Make fz_buffer structure private to fitz.

Move the definition of the structure contents into new fitz-imp.h
file. Make all code outside of fitz access the buffer through the
defined API.

Add a convenience API for people that want to get buffers as
null terminated C strings.

36 files changed, 207 insertions, 105 deletions

diff --git a/source/cbz/mutiff.c b/source/cbz/mutiff.c
index 44f55c7c..44756b88 100644
--- a/source/cbz/mutiff.c
+++ b/source/cbz/mutiff.c
@@ -68,7 +68,10 @@ tiff_load_page(fz_context *ctx, tiff_document *doc, int number)
 
 	fz_try(ctx)
 	{
-		pixmap = fz_load_tiff_subimage(ctx, doc->buffer->data, doc->buffer->len, number);
+		size_t len;
+		unsigned char *data;
+		len = fz_buffer_storage(ctx, doc->buffer, &data);
+		pixmap = fz_load_tiff_subimage(ctx, data, len, number);
 		image = fz_new_image_from_pixmap(ctx, pixmap, NULL);
 
 		page = fz_new_page(ctx, sizeof *page);
@@ -125,8 +128,11 @@ tiff_open_document_with_stream(fz_context *ctx, fz_stream *file)
 
 	fz_try(ctx)
 	{
+		size_t len;
+		unsigned char *data;
 		doc->buffer = fz_read_all(ctx, file, 1024);
-		doc->page_count = fz_load_tiff_subimage_count(ctx, doc->buffer->data, doc->buffer->len);
+		len = fz_buffer_storage(ctx, doc->buffer, &data);
+		doc->page_count = fz_load_tiff_subimage_count(ctx, data, len);
 	}
 	fz_catch(ctx)
 	{
diff --git a/source/fitz/buffer.c b/source/fitz/buffer.c
index 10c0c055..13aae983 100644
--- a/source/fitz/buffer.c
+++ b/source/fitz/buffer.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 fz_buffer *
 fz_new_buffer(fz_context *ctx, size_t size)
@@ -30,12 +30,20 @@ fz_new_buffer_from_data(fz_context *ctx, unsigned char *data, size_t size)
 {
 	fz_buffer *b;
 
-	b = fz_malloc_struct(ctx, fz_buffer);
-	b->refs = 1;
-	b->data = data;
-	b->cap = size;
-	b->len = size;
-	b->unused_bits = 0;
+	fz_try(ctx)
+	{
+		b = fz_malloc_struct(ctx, fz_buffer);
+		b->refs = 1;
+		b->data = data;
+		b->cap = size;
+		b->len = size;
+		b->unused_bits = 0;
+	}
+	fz_catch(ctx)
+	{
+		fz_free(ctx, data);
+		fz_rethrow(ctx);
+	}
 
 	return b;
 }
@@ -152,6 +160,32 @@ fz_buffer_storage(fz_context *ctx, fz_buffer *buf, unsigned char **datap)
 	return (buf ? buf->len : 0);
 }
 
+const char *
+fz_string_from_buffer(fz_context *ctx, fz_buffer *buf)
+{
+	if (!buf)
+		return "";
+
+	if (buf->data[buf->len-1] != 0)
+		fz_write_buffer_byte(ctx, buf, 0);
+
+	return (const char *)buf->data;
+}
+
+size_t
+fz_buffer_extract(fz_context *ctx, fz_buffer *buf, unsigned char **datap)
+{
+	size_t len = buf ? buf->len : 0;
+	*datap = (buf ? buf->data : NULL);
+
+	if (buf)
+	{
+		buf->data = NULL;
+		buf->len = 0;
+	}
+	return len;
+}
+
 void
 fz_append_buffer(fz_context *ctx, fz_buffer *buf, fz_buffer *extra)
 {
diff --git a/source/fitz/compressed-buffer.c b/source/fitz/compressed-buffer.c
index 8c9b7e56..3846fcb2 100644
--- a/source/fitz/compressed-buffer.c
+++ b/source/fitz/compressed-buffer.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 /* This code needs to be kept out of stm_buffer.c to avoid it being
  * pulled into cmapdump.c */
diff --git a/source/fitz/filter-jbig2.c b/source/fitz/filter-jbig2.c
index 404eb524..7e7a9420 100644
--- a/source/fitz/filter-jbig2.c
+++ b/source/fitz/filter-jbig2.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #ifdef HAVE_LURATECH
 
diff --git a/source/fitz/filter-leech.c b/source/fitz/filter-leech.c
index c8f28b7c..b6d139e2 100644
--- a/source/fitz/filter-leech.c
+++ b/source/fitz/filter-leech.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #include <zlib.h>
 
diff --git a/source/fitz/fitz-imp.h b/source/fitz/fitz-imp.h
new file mode 100644
index 00000000..9441aa9c
--- /dev/null
+++ b/source/fitz/fitz-imp.h
@@ -0,0 +1,15 @@
+#ifndef MUPDF_FITZ_IMP_H
+#define MUPDF_FITZ_IMP_H
+
+#include "mupdf/fitz.h"
+
+struct fz_buffer_s
+{
+	int refs;
+	unsigned char *data;
+	size_t cap, len;
+	int unused_bits;
+	int shared;
+};
+
+#endif
diff --git a/source/fitz/font.c b/source/fitz/font.c
index 7142414e..4e30579f 100644
--- a/source/fitz/font.c
+++ b/source/fitz/font.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #include "font-imp.h"
 
