Suricata

When computing the MD5 of an email body in, the mime decoding appears to attempt to build the hash up over the contents of each mime part. The issue is that ProcessBodyComplete is called at the end of each part wich results in "HASH_End" being called. As the same MD5 context continues to be used, the hash is no longer updated as libnss appears to accept updates, but continued calls to HASH_End keep returning the value from the first HASH_End.

I found this while converting to the Rust MD5 implementation which free's the MD5 context when finalized (the equivalent to HASH_End). By tweaking the Rust MD5 bindings I can let it continue accumulate after "finalize", but it would probably be better to wait until the message is completed, instead of doing this at the end of every part, if thats an easy enough modification, as I'd rather keep the behaviour where the MD5 context is "consumed" upon finalization.