  void OnCallback(mojom::PdfCompositor::Status status,
                  mojo::ScopedSharedBufferHandle handle) {
    if (status == mojom::PdfCompositor::Status::SUCCESS)
      CallbackOnSuccess(handle.get());
    else
      CallbackOnError(status);
    run_loop_->Quit();
  }

The product writes data past the end, or before the beginning, of the intended buffer.