int pdf_page_set_size(struct pdf_doc *pdf, struct pdf_object *page, int width, int height)
{
    if (!page)
        page = pdf_find_last_object(pdf, OBJ_page);

    if (!page || page->type != OBJ_page)
        return pdf_set_err(pdf, -EINVAL, "Invalid PDF page");
    page->page.width = width;
    page->page.height = height;
    return 0;
}

The product reads data past the end, or before the beginning, of the intended buffer.