fixed bug where sections ended up in a copy

[roenyroeny]

In calculate_checksum we iterate over the list of sections.
However, instead of populating the local sections vector we populate ctx.sections instead.
for (const auto &section : sections) then ends up iterating over a empty vector.

This behavior has likely gone unnoticed because total_bytes_hashed was also a copy, which caused the sections we missed before to end up in the trailer_buf instead.
This combination of bugs causes it to hash correctly.

Another thing worth mentioning is that according to the authenticode spec the sections should be hashed in order of their base address. which is something i don't think we currently do.

[CLAassistant]

All committers have signed the CLA.

[woodruffw]

Thanks for catching that @roenyroeny! I'll give this a full review today.

Another thing worth mentioning is that according to the authenticode spec the sections should be hashed in order of their base address. which is something i don't think we currently do.

Hmm, where did you see this? In the 2008 spec (the only public one I'm aware of) sections are hashed in order of their file offset, which is what we currently do:

Using the PointerToRawData field (offset 20) in the referenced SectionHeader structure as a key,
arrange the table's elements in ascending order. In other words, sort the section headers in
ascending order according to the disk-file offset of the sections.

(From step 10 under "Calculating the PE Image Hash" in https://yossarian.net/junk/hard_to_find/authenticode-pe.pdf)

[roenyroeny]

I saw that in the section of the spec you mentioned. Thanks for confirming that this is what we already do.

[woodruffw]

No problem! FYI if you merge or rebase here the CI will go green; I've fixed it on the main branch.