fixed possible memory leak.

From the new MD5 library bug fix commit: "I've changed it to alloc the
hash but the caller must subsequently free() it."