@@ -2075,9 +2075,13 @@ int asn1_check_mscat(struct cl_engine *engine, fmap_t *map, size_t offset, unsig

     // Now that we know the hash algorithm, compute the authenticode hash

     // across the required regions of memory.

-    // NOTE: section[i].ptr points to an already mapped region of memory

     for(int i = 0; i < nregions; i++) {

-        cl_update_hash(ctx, regions[i].ptr, regions[i].size);

+        const uint8_t *hptr; \

+        if(!(hptr = fmap_need_off_once(map, regions[i].offset, regions[i].size))){

+            return CL_VIRUS;

+        }

+

+        cl_update_hash(ctx, hptr, regions[i].size);

     }

     cl_finish_hash(ctx, hash);

@@ -26,7 +26,7 @@

 #include "fmap.h"

 struct cli_mapped_region {

-    const unsigned char *ptr;

+    unsigned int offset;

     unsigned int size;

 };

@@ -5567,8 +5567,35 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

         }

     }

+    // TODO This likely isn't needed anymore, since we no longer compute

+    // the authenticode hash like the 2008 spec doc says (sort sections

+    // and use the section info to compute the hash)

     cli_qsort(exe_sections, nsections, sizeof(*exe_sections), sort_sects);

+    /* Hash the sections */

+    if (flags & CL_CHECKFP_PE_FLAG_STATS) {

+

+        for(i = 0; i < nsections; i++) {

+            const uint8_t *hptr;

+            void *md5ctx;

+

+            if(!exe_sections[i].rsz)

+                continue;

+

+            if(!(hptr = fmap_need_off_once(map, exe_sections[i].raw, exe_sections[i].rsz))){

+                free(exe_sections);

+                return CL_EFORMAT;

+            }

+            md5ctx = cl_hash_init("md5");

+            if (md5ctx) {

+                cl_update_hash(md5ctx, (void *)hptr, exe_sections[i].rsz);

+                cl_finish_hash(md5ctx, hashes->sections[i].md5);

+            }

+        }

+    }

+

+    free(exe_sections);

+

     if (flags & CL_CHECKFP_PE_FLAG_AUTHENTICODE) {

         /* Check to see if we have a security section. */

         if(!cli_hm_have_size(ctx->engine->hm_fp, CLI_HASH_SHA1, 2) && EC32(dirs[4].Size) < 8) {

@@ -5576,7 +5603,6 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

                 /* If stats is enabled, continue parsing the sample */

                 flags ^= CL_CHECKFP_PE_FLAG_AUTHENTICODE;

             } else {

-                free(exe_sections);

                 return CL_BREAK;

             }

         }

@@ -5590,7 +5616,6 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

             if (flags & CL_CHECKFP_PE_FLAG_STATS) {

                 flags ^= CL_CHECKFP_PE_FLAG_AUTHENTICODE;

             } else {

-                free(exe_sections);

                 return CL_EFORMAT;

             }

         }

@@ -5602,23 +5627,15 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

     // data associated with each section.

     regions = (struct cli_mapped_region *) cli_calloc(nsections+4, sizeof(struct cli_mapped_region));

     if(!regions) {

-        free(exe_sections);

         return CL_EMEM;

     }

     nregions = 0;

-#define hash_chunk(where, _size) \

+#define add_chunk_to_hash_list(_offset, _size) \

     do { \

-        const uint8_t *hptr; \

-        if(!(_size)) break; \

-        if(!(hptr = fmap_need_off_once(map, where, _size))){ \

-            free(exe_sections); \

-            free(regions); \

-            return CL_EFORMAT; \

-        } \

         if (flags & CL_CHECKFP_PE_FLAG_AUTHENTICODE) { \

-            regions[nregions].ptr = hptr; \

-            regions[nregions].size = _size; \

+            regions[nregions].offset = (_offset); \

+            regions[nregions].size = (_size); \

             nregions++; \

         } \

     } while(0)

@@ -5627,7 +5644,7 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

         /* MZ to checksum */

         at = 0;

         hlen = e_lfanew + sizeof(struct pe_image_file_hdr) + (pe_plus ? offsetof(struct pe_image_optional_hdr64, CheckSum) : offsetof(struct pe_image_optional_hdr32, CheckSum));

-        hash_chunk(0, hlen);

+        add_chunk_to_hash_list(0, hlen);

         at = hlen + 4;

         /* Checksum to security */

@@ -5635,7 +5652,7 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

             hlen = offsetof(struct pe_image_optional_hdr64, DataDirectory[4]) - offsetof(struct pe_image_optional_hdr64, CheckSum) - 4;

         else

             hlen = offsetof(struct pe_image_optional_hdr32, DataDirectory[4]) - offsetof(struct pe_image_optional_hdr32, CheckSum) - 4;

-        hash_chunk(at, hlen);

+        add_chunk_to_hash_list(at, hlen);

         at += hlen + 8;

         if(at > hdr_size) {

@@ -5643,7 +5660,6 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

                 flags ^= CL_CHECKFP_PE_FLAG_AUTHENTICODE;

                 break;

             } else {

-                free(exe_sections);

                 free(regions);

                 return CL_EFORMAT;

             }

@@ -5651,42 +5667,17 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin

         /* Security to End of header */

         hlen = hdr_size - at;

-        hash_chunk(at, hlen);

+        add_chunk_to_hash_list(at, hlen);

         at += hlen;

         break;

     }

-    /* Hash the sections */

-    if (flags & CL_CHECKFP_PE_FLAG_STATS) {

-

-        for(i = 0; i < nsections; i++) {

-            const uint8_t *hptr;

-            void *md5ctx;

-

-            if(!exe_sections[i].rsz)

-                continue;

-

-            if(!(hptr = fmap_need_off_once(map, exe_sections[i].raw, exe_sections[i].rsz))){

-                free(exe_sections);

-                free(regions);

-                return CL_EFORMAT;

-            }

-            md5ctx = cl_hash_init("md5");

-            if (md5ctx) {

-                cl_update_hash(md5ctx, (void *)hptr, exe_sections[i].rsz);

-                cl_finish_hash(md5ctx, hashes->sections[i].md5);

-            }

-        }

-    }

-

-    free(exe_sections);

-

     /* Finally, hash everything from the end of the header to the start of

      * the security section, which must be the last thing in a file

      */

     if (at < EC32(dirs[4].VirtualAddress)) {

         hlen = EC32(dirs[4].VirtualAddress)-at;

-        hash_chunk(at, hlen);

+        add_chunk_to_hash_list(at, hlen);

     }

     if (flags & CL_CHECKFP_PE_FLAG_AUTHENTICODE) {