diff --git a/source/fitz/image.c b/source/fitz/image.c
index f568df32..8fe49c0d 100644
--- a/source/fitz/image.c
+++ b/source/fitz/image.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #define SANE_DPI 72.0f
 #define INSANE_DPI 4800.0f
diff --git a/source/fitz/load-gif.c b/source/fitz/load-gif.c
index f41dee32..16c46637 100644
--- a/source/fitz/load-gif.c
+++ b/source/fitz/load-gif.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 struct info
 {
diff --git a/source/fitz/output.c b/source/fitz/output.c
index 3133116c..c34b8736 100644
--- a/source/fitz/output.c
+++ b/source/fitz/output.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 struct fz_output_context_s
 {
diff --git a/source/fitz/stext-output.c b/source/fitz/stext-output.c
index a6c51cb8..d671288f 100644
--- a/source/fitz/stext-output.c
+++ b/source/fitz/stext-output.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #define SUBSCRIPT_OFFSET 0.2f
 #define SUPERSCRIPT_OFFSET -0.2f
diff --git a/source/fitz/stext-search.c b/source/fitz/stext-search.c
index bba2c3f5..8d768a4f 100644
--- a/source/fitz/stext-search.c
+++ b/source/fitz/stext-search.c
@@ -280,7 +280,7 @@ fz_copy_selection(fz_context *ctx, fz_stext_page *page, fz_rect rect)
 
 	fz_write_buffer_byte(ctx, buffer, 0);
 
-	s = (char*)buffer->data;
-	fz_free(ctx, buffer);
+	fz_buffer_extract(ctx, buffer, &s);
+	fz_drop_buffer(ctx, buffer);
 	return s;
 }
diff --git a/source/fitz/stream-open.c b/source/fitz/stream-open.c
index e70fc0e9..f999014b 100644
--- a/source/fitz/stream-open.c
+++ b/source/fitz/stream-open.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 int
 fz_file_exists(fz_context *ctx, const char *path)
diff --git a/source/fitz/stream-read.c b/source/fitz/stream-read.c
index b499d68f..2d2f28b1 100644
--- a/source/fitz/stream-read.c
+++ b/source/fitz/stream-read.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #define MIN_BOMB (100 << 20)
 
diff --git a/source/fitz/svg-device.c b/source/fitz/svg-device.c
index 8a83c97b..5d05d808 100644
--- a/source/fitz/svg-device.c
+++ b/source/fitz/svg-device.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 typedef struct svg_device_s svg_device;
 
diff --git a/source/fitz/untar.c b/source/fitz/untar.c
index a364bf39..3c00425d 100644
--- a/source/fitz/untar.c
+++ b/source/fitz/untar.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 typedef struct tar_entry_s tar_entry;
 typedef struct fz_tar_archive_s fz_tar_archive;
diff --git a/source/fitz/unzip.c b/source/fitz/unzip.c
index 491322fd..d7f2ad0e 100644
--- a/source/fitz/unzip.c
+++ b/source/fitz/unzip.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #include <zlib.h>
 
diff --git a/source/fitz/zip.c b/source/fitz/zip.c
index 95f1bd03..cb51fd6d 100644
--- a/source/fitz/zip.c
+++ b/source/fitz/zip.c
@@ -1,4 +1,4 @@
-#include "mupdf/fitz.h"
+#include "fitz-imp.h"
 
 #include <zlib.h>
 
diff --git a/source/html/epub-doc.c b/source/html/epub-doc.c
index f5f3ca67..6c776bfa 100644
--- a/source/html/epub-doc.c
+++ b/source/html/epub-doc.c
@@ -334,12 +334,15 @@ epub_parse_ncx(fz_context *ctx, epub_document *doc, const char *path)
 	fz_buffer *buf;
 	fz_xml *ncx;
 	char base_uri[2048];
+	unsigned char *data;
+	size_t len;
 
 	fz_dirname(base_uri, path, sizeof base_uri);
 
 	buf = fz_read_archive_entry(ctx, zip, path);
 	fz_write_buffer_byte(ctx, buf, 0);
-	ncx = fz_parse_xml(ctx, buf->data, buf->len, 0);
+	len = fz_buffer_storage(ctx, buf, &data);
+	ncx = fz_parse_xml(ctx, data, len, 0);
 	fz_drop_buffer(ctx, buf);
 
 	doc->outline = epub_parse_ncx_imp(ctx, doc, fz_xml_find_down(ncx, "navMap"), base_uri);
@@ -369,6 +372,8 @@ epub_parse_header(fz_context *ctx, epub_document *doc)
 	const char *version;
 	char ncx[2048], s[2048];
 	epub_chapter **tailp;
+	size_t len;
+	unsigned char *data;
 
 	if (fz_has_archive_entry(ctx, zip, "META-INF/rights.xml"))
 		fz_throw(ctx, FZ_ERROR_GENERIC, "EPUB is locked by DRM");
@@ -379,7 +384,8 @@ epub_parse_header(fz_context *ctx, epub_document *doc)
 
 	buf = fz_read_archive_entry(ctx, zip, "META-INF/container.xml");
 	fz_write_buffer_byte(ctx, buf, 0);
-	container_xml = fz_parse_xml(ctx, buf->data, buf->len, 0);
+	len = fz_buffer_storage(ctx, buf, &data);
+	container_xml = fz_parse_xml(ctx, data, len, 0);
 	fz_drop_buffer(ctx, buf);
 
