commit - b3dda3fe558da73e9b929790be8eb74afad337c6
commit + e61966396178de7c6118f47291cf1d93b96072d3
blob - 04e077d7770c356c450863f0601ea7238b17d119
blob + ed6afd0326403345282b893da4fea696848d9f41
--- pdf.c
+++ pdf.c
@@ -4972,18 +4972,15 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *n
 		goto end;
 	}
 	offset = H_INDEX_UINT(res->ast, 0);
-
-	// XXX put many checks here into semantic validations in the parser...
-	// e.g. offset bounds, /Prev type/value, loop detection
-
-	// verify the offset recovered is bounded to be in the file
-	// XXX this check is already present below by virtue of h_seek()
 	if (offset > sz) {
 		log_message(5, "%s: startxref value at %zu (%#zx) points "
 		    "outside the file\n", sz - i, sz - i);
 		goto end;
 	}
 
+	// XXX put many checks here also into semantic validations in the
+	// parser... e.g. offset bounds, /Prev type/value, loop detection
+
 	// XXX try formulating this loop as one parser using h_seek and h_bind
 	for (;;) {
 		assert(offset <= sz);