Cleanup fpdf_parser_decode

This CL fixes some nits in fpdf_parser_decode, especially avoiding non-const
reference parameters.

Change-Id: Ibb914850afd924bb398f886ac862f7589519ef7e
Reviewed-on: https://pdfium-review.googlesource.com/6750
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

13 files changed, 178 insertions, 184 deletions

diff --git a/core/fpdfapi/page/cpdf_streamparser.cpp b/core/fpdfapi/page/cpdf_streamparser.cpp
index c3dc54a734..37ab857816 100644
--- a/core/fpdfapi/page/cpdf_streamparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamparser.cpp
@@ -36,8 +36,8 @@ const uint32_t kMaxWordBuffer = 256;
 const FX_STRSIZE kMaxStringLength = 32767;
 
 uint32_t DecodeAllScanlines(std::unique_ptr<CCodec_ScanlineDecoder> pDecoder,
-                            uint8_t*& dest_buf,
-                            uint32_t& dest_size) {
+                            uint8_t** dest_buf,
+                            uint32_t* dest_size) {
   if (!pDecoder)
     return FX_INVALID_OFFSET;
   int ncomps = pDecoder->CountComps();
@@ -48,14 +48,14 @@ uint32_t DecodeAllScanlines(std::unique_ptr<CCodec_ScanlineDecoder> pDecoder,
   if (height == 0 || pitch > (1 << 30) / height)
     return FX_INVALID_OFFSET;
 
-  dest_buf = FX_Alloc2D(uint8_t, pitch, height);
-  dest_size = pitch * height;  // Safe since checked alloc returned.
-  for (int row = 0; row < height; row++) {
+  *dest_buf = FX_Alloc2D(uint8_t, pitch, height);
+  *dest_size = pitch * height;  // Safe since checked alloc returned.
+  for (int row = 0; row < height; ++row) {
     const uint8_t* pLine = pDecoder->GetScanline(row);
     if (!pLine)
       break;
 
-    memcpy(dest_buf + row * pitch, pLine, pitch);
+    memcpy(*dest_buf + row * pitch, pLine, pitch);
   }
   return pDecoder->GetSrcOffset();
 }
@@ -66,8 +66,8 @@ uint32_t PDF_DecodeInlineStream(const uint8_t* src_buf,
                                 int height,
                                 const CFX_ByteString& decoder,
                                 CPDF_Dictionary* pParam,
-                                uint8_t*& dest_buf,
-                                uint32_t& dest_size) {
+                                uint8_t** dest_buf,
+                                uint32_t* dest_size) {
   if (decoder == "CCITTFaxDecode" || decoder == "CCF") {
     std::unique_ptr<CCodec_ScanlineDecoder> pDecoder =
         FPDFAPI_CreateFaxDecoder(src_buf, limit, width, height, pParam);
@@ -78,7 +78,7 @@ uint32_t PDF_DecodeInlineStream(const uint8_t* src_buf,
   if (decoder == "ASCIIHexDecode" || decoder == "AHx")
     return HexDecode(src_buf, limit, dest_buf, dest_size);
   if (decoder == "FlateDecode" || decoder == "Fl") {
-    return FPDFAPI_FlateOrLZWDecode(false, src_buf, limit, pParam, dest_size,
+    return FPDFAPI_FlateOrLZWDecode(false, src_buf, limit, pParam, *dest_size,
                                     dest_buf, dest_size);
   }
   if (decoder == "LZWDecode" || decoder == "LZW") {
@@ -94,8 +94,8 @@ uint32_t PDF_DecodeInlineStream(const uint8_t* src_buf,
   }
   if (decoder == "RunLengthDecode" || decoder == "RL")
     return RunLengthDecode(src_buf, limit, dest_buf, dest_size);
-  dest_size = 0;
-  dest_buf = 0;
+  *dest_size = 0;
+  *dest_buf = 0;
   return 0xFFFFFFFF;
 }
 