 	container = fz_xml_find(container_xml, "container");
@@ -395,7 +401,8 @@ epub_parse_header(fz_context *ctx, epub_document *doc)
 
 	buf = fz_read_archive_entry(ctx, zip, full_path);
 	fz_write_buffer_byte(ctx, buf, 0);
-	content_opf = fz_parse_xml(ctx, buf->data, buf->len, 0);
+	len = fz_buffer_storage(ctx, buf, &data);
+	content_opf = fz_parse_xml(ctx, data, len, 0);
 	fz_drop_buffer(ctx, buf);
 
 	package = fz_xml_find(content_opf, "package");
diff --git a/source/html/html-layout.c b/source/html/html-layout.c
index 8b7a08db..945149f4 100644
--- a/source/html/html-layout.c
+++ b/source/html/html-layout.c
@@ -2117,8 +2117,7 @@ html_load_css(fz_context *ctx, fz_archive *zip, const char *base_uri, fz_css *cs
 						fz_try(ctx)
 						{
 							buf = fz_read_archive_entry(ctx, zip, path);
-							fz_write_buffer_byte(ctx, buf, 0);
-							fz_parse_css(ctx, css, (char*)buf->data, path);
+							fz_parse_css(ctx, css, fz_string_from_buffer(ctx, buf), path);
 						}
 						fz_always(ctx)
 							fz_drop_buffer(ctx, buf);
@@ -2500,6 +2499,8 @@ fz_parse_html(fz_context *ctx, fz_html_font_set *set, fz_archive *zip, const cha
 {
 	fz_xml *xml;
 	fz_html *html;
+	unsigned char *data;
+	size_t len = fz_buffer_storage(ctx, buf, &data);
 
 	fz_css_match match;
 	struct genstate g;
@@ -2512,7 +2513,7 @@ fz_parse_html(fz_context *ctx, fz_html_font_set *set, fz_archive *zip, const cha
 	g.emit_white = 0;
 	g.last_brk_cls = UCDN_LINEBREAK_CLASS_OP;
 
-	xml = fz_parse_xml(ctx, buf->data, buf->len, 1);
+	xml = fz_parse_xml(ctx, data, len, 1);
 
 	g.css = fz_new_css(ctx);
 	fz_try(ctx)
diff --git a/source/pdf/pdf-appearance.c b/source/pdf/pdf-appearance.c
index f94103a9..5627aaa4 100644
--- a/source/pdf/pdf-appearance.c
+++ b/source/pdf/pdf-appearance.c
@@ -397,7 +397,7 @@ typedef struct text_splitter_s
 	float unscaled_width;
 	float fontsize;
 	float lineheight;
-	char *text;
+	const char *text;
 	int done;
 	float x_orig;
 	float y_orig;
@@ -409,7 +409,7 @@ typedef struct text_splitter_s
 	int retry;
 } text_splitter;
 
-static void text_splitter_init(text_splitter *splitter, font_info *info, char *text, float width, float height, int variable)
+static void text_splitter_init(text_splitter *splitter, font_info *info, const char *text, float width, float height, int variable)
 {
 	float fontsize = info->da_rec.font_size;
 
@@ -442,7 +442,7 @@ static void text_splitter_start_line(text_splitter *splitter)
 
 static int text_splitter_layout(fz_context *ctx, text_splitter *splitter)
 {
-	char *text;
+	const char *text;
 	float room;
 	float stride;
 	size_t count;
@@ -1899,7 +1899,7 @@ void pdf_update_ink_appearance(fz_context *ctx, pdf_document *doc, pdf_annot *an
 	}
 }
 
-static void add_text(fz_context *ctx, font_info *font_rec, fz_text *text, char *str, size_t str_len, const fz_matrix *tm_)
+static void add_text(fz_context *ctx, font_info *font_rec, fz_text *text, const char *str, size_t str_len, const fz_matrix *tm_)
 {
 	fz_font *font = font_rec->font->font;
 	fz_matrix tm = *tm_;
@@ -1940,7 +1940,7 @@ static fz_text *layout_text(fz_context *ctx, font_info *font_rec, char *str, flo
 	return text;
 }
 
-static fz_text *fit_text(fz_context *ctx, font_info *font_rec, char *str, fz_rect *bounds)
+static fz_text *fit_text(fz_context *ctx, font_info *font_rec, const char *str, fz_rect *bounds)
 {
 	float width = bounds->x1 - bounds->x0;
 	float height = bounds->y1 - bounds->y0;
@@ -1989,7 +1989,7 @@ static fz_text *fit_text(fz_context *ctx, font_info *font_rec, char *str, fz_rec
 					if (splitter.text[splitter.text_start] != ' ')
 					{
 						float dx, dy;
-						char *word = str+splitter.text_start;
+						const char *word = str+splitter.text_start;
 						size_t wordlen = splitter.text_end-splitter.text_start;
 
 						text_splitter_move(&splitter, -line, &dx, &dy);
@@ -2374,7 +2374,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
 		fz_rect annot_rect;
 		fz_rect logo_bounds;
 		fz_matrix logo_tm;
-		unsigned char *bufstr;
 		fz_rect rect;
 
