xmlsecurity PDF verify: avoid seeking before the start of the stream

Happened when the doc was smaller than 1024 bytes.

Change-Id: Ie5eea5905a09722e7958495d26e6c78ee234d3ba
Reviewed-on: https://gerrit.libreoffice.org/31500Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx

@@ -394,6 +394,8 @@ void PDFSigningTest::testTokenize()
         OUStringLiteral("name-bracket.pdf"),
         // %%EOF at the end wasn't followed by a newline.
         OUStringLiteral("noeol.pdf"),
+        // File that's intentionally smaller than 1024 bytes.
+        OUStringLiteral("small.pdf"),
     };
 
     for (const auto& rName : aNames)

xmlsecurity/source/pdfio/pdfdocument.cxx

@@ -1392,7 +1392,11 @@ size_t PDFDocument::FindStartXRef(SvStream& rStream)
     // Find the "startxref" token, somewhere near the end of the document.
     std::vector<char> aBuf(1024);
     rStream.Seek(STREAM_SEEK_TO_END);
-    rStream.SeekRel(static_cast<sal_Int64>(-1) * aBuf.size());
+    if (rStream.Tell() > aBuf.size())
+        rStream.SeekRel(static_cast<sal_Int64>(-1) * aBuf.size());
+    else
+        // The document is really short, then just read it from the start.
+        rStream.Seek(0);
     size_t nBeforePeek = rStream.Tell();
     size_t nSize = rStream.ReadBytes(aBuf.data(), aBuf.size());
     rStream.Seek(nBeforePeek);