this should really implement a patch for the illegal access

src/hashes/blake2b.c

@@ -342,7 +342,7 @@ int blake2b_process(hash_state *md, const unsigned char *in, unsigned long inlen
       unsigned long fill = BLAKE2B_BLOCKBYTES - left;
       if (inlen > fill) {
          md->blake2b.curlen = 0;
-         XMEMCPY(md->blake2b.buf + left, in, fill); /* Fill buffer */
+         XMEMCPY(md->blake2b.buf + (left % sizeof(md->blake2b.buf)), in, fill); /* Fill buffer */
          blake2b_increment_counter(md, BLAKE2B_BLOCKBYTES);
          blake2b_compress(md, md->blake2b.buf); /* Compress */
          in += fill;

src/hashes/blake2s.c

@@ -330,7 +330,7 @@ int blake2s_process(hash_state *md, const unsigned char *in, unsigned long inlen
       unsigned long fill = BLAKE2S_BLOCKBYTES - left;
       if (inlen > fill) {
          md->blake2s.curlen = 0;
-         XMEMCPY(md->blake2s.buf + left, in, fill); /* Fill buffer */
+         XMEMCPY(md->blake2s.buf + (left % sizeof(md->blake2s.buf)), in, fill); /* Fill buffer */
          blake2s_increment_counter(md, BLAKE2S_BLOCKBYTES);
          blake2s_compress(md, md->blake2s.buf); /* Compress */
          in += fill;