oss-fuzz 47499: reading xref, check starting object num is positive

1 files changed, 3 insertions, 0 deletions

diff --git a/pdf/pdf_xref.c b/pdf/pdf_xref.c
index b0912d221..3142f2ef1 100644
--- a/pdf/pdf_xref.c
+++ b/pdf/pdf_xref.c
@@ -660,6 +660,9 @@ static int read_xref_section(pdf_context *ctx, pdf_c_stream *s, uint64_t *sectio
         return 1;
     }
 
+    if (start < 0)
+        return_error(gs_error_rangecheck);
+
     *section_start = start;
 
     code = pdfi_read_bare_int(ctx, ctx->main_stream, &size);