don't authenticode unless we've got a security dir or cats loaded

libclamav/pe.c

@@ -2743,6 +2743,9 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1) {
 	dirs = optional_hdr64.DataDirectory;
     }
 
+    if(!cli_hm_have_size(ctx->engine->hm_fp, CLI_HASH_SHA1, 2) && dirs[4].Size < 8)
+	return CL_BREAK;
+
     fsize = map->len;
 
     valign = (pe_plus)?EC32(optional_hdr64.SectionAlignment):EC32(optional_hdr32.SectionAlignment);
@@ -2857,9 +2860,6 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1) {
     }
 
     hlen = dirs[4].Size;
-    if(!hlen)
-	return CL_VIRUS;
-
     if(hlen < 8)
 	return CL_VIRUS;
     hlen -= 8;