Fix actual authenticode hash computation for header overlap case

I'm really not sure why my testing earlier didn't catch that the computed
hash was not correct, but this seems to fix it in the UPX case

libclamav/pe.c

@@ -5660,6 +5660,7 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin
         /* Security to End of header */
         hlen = hdr_size - at;
         hash_chunk(at, hlen, 0, 0);
+        at += hlen;
         break;
     }
 
@@ -5669,6 +5670,24 @@ int cli_checkfp_pe(cli_ctx *ctx, uint8_t *authsha1, stats_section_t *hashes, uin
             continue;
 
         hash_chunk(exe_sections[i].raw, exe_sections[i].rsz, 1, i);
+
+        /* If the section overlaps with the header (the case for UPX binaries)
+         * adjust the entry in the authenticode hash regions list to account
+         * for the fact that we've already accounted for computing the hash
+         * over the header */
+        if (exe_sections[i].raw < at)
+        {
+            uint32_t overlap_size = (at - exe_sections[i].raw);
+            if (overlap_size >= exe_sections[i].rsz) {
+                /* The section completely overlaps the header.  Setting the
+                 * size to zero should prevent this section from affecting
+                 * the actual Authenticode hash computation. */
+                regions[nregions-1].size = 0;
+            } else {
+                regions[nregions-1].size -= overlap_size;
+                regions[nregions-1].ptr += overlap_size;
+            }
+        }
     }
 
     /* Finally, if there is data after the section with the highest