 		pdf_to_rect(ctx, pdf_dict_get(ctx, annot->obj, PDF_NAME_Rect), &annot_rect);
@@ -2415,10 +2414,9 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
 		fz_buffer_printf(ctx, fzbuf, "\nDN: %s", dn);
 		if (date)
 			fz_buffer_printf(ctx, fzbuf, "\nDate: %s", date);
-		(void)fz_buffer_storage(ctx, fzbuf, &bufstr);
 		rect = annot_rect;
 		rect.x0 = (rect.x0 + rect.x1)/2.0f;
-		text = fit_text(ctx, &font_rec, (char *)bufstr, &rect);
+		text = fit_text(ctx, &font_rec, fz_string_from_buffer(ctx, fzbuf), &rect);
 		fz_fill_text(ctx, dev, text, &page_ctm, cs, font_rec.da_rec.col, 1.0f);
 
 		fz_close_device(ctx, dev);
diff --git a/source/pdf/pdf-font.c b/source/pdf/pdf-font.c
index 5b5c7735..a974c8d5 100644
--- a/source/pdf/pdf-font.c
+++ b/source/pdf/pdf-font.c
@@ -124,9 +124,11 @@ static const char *clean_font_name(const char *fontname)
 static int is_builtin_font(fz_context *ctx, fz_font *font)
 {
 	int size;
+	unsigned char *data;
 	if (!font->buffer)
 		return 0;
-	return fz_lookup_base14_font(ctx, clean_font_name(font->name), &size) == (char*)font->buffer->data;
+	fz_buffer_storage(ctx, font->buffer, &data);
+	return fz_lookup_base14_font(ctx, clean_font_name(font->name), &size) == (char*)data;
 }
 
 /*
@@ -448,7 +450,7 @@ pdf_load_embedded_font(fz_context *ctx, pdf_document *doc, pdf_font_desc *fontde
 	fz_catch(ctx)
 		fz_rethrow(ctx);
 
-	fontdesc->size += buf->len;
+	fontdesc->size += fz_buffer_storage(ctx, buf, NULL);
 	fontdesc->is_embedded = 1;
 }
 
@@ -1032,15 +1034,17 @@ load_cid_font(fz_context *ctx, pdf_document *doc, pdf_obj *dict, pdf_obj *encodi
 		if (pdf_is_indirect(ctx, cidtogidmap))
 		{
 			fz_buffer *buf;
-			size_t z;
+			size_t z, len;
+			unsigned char *data;
 
 			buf = pdf_load_stream(ctx, cidtogidmap);
 
-			fontdesc->cid_to_gid_len = (buf->len) / 2;
+			len = fz_buffer_storage(ctx, buf, &data);
+			fontdesc->cid_to_gid_len = len / 2;
 			fontdesc->cid_to_gid = fz_malloc_array(ctx, fontdesc->cid_to_gid_len, sizeof(unsigned short));
 			fontdesc->size += fontdesc->cid_to_gid_len * sizeof(unsigned short);
 			for (z = 0; z < fontdesc->cid_to_gid_len; z++)
-				fontdesc->cid_to_gid[z] = (buf->data[z * 2] << 8) + buf->data[z * 2 + 1];
+				fontdesc->cid_to_gid[z] = (data[z * 2] << 8) + data[z * 2 + 1];
 
 			fz_drop_buffer(ctx, buf);
 		}
@@ -1466,13 +1470,14 @@ pdf_add_font_file(fz_context *ctx, pdf_document *doc, fz_font *font)
 
 	fz_try(ctx)
 	{
+		size_t len = fz_buffer_storage(ctx, buf, NULL);
 		obj = pdf_new_dict(ctx, doc, 3);
-		pdf_dict_put_drop(ctx, obj, PDF_NAME_Length1, pdf_new_int(ctx, doc, (int)buf->len));
+		pdf_dict_put_drop(ctx, obj, PDF_NAME_Length1, pdf_new_int(ctx, doc, (int)len));
 		switch (ft_font_file_kind(font->ft_face))
 		{
 		case 1:
 			/* TODO: these may not be the correct values, but I doubt it matters */
-			pdf_dict_put_drop(ctx, obj, PDF_NAME_Length2, pdf_new_int(ctx, doc, (int)buf->len));
+			pdf_dict_put_drop(ctx, obj, PDF_NAME_Length2, pdf_new_int(ctx, doc, (int)len));
 			pdf_dict_put_drop(ctx, obj, PDF_NAME_Length3, pdf_new_int(ctx, doc, 0));
 			break;
 		case 2:
diff --git a/source/pdf/pdf-image.c b/source/pdf/pdf-image.c
index 37e2ca50..b669948b 100644
--- a/source/pdf/pdf-image.c
+++ b/source/pdf/pdf-image.c
@@ -226,6 +226,9 @@ pdf_load_jpx(fz_context *ctx, pdf_document *doc, pdf_obj *dict, int forcemask)
 	/* FIXME: We can't handle decode arrays for indexed images currently */
 	fz_try(ctx)
 	{
+		unsigned char *data;
+		size_t len;
+
 		obj = pdf_dict_get(ctx, dict, PDF_NAME_ColorSpace);
 		if (obj)
 		{
@@ -233,7 +236,8 @@ pdf_load_jpx(fz_context *ctx, pdf_document *doc, pdf_obj *dict, int forcemask)
 			indexed = fz_colorspace_is_indexed(ctx, colorspace);
 		}
 
