Unless it changes the contents of the input array, MD5Update() in md5.h should declare it's input argument as an array of constant bytes. Same goes for MD5Builder and the Hash library.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.