diff --git a/pdf.c b/pdf.c
index f15bc6cc9d7f94428a3cb4d6b86e2bfee93980b2..2e5e321b3527918833c5cbba4e4769b85703a4de 100644
--- a/pdf.c
+++ b/pdf.c
@@ -657,15 +657,18 @@ init_parser(struct Env *aux)
 XREntry *
 lookup_xref(struct Env *aux, size_t nr, size_t gen)
 {
+	HParsedToken *ss;	/* xref subsection */
+	size_t base, n;
+
 	/* for each cross-reference section (i.e. update) */
 	for (size_t i = 0; i < aux->nxrefs; i++) {
 		HCountedArray *subs = H_INDEX_SEQ(aux->xrefs[i], 0);
 
 		/* for each cross-reference subsection */
 		for (size_t j = 0; j < subs->used; j++) {
-			HParsedToken *ss = subs->elements[i];
-			size_t base = H_INDEX_UINT(ss, 0, 0);
-			size_t n = H_INDEX_UINT(ss, 0, 1);
+			ss = subs->elements[j];
+			base = H_INDEX_UINT(ss, 0, 0);
+			n = H_INDEX_UINT(ss, 0, 1);
 
 			if (nr >= base && nr - base < n)
 				return H_INDEX(XREntry, ss, 1, nr - base);
@@ -1434,6 +1437,7 @@ parse_xrefs(const uint8_t *input, size_t sz, size_t *nxrefs)
 			    "position %zu (%#zx)\n", infile, offset, offset);
 			break;
 		}
+		assert(res->ast != NULL);
 
 		/* save this section in xrefs */
 		if (n >= SIZE_MAX / sizeof(HParsedToken *))