-		pix = fz_load_jpx(ctx, buf->data, buf->len, colorspace, indexed);
+		len = fz_buffer_storage(ctx, buf, &data);
+		pix = fz_load_jpx(ctx, data, len, colorspace, indexed);
 
 		obj = pdf_dict_geta(ctx, dict, PDF_NAME_SMask, PDF_NAME_Mask);
 		if (pdf_is_dict(ctx, obj))
@@ -392,9 +396,8 @@ raw_or_unknown_compression:
 			s = pixmap->samples;
 			h = image->h;
 			size = image->w * n;
-			buffer = fz_new_buffer(ctx, size * h);
-			buffer->len = size * h;
-			d = buffer->data;
+			d = fz_malloc(ctx, size * h);
+			buffer = fz_new_buffer_from_data(ctx, d, size * h);
 			if (pixmap->alpha == 0 || n == 1)
 			{
 				while (h--)
diff --git a/source/pdf/pdf-op-buffer.c b/source/pdf/pdf-op-buffer.c
index 2eb4323a..1bfe982a 100644
--- a/source/pdf/pdf-op-buffer.c
+++ b/source/pdf/pdf-op-buffer.c
@@ -548,6 +548,8 @@ pdf_out_BI(fz_context *ctx, pdf_processor *proc, fz_image *img)
 	fz_compressed_buffer *cbuf;
 	fz_buffer *buf;
 	int i;
+	unsigned char *data;
+	size_t len;
 
 	if (img == NULL)
 		return;
@@ -662,12 +664,13 @@ pdf_out_BI(fz_context *ctx, pdf_processor *proc, fz_image *img)
 	}
 
 	fz_printf(ctx, out, "ID\n");
+	len = fz_buffer_storage(ctx, buf, &data);
 	if (ahx)
 	{
 		size_t z;
-		for (z = 0; z < buf->len; ++z)
+		for (z = 0; z < len; ++z)
 		{
-			int c = buf->data[z];
+			int c = data[z];
 			fz_putc(ctx, out, "0123456789abcdef"[(c >> 4) & 0xf]);
 			fz_putc(ctx, out, "0123456789abcdef"[c & 0xf]);
 			if ((z & 31) == 31)
@@ -677,7 +680,7 @@ pdf_out_BI(fz_context *ctx, pdf_processor *proc, fz_image *img)
 	}
 	else
 	{
-		fz_write(ctx, out, buf->data, buf->len);
+		fz_write(ctx, out, data, len);
 	}
 	fz_printf(ctx, out, "\nEI\n");
 }
diff --git a/source/pdf/pdf-pkcs7.c b/source/pdf/pdf-pkcs7.c
index 934202e1..9fa15970 100644
--- a/source/pdf/pdf-pkcs7.c
+++ b/source/pdf/pdf-pkcs7.c
@@ -749,7 +749,7 @@ void pdf_sign_signature(fz_context *ctx, pdf_document *doc, pdf_widget *widget,
 			if (dn->c)
 				fz_buffer_printf(ctx, fzbuf, ", c=%s", dn->c);
 
-			(void)fz_buffer_storage(ctx, fzbuf, (unsigned char **) &dn_str);
+			dn_str = fz_string_from_buffer(ctx, fzbuf);
 			pdf_set_signature_appearance(ctx, doc, (pdf_annot *)widget, dn->cn, dn_str, NULL);
 		}
 	}
diff --git a/source/pdf/pdf-stream.c b/source/pdf/pdf-stream.c
index b6645eca..289f27da 100644
--- a/source/pdf/pdf-stream.c
+++ b/source/pdf/pdf-stream.c
@@ -70,7 +70,7 @@ pdf_load_jbig2_globals(fz_context *ctx, pdf_document *doc, pdf_obj *dict)
 	{
 		buf = pdf_load_stream(ctx, dict);
 		globals = fz_load_jbig2_globals(ctx, buf);
-		pdf_store_item(ctx, dict, globals, buf->len);
+		pdf_store_item(ctx, dict, globals, fz_buffer_storage(ctx, buf, NULL));
 	}
 	fz_always(ctx)
 	{
diff --git a/source/pdf/pdf-type3.c b/source/pdf/pdf-type3.c
index ede5a5ee..677a26e5 100644
--- a/source/pdf/pdf-type3.c
+++ b/source/pdf/pdf-type3.c
@@ -165,7 +165,8 @@ pdf_load_type3_font(fz_context *ctx, pdf_document *doc, pdf_obj *rdb, pdf_obj *d
 				if (pdf_is_stream(ctx, obj))
 				{
 					font->t3procs[i] = pdf_load_stream(ctx, obj);
-					fontdesc->size += font->t3procs[i]->cap;
+					fz_trim_buffer(ctx, font->t3procs[i]);
+					fontdesc->size += fz_buffer_storage(ctx, font->t3procs[i], NULL);
 					fontdesc->size += 0; // TODO: display list size calculation
 				}
 			}
diff --git a/source/pdf/pdf-write.c b/source/pdf/pdf-write.c
index eb1a2f29..3401f59d 100644
--- a/source/pdf/pdf-write.c
+++ b/source/pdf/pdf-write.c
@@ -1517,11 +1517,13 @@ static inline int isbinary(int c)
 	return c < 32 || c > 127;
 }
 
