Don't try to read xref at negative stream positions

oss-fuzz/29460
7 jobs for security_fixe in 7 minutes and 25 seconds (queued for 2 seconds)
Status Job ID Name Coverage
  Build
passed #6562513
build

00:07:25

passed #6562518
build_android

00:00:39

passed #6562514
build_clang_libcpp

00:06:48

passed #6562517
build_clazy

00:03:57

passed #6562516
build_mingw64_fedora

00:03:07

passed #6562515
build_ubuntu_16_04

00:03:09

passed #6562512
clang_format

00:01:52