@@ -194,7 +194,7 @@ std::unique_ptr<CPDF_Stream> CPDF_StreamParser::ReadInlineStream(
     uint32_t dwDestSize = OrigSize;
     dwStreamSize =
         PDF_DecodeInlineStream(m_pBuf + m_Pos, m_Size - m_Pos, width, height,
-                               Decoder, pParam, pIgnore, dwDestSize);
+                               Decoder, pParam, &pIgnore, &dwDestSize);
     FX_Free(pIgnore);
     if (static_cast<int>(dwStreamSize) < 0)
       return nullptr;
diff --git a/core/fpdfapi/parser/cpdf_stream_acc.cpp b/core/fpdfapi/parser/cpdf_stream_acc.cpp
index fe333e4d2b..ccc3fdae53 100644
--- a/core/fpdfapi/parser/cpdf_stream_acc.cpp
+++ b/core/fpdfapi/parser/cpdf_stream_acc.cpp
@@ -42,9 +42,9 @@ void CPDF_StreamAcc::LoadAllData(bool bRawAccess,
   if (!m_pStream->HasFilter() || bRawAccess) {
     m_pData = pSrcData;
     m_dwSize = dwSrcSize;
-  } else if (!PDF_DataDecode(pSrcData, dwSrcSize, m_pStream->GetDict(), m_pData,
-                             m_dwSize, &m_ImageDecoder, m_pImageParam,
-                             estimated_size, bImageAcc)) {
+  } else if (!PDF_DataDecode(pSrcData, dwSrcSize, m_pStream->GetDict(),
+                             estimated_size, bImageAcc, &m_pData, &m_dwSize,
+                             &m_ImageDecoder, &m_pImageParam)) {
     m_pData = pSrcData;
     m_dwSize = dwSrcSize;
   }
diff --git a/core/fpdfapi/parser/fpdf_parser_decode.cpp b/core/fpdfapi/parser/fpdf_parser_decode.cpp
index a2ba203488..ddd6b1462d 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode.cpp
+++ b/core/fpdfapi/parser/fpdf_parser_decode.cpp
@@ -19,6 +19,7 @@
 #include "core/fpdfapi/parser/fpdf_parser_utility.h"
 #include "core/fxcodec/fx_codec.h"
 #include "core/fxcrt/fx_extension.h"
+#include "third_party/base/numerics/safe_math.h"
 #include "third_party/base/stl_util.h"
 
 namespace {
@@ -29,15 +30,13 @@ bool CheckFlateDecodeParams(int Colors, int BitsPerComponent, int Columns) {
   if (Colors < 0 || BitsPerComponent < 0 || Columns < 0)
     return false;
 
-  int check = Columns;
-  if (check > 0 && Colors > INT_MAX / check)
-    return false;
-
+  pdfium::base::CheckedNumeric<int> check = Columns;
   check *= Colors;
-  if (check > 0 && BitsPerComponent > INT_MAX / check)
+  check *= BitsPerComponent;
+  if (!check.IsValid())
     return false;
 
-  return check * BitsPerComponent <= INT_MAX - 7;
+  return check.ValueOrDie() <= INT_MAX - 7;
 }
 
 }  // namespace
@@ -75,10 +74,10 @@ const uint16_t PDFDocEncoding[256] = {
 
 uint32_t A85Decode(const uint8_t* src_buf,
                    uint32_t src_size,
-                   uint8_t*& dest_buf,
-                   uint32_t& dest_size) {
-  dest_size = 0;
-  dest_buf = nullptr;
+                   uint8_t** dest_buf,
+                   uint32_t* dest_size) {
+  *dest_size = 0;
+  *dest_buf = nullptr;
   if (src_size == 0)
     return 0;
 
@@ -105,26 +104,27 @@ uint32_t A85Decode(const uint8_t* src_buf,
   if (zcount > (UINT_MAX - space_for_non_zeroes) / 4)
     return 0xFFFFFFFF;
 
-  dest_buf = FX_Alloc(uint8_t, zcount * 4 + space_for_non_zeroes);
+  *dest_buf = FX_Alloc(uint8_t, zcount * 4 + space_for_non_zeroes);
   size_t state = 0;
   uint32_t res = 0;
-  pos = dest_size = 0;
+  pos = 0;
   while (pos < src_size) {
     uint8_t ch = src_buf[pos++];
     if (PDFCharIsLineEnding(ch) || ch == ' ' || ch == '\t')
       continue;
 
     if (ch == 'z') {
-      memset(dest_buf + dest_size, 0, 4);
+      memset(*dest_buf + *dest_size, 0, 4);
       state = 0;
       res = 0;
-      dest_size += 4;
+      *dest_size += 4;
     } else if (ch >= '!' && ch <= 'u') {
       res = res * 85 + ch - 33;
       state++;
       if (state == 5) {
-        for (size_t i = 0; i < 4; i++) {
-          dest_buf[dest_size++] = (uint8_t)(res >> (3 - i) * 8);
+        for (size_t i = 0; i < 4; ++i) {
+          (*dest_buf)[(*dest_size)++] =
+              static_cast<uint8_t>(res >> (3 - i) * 8);
         }
         state = 0;
         res = 0;
@@ -136,34 +136,34 @@ uint32_t A85Decode(const uint8_t* src_buf,
   }
   // Handle partial group.
   if (state) {
-    for (size_t i = state; i < 5; i++)
+    for (size_t i = state; i < 5; ++i)
       res = res * 85 + 84;
-    for (size_t i = 0; i < state - 1; i++)
-      dest_buf[dest_size++] = (uint8_t)(res >> (3 - i) * 8);
+    for (size_t i = 0; i < state - 1; ++i)
+      (*dest_buf)[(*dest_size)++] = static_cast<uint8_t>(res >> (3 - i) * 8);
   }
   if (pos < src_size && src_buf[pos] == '>')
-    pos++;
+    ++pos;
   return pos;
 }
 
 uint32_t HexDecode(const uint8_t* src_buf,
                    uint32_t src_size,
-                   uint8_t*& dest_buf,
-                   uint32_t& dest_size) {
-  dest_size = 0;
+                   uint8_t** dest_buf,
+                   uint32_t* dest_size) {
+  *dest_size = 0;
   if (src_size == 0) {
-    dest_buf = nullptr;
+    *dest_buf = nullptr;
     return 0;
   }
 
   uint32_t i = 0;
   // Find the end of data.
   while (i < src_size && src_buf[i] != '>')
-    i++;
+    ++i;
 