-static int isbinarystream(fz_buffer *buf)
+static int isbinarystream(fz_context *ctx, fz_buffer *buf)
 {
+	unsigned char *data;
+	size_t len = fz_buffer_storage(ctx, buf, &data);
 	size_t i;
-	for (i = 0; i < buf->len; i++)
-		if (isbinary(buf->data[i]))
+	for (i = 0; i < len; i++)
+		if (isbinary(data[i]))
 			return 1;
 	return 0;
 }
@@ -1529,25 +1531,25 @@ static int isbinarystream(fz_buffer *buf)
 static fz_buffer *hexbuf(fz_context *ctx, unsigned char *p, size_t n)
 {
 	static const char hex[17] = "0123456789abcdef";
-	fz_buffer *buf;
 	int x = 0;
-
-	buf = fz_new_buffer(ctx, n * 2 + (n / 32) + 2);
+	size_t len = n * 2 + (n / 32) + 2;
+	unsigned char *data = fz_malloc(ctx, len);
+	fz_buffer *buf = fz_new_buffer_from_data(ctx, data, len);
 
 	while (n--)
 	{
-		buf->data[buf->len++] = hex[*p >> 4];
-		buf->data[buf->len++] = hex[*p & 15];
+		*data++ = hex[*p >> 4];
+		*data++ = hex[*p & 15];
 		if (++x == 32)
 		{
-			buf->data[buf->len++] = '\n';
+			*data++ = '\n';
 			x = 0;
 		}
 		p++;
 	}
 
-	buf->data[buf->len++] = '>';
-	buf->data[buf->len++] = '\n';
+	*data++ = '>';
+	*data++ = '\n';
 
 	return buf;
 }
@@ -1609,19 +1611,23 @@ static fz_buffer *deflatebuf(fz_context *ctx, unsigned char *p, size_t n)
 	uLongf csize;
 	int t;
 	uLong longN = (uLong)n;
+	unsigned char *data;
+	size_t cap;
 
 	if (n != (size_t)longN)
 		fz_throw(ctx, FZ_ERROR_GENERIC, "Buffer to large to deflate");
 
-	buf = fz_new_buffer(ctx, compressBound(longN));
-	csize = (uLongf)buf->cap;
-	t = compress(buf->data, &csize, p, longN);
+	cap = compressBound(longN);
+	data = fz_malloc(ctx, cap);
+	buf = fz_new_buffer_from_data(ctx, data, cap);
+	csize = (uLongf)cap;
+	t = compress(data, &csize, p, longN);
 	if (t != Z_OK)
 	{
 		fz_drop_buffer(ctx, buf);
 		fz_throw(ctx, FZ_ERROR_GENERIC, "cannot deflate buffer");
 	}
-	buf->len = csize;
+	fz_resize_buffer(ctx, buf, csize);
 	return buf;
 }
 
@@ -1630,45 +1636,53 @@ static void copystream(fz_context *ctx, pdf_document *doc, pdf_write_state *opts
 	fz_buffer *buf, *tmp;
 	pdf_obj *newlen;
 	pdf_obj *obj;
+	size_t len;
+	unsigned char *data;
 
 	buf = pdf_load_raw_stream_number(ctx, doc, num);
 
 	obj = pdf_copy_dict(ctx, obj_orig);
 
+	len = fz_buffer_storage(ctx, buf, &data);
 	if (do_deflate && !pdf_dict_get(ctx, obj, PDF_NAME_Filter))
 	{
-		tmp = deflatebuf(ctx, buf->data, buf->len);
-		if (tmp->len >= buf->len)
+		size_t clen;
+		unsigned char *cdata;
+		tmp = deflatebuf(ctx, data, len);
+		clen = fz_buffer_storage(ctx, tmp, &cdata);
+		if (clen >= len)
 		{
 			/* Don't bother compressing, as we gain nothing. */
 			fz_drop_buffer(ctx, tmp);
 		}
 		else
 		{
+			len = clen;
+			data = cdata;
 			pdf_dict_put(ctx, obj, PDF_NAME_Filter, PDF_NAME_FlateDecode);
 			fz_drop_buffer(ctx, buf);
 			buf = tmp;
 		}
 	}
 
-	if (opts->do_ascii && isbinarystream(buf))
+	if (opts->do_ascii && isbinarystream(ctx, buf))
 	{
-		tmp = hexbuf(ctx, buf->data, buf->len);
+		tmp = hexbuf(ctx, data, len);
 		fz_drop_buffer(ctx, buf);
 		buf = tmp;
 
 		addhexfilter(ctx, doc, obj);
 	}
 
-	newlen = pdf_new_int(ctx, doc, (int)buf->len);
+	newlen = pdf_new_int(ctx, doc, (int)len);
 	pdf_dict_put(ctx, obj, PDF_NAME_Length, newlen);
 	pdf_drop_obj(ctx, newlen);
 
 	fz_printf(ctx, opts->out, "%d %d obj\n", num, gen);
 	pdf_print_obj(ctx, opts->out, obj, opts->do_tight);
 	fz_puts(ctx, opts->out, "\nstream\n");
-	fz_write(ctx, opts->out, buf->data, buf->len);
-	if (buf->len > 0 && buf->data[buf->len-1] != '\n')
+	fz_write(ctx, opts->out, data, len);
+	if (len > 0 && data[len-1] != '\n')
 		fz_putc(ctx, opts->out, '\n');
 	fz_puts(ctx, opts->out, "endstream\nendobj\n\n");
 
