d44 in __libc_start_main (/lib64/libc.so.6+0x23d44)
    #10 0x5643cd9a4550 in _start (/var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/run/john+0x37550)

0x5643cdb3e067 is located 57 bytes before global variable '.str' defined in '/var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/MD5_fmt.c:244' (0x5643cdb3e0a0) of size 9
  '.str' is ascii string 'md5crypt'
0x5643cdb3e067 is located 6 bytes after global variable '.str.28' defined in '/var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/BSDI_fmt.c:44' (0x5643cdb3e060) of size 1
  '.str.28' is ascii string ''
SUMMARY: AddressSanitizer: global-buffer-overflow /var/tmp/portage/app-crypt/johntheripper-1.9.0/work/john-1.9.0/src/DES_std.c:663:15 in DES_std_set_key
Shadow bytes around the buggy address:
  0x5643cdb3dd80: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 05 f9
  0x5643cdb3de00: f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 00 00 02 f9
  0x5643cdb3de80: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 02 f9 f9
  0x5643cdb3df00: 00 00 05 f9 f9 f9 f9 f9 00 02 f9 f9 00 00 05 f9
  0x5643cdb3df80: f9 f9 f9 f9 00 07 f9 f9 00 00 05 f9 f9 f9 f9 f9
=>0x5643cdb3e000: 00 01 f9 f9 00 00 05 f9 f9 f9 f9 f9[01]f9 f9 f9
  0x5643cdb3e080: 00 00 00 00 00 01 f9 f9 01 f9 f9 f9 00 05 f9 f9
  0x5643cdb3e100: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
  0x5643cdb3e180: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9
  0x5643cdb3e200: 00 00 00 00 06 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9
  0x5643cdb3e280: 00 00 00 00 03 f9 f9 f9 f9 f9 f9 f9 00 01 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==26==ABORTING

I didn't look deeply into this issue so I don't know if the bug is in the unittest itself or in the involed libraries/daemons, if so please check for any security implications.
If I can do further, please let me know.

Start with src/DES_std.c:663 and the caller in src/BSDI_fmt.c:266, then trace the failure through fmt_self_test and benchmark_format. Reproduce the Gentoo Tinderbox failure under AddressSanitizer and determine whether the overflow is in the test or the involved library code. Done means the failure is explained, any security impact is assessed, and the relevant test no longer reports the overflow.