hash: fix buffer overrun pointed out by coverity