@@ -1682,6 +1696,8 @@ static void expandstream(fz_context *ctx, pdf_document *doc, pdf_write_state *op
 	pdf_obj *newlen;
 	pdf_obj *obj;
 	int truncated = 0;
+	size_t len;
+	unsigned char *data;
 
 	buf = pdf_load_stream_truncated(ctx, doc, num, (opts->continue_on_error ? &truncated : NULL));
 	if (truncated && opts->errors)
@@ -1691,40 +1707,46 @@ static void expandstream(fz_context *ctx, pdf_document *doc, pdf_write_state *op
 	pdf_dict_del(ctx, obj, PDF_NAME_Filter);
 	pdf_dict_del(ctx, obj, PDF_NAME_DecodeParms);
 
+	len = fz_buffer_storage(ctx, buf, &data);
 	if (do_deflate)
 	{
-		tmp = deflatebuf(ctx, buf->data, buf->len);
-		if (tmp->len >= buf->len)
+		unsigned char *cdata;
+		size_t clen;
+		tmp = deflatebuf(ctx, data, len);
+		clen = fz_buffer_storage(ctx, tmp, &cdata);
+		if (clen >= len)
 		{
 			/* Don't bother compressing, as we gain nothing. */
 			fz_drop_buffer(ctx, tmp);
 		}
 		else
 		{
+			len = clen;
+			data = cdata;
 			pdf_dict_put(ctx, obj, PDF_NAME_Filter, PDF_NAME_FlateDecode);
 			fz_drop_buffer(ctx, buf);
 			buf = tmp;
 		}
 	}
 
-	if (opts->do_ascii && isbinarystream(buf))
+	if (opts->do_ascii && isbinarystream(ctx, buf))
 	{
-		tmp = hexbuf(ctx, buf->data, buf->len);
+		tmp = hexbuf(ctx, data, len);
 		fz_drop_buffer(ctx, buf);
 		buf = tmp;
 
 		addhexfilter(ctx, doc, obj);
 	}
 
-	newlen = pdf_new_int(ctx, doc, (int)buf->len);
+	newlen = pdf_new_int(ctx, doc, (int)len);
 	pdf_dict_put(ctx, obj, PDF_NAME_Length, newlen);
 	pdf_drop_obj(ctx, newlen);
 
 	fz_printf(ctx, opts->out, "%d %d obj\n", num, gen);
 	pdf_print_obj(ctx, opts->out, obj, opts->do_tight);
 	fz_puts(ctx, opts->out, "\nstream\n");
-	fz_write(ctx, opts->out, buf->data, buf->len);
-	if (buf->len > 0 && buf->data[buf->len-1] != '\n')
+	fz_write(ctx, opts->out, data, len);
+	if (len > 0 && data[len-1] != '\n')
 		fz_putc(ctx, opts->out, '\n');
 	fz_puts(ctx, opts->out, "endstream\nendobj\n\n");
 
@@ -2439,7 +2461,7 @@ make_page_offset_hints(fz_context *ctx, pdf_document *doc, pdf_write_state *opts
 
 	/* Pad, and then do shared object hint table */
 	fz_write_buffer_pad(ctx, buf);
-	opts->hints_shared_offset = (int)buf->len;
+	opts->hints_shared_offset = (int)fz_buffer_storage(ctx, buf, NULL);
 
 	/* Table F.5: */
 	/* Header Item 1: Object number of the first object in the shared
@@ -2516,7 +2538,7 @@ make_hint_stream(fz_context *ctx, pdf_document *doc, pdf_write_state *opts)
 	{
 		make_page_offset_hints(ctx, doc, opts, buf);
 		pdf_update_stream(ctx, doc, pdf_load_object(ctx, doc, pdf_xref_len(ctx, doc)-1), buf, 0);
-		opts->hintstream_len = (int)buf->len;
+		opts->hintstream_len = (int)fz_buffer_storage(ctx, buf, NULL);
 		fz_drop_buffer(ctx, buf);
 	}
 	fz_catch(ctx)
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index 6280c2ff..df3c3254 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -2119,7 +2119,7 @@ pdf_update_stream(fz_context *ctx, pdf_document *doc, pdf_obj *obj, fz_buffer *n
 	fz_drop_buffer(ctx, x->stm_buf);
 	x->stm_buf = fz_keep_buffer(ctx, newbuf);
 
-	pdf_dict_puts_drop(ctx, obj, "Length", pdf_new_int(ctx, doc, (int)newbuf->len));
+	pdf_dict_puts_drop(ctx, obj, "Length", pdf_new_int(ctx, doc, (int)fz_buffer_storage(ctx, newbuf, NULL)));
 	if (!compressed)
 	{
 		pdf_dict_dels(ctx, obj, "Filter");
diff --git a/source/svg/svg-doc.c b/source/svg/svg-doc.c
index 5f7f809b..d0ff1e4a 100644
--- a/source/svg/svg-doc.c
+++ b/source/svg/svg-doc.c
@@ -88,8 +88,11 @@ svg_open_document_with_buffer(fz_context *ctx, fz_buffer *buf)
 {
 	svg_document *doc;
 	fz_xml *root;
+	size_t len;
+	unsigned char *data;
 
-	root = fz_parse_xml(ctx, buf->data, buf->len, 0);
+	len = fz_buffer_storage(ctx, buf, &data);
+	root = fz_parse_xml(ctx, data, len, 0);
 
 	doc = fz_new_document(ctx, svg_document);
 	doc->super.drop_document = svg_drop_document;
diff --git a/source/tools/muconvert.c b/source/tools/muconvert.c
index a62a0dd3..575574be 100644
--- a/source/tools/muconvert.c
+++ b/source/tools/muconvert.c
@@ -131,8 +131,7 @@ int muconvert_main(int argc, char **argv)
 	if (layout_css)
 	{
 		fz_buffer *buf = fz_read_file(ctx, layout_css);
-		fz_write_buffer_byte(ctx, buf, 0);
-		fz_set_user_css(ctx, (char*)buf->data);
+		fz_set_user_css(ctx, fz_string_from_buffer(ctx, buf));
 		fz_drop_buffer(ctx, buf);
 	}
 
diff --git a/source/tools/mudraw.c b/source/tools/mudraw.c
index 470ff66d..0b091fee 100644
--- a/source/tools/mudraw.c
+++ b/source/tools/mudraw.c
@@ -1555,8 +1555,7 @@ int mudraw_main(int argc, char **argv)
 	if (layout_css)
 	{
 		fz_buffer *buf = fz_read_file(ctx, layout_css);
-		fz_write_buffer_byte(ctx, buf, 0);
-		fz_set_user_css(ctx, (char*)buf->data);
+		fz_set_user_css(ctx, fz_string_from_buffer(ctx, buf));
 		fz_drop_buffer(ctx, buf);
 	}
 
diff --git a/source/tools/muraster.c b/source/tools/muraster.c
index ddb546b1..a22ee0a8 100644
--- a/source/tools/muraster.c
+++ b/source/tools/muraster.c
@@ -1700,8 +1700,7 @@ int main(int argc, char **argv)
 	if (layoutput_css)
 	{
 		fz_buffer *buf = fz_read_file(ctx, layoutput_css);
-		fz_write_buffer_byte(ctx, buf, 0);
-		fz_set_user_css(ctx, (char*)buf->data);
+		fz_set_user_css(ctx, fz_string_from_buffer(ctx, buf));
 		fz_drop_buffer(ctx, buf);
 	}
 
diff --git a/source/tools/murun.c b/source/tools/murun.c
index b1f95d57..7d26c49c 100644
--- a/source/tools/murun.c
+++ b/source/tools/murun.c
@@ -688,14 +688,16 @@ static int ffi_buffer_has(js_State *J, void *buf_, const char *key)
 {
 	fz_buffer *buf = buf_;
 	int idx;
+	unsigned char *data;
+	size_t len = fz_buffer_storage(js_getcontext(J), buf, &data);
 	if (is_number(key, &idx)) {
-		if (idx < 0 || (size_t)idx >= buf->len)
+		if (idx < 0 || (size_t)idx >= len)
 			js_rangeerror(J, "index out of bounds");
-		js_pushnumber(J, buf->data[idx]);
+		js_pushnumber(J, data[idx]);
 		return 1;
 	}
 	if (!strcmp(key, "length")) {
-		js_pushnumber(J, buf->len);
+		js_pushnumber(J, len);
 		return 1;
 	}
 	return 0;
@@ -705,10 +707,12 @@ static int ffi_buffer_put(js_State *J, void *buf_, const char *key)
 {
 	fz_buffer *buf = buf_;
 	int idx;
+	unsigned char *data;
+	size_t len = fz_buffer_storage(js_getcontext(J), buf, &data);
 	if (is_number(key, &idx)) {
-		if (idx < 0 || (size_t)idx >= buf->len)
+		if (idx < 0 || (size_t)idx >= len)
 			js_rangeerror(J, "index out of bounds");
-		buf->data[idx] = js_tonumber(J, -1);
+		data[idx] = js_tonumber(J, -1);
 		return 1;
 	}
 	if (!strcmp(key, "length"))
diff --git a/source/tools/pdfextract.c b/source/tools/pdfextract.c
index dadcda15..d65befdd 100644
--- a/source/tools/pdfextract.c
+++ b/source/tools/pdfextract.c
@@ -112,9 +112,13 @@ static void saveimage(int num)
 		switch (type)
 		{
 		case FZ_IMAGE_JPEG:
+		{
+			unsigned char *data;
+			size_t len = fz_buffer_storage(ctx, cbuf->buffer, &data);
 			snprintf(buf, sizeof(buf), "img-%04d", num);
-			writejpeg(ctx, cbuf->buffer->data, cbuf->buffer->len, buf);
+			writejpeg(ctx, data, len, buf);
 			break;
+		}
 		default:
 			pix = fz_get_pixmap_from_image(ctx, image, NULL, NULL, 0, 0);
 			writepixmap(ctx, pix, buf, dorgb);
diff --git a/source/xps/xps-zip.c b/source/xps/xps-zip.c
index ba9947c7..53ea15f9 100644
--- a/source/xps/xps-zip.c
+++ b/source/xps/xps-zip.c
@@ -95,10 +95,9 @@ xps_read_part(fz_context *ctx, xps_document *doc, char *partname)
 	fz_write_buffer_byte(ctx, buf, 0); /* zero-terminate */
 
 	/* take over the data */
-	data = buf->data;
 	/* size doesn't include the added zero-terminator */
-	size = buf->len - 1;
-	fz_free(ctx, buf);
+	size = fz_buffer_extract(ctx, buf, &data) - 1;
+	fz_drop_buffer(ctx, buf);
 
 	return xps_new_part(ctx, doc, partname, data, size);
 }