localize and don't leak cross-platform md5 function