diff --git a/pdf.c b/pdf.c
index 14e4a1da670fc0f1db89b2baf1e3047482adba13..4e159a39308ae3a089a6319e3e6227172b84d5a8 100644
--- a/pdf.c
+++ b/pdf.c
@@ -5023,6 +5023,7 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *nxrefs)
 		 * is a "linearized" PDF. in that case there should be exactly
 		 * one xref section at the beginning of the file that is
 		 * allowed to point forward.
+		 * also, the new offset should not point outside the file.
 		 */
 		if ((uint64_t)tok->sint >= offset)
 			nfwd++;
@@ -5032,6 +5033,12 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *nxrefs)
 			    offset);
 			break;
 		}
+		if ((uint64_t)tok->sint >= sz) {
+			log_message(5, "%s: /Prev pointer of xref section at "
+			    "%zu (%#zx) points outside the file\n", infile,
+			    offset, offset);
+			break;
+		}
 
 		offset = (size_t)tok->sint;
 	}