src/java.base/share/classes/sun/security/provider/MD5.java

@@ -23,10 +23,12 @@
  * questions.
  */
 
 package sun.security.provider;
 
+import java.util.Arrays;
+
 import static sun.security.provider.ByteArrayAccess.*;
 
 /**
  * The MD5 class is used to compute an MD5 message digest over a given
  * buffer of bytes. It is an implementation of the RSA Data Security Inc

@@ -64,11 +66,11 @@
     // Standard constructor, creates a new MD5 instance.
     public MD5() {
         super("MD5", 16, 64);
         state = new int[4];
         x = new int[16];
-        implReset();
+        resetHashes();
     }
 
     // clone this object
     public Object clone() throws CloneNotSupportedException {
         MD5 copy = (MD5) super.clone();

@@ -80,10 +82,16 @@
     /**
      * Reset the state of this object.
      */
     void implReset() {
         // Load magic initialization constants.
+        resetHashes();
+        // clear out old data
+        Arrays.fill(x, 0);
+    }
+
+    private void resetHashes() {
         state[0] = 0x67452301;
         state[1] = 0xefcdab89;
         state[2] = 0x98badcfe;
         state[3] = 0x10325476;
     }