-  dest_buf = FX_Alloc(uint8_t, i / 2 + 1);
+  *dest_buf = FX_Alloc(uint8_t, i / 2 + 1);
   bool bFirst = true;
-  for (i = 0; i < src_size; i++) {
+  for (i = 0; i < src_size; ++i) {
     uint8_t ch = src_buf[i];
     if (PDFCharIsLineEnding(ch) || ch == ' ' || ch == '\t')
       continue;
@@ -177,44 +177,43 @@ uint32_t HexDecode(const uint8_t* src_buf,
 
     int digit = FXSYS_HexCharToInt(ch);
     if (bFirst)
-      dest_buf[dest_size] = digit * 16;
+      (*dest_buf)[*dest_size] = digit * 16;
     else
-      dest_buf[dest_size++] += digit;
-
+      (*dest_buf)[(*dest_size)++] += digit;
     bFirst = !bFirst;
   }
   if (!bFirst)
-    dest_size++;
+    ++(*dest_size);
   return i;
 }
 
 uint32_t RunLengthDecode(const uint8_t* src_buf,
                          uint32_t src_size,
-                         uint8_t*& dest_buf,
-                         uint32_t& dest_size) {
+                         uint8_t** dest_buf,
+                         uint32_t* dest_size) {
   uint32_t i = 0;
-  dest_size = 0;
+  *dest_size = 0;
   while (i < src_size) {
     if (src_buf[i] == 128)
       break;
 
-    uint32_t old = dest_size;
+    uint32_t old = *dest_size;
     if (src_buf[i] < 128) {
-      dest_size += src_buf[i] + 1;
-      if (dest_size < old)
+      *dest_size += src_buf[i] + 1;
+      if (*dest_size < old)
         return FX_INVALID_OFFSET;
       i += src_buf[i] + 2;
     } else {
-      dest_size += 257 - src_buf[i];
-      if (dest_size < old)
+      *dest_size += 257 - src_buf[i];
+      if (*dest_size < old)
         return FX_INVALID_OFFSET;
       i += 2;
     }
   }
-  if (dest_size >= kMaxStreamSize)
+  if (*dest_size >= kMaxStreamSize)
     return FX_INVALID_OFFSET;
 
-  dest_buf = FX_Alloc(uint8_t, dest_size);
+  *dest_buf = FX_Alloc(uint8_t, *dest_size);
   i = 0;
   int dest_count = 0;
   while (i < src_size) {
@@ -227,22 +226,20 @@ uint32_t RunLengthDecode(const uint8_t* src_buf,
       if (buf_left < copy_len) {
         uint32_t delta = copy_len - buf_left;
         copy_len = buf_left;
-        memset(dest_buf + dest_count + copy_len, '\0', delta);
+        memset(*dest_buf + dest_count + copy_len, '\0', delta);
       }
-      memcpy(dest_buf + dest_count, src_buf + i + 1, copy_len);
+      memcpy(*dest_buf + dest_count, src_buf + i + 1, copy_len);
       dest_count += src_buf[i] + 1;
       i += src_buf[i] + 2;
     } else {
       int fill = 0;
-      if (i < src_size - 1) {
+      if (i < src_size - 1)
         fill = src_buf[i + 1];
-      }
-      memset(dest_buf + dest_count, fill, 257 - src_buf[i]);
+      memset(*dest_buf + dest_count, fill, 257 - src_buf[i]);
       dest_count += 257 - src_buf[i];
       i += 2;
     }
   }
-
   return std::min(i + 1, src_size);
 }
 
@@ -265,9 +262,8 @@ std::unique_ptr<CCodec_ScanlineDecoder> FPDFAPI_CreateFaxDecoder(
     BlackIs1 = !!pParams->GetIntegerFor("BlackIs1");
     Columns = pParams->GetIntegerFor("Columns", 1728);
     Rows = pParams->GetIntegerFor("Rows");
-    if (Rows > USHRT_MAX) {
+    if (Rows > USHRT_MAX)
       Rows = 0;
-    }
   }
   return CPDF_ModuleMgr::Get()->GetFaxModule()->CreateDecoder(
       src_buf, src_size, width, height, K, EndOfLine, ByteAlign, BlackIs1,
@@ -283,7 +279,9 @@ std::unique_ptr<CCodec_ScanlineDecoder> FPDFAPI_CreateFlateDecoder(
     int bpc,
     const CPDF_Dictionary* pParams) {
   int predictor = 0;
-  int Colors = 0, BitsPerComponent = 0, Columns = 0;
+  int Colors = 0;
+  int BitsPerComponent = 0;
+  int Columns = 0;
   if (pParams) {
     predictor = pParams->GetIntegerFor("