MD5: add a missing bounds check

Change-Id: I866d434953b3479de9c482b9fb311b93d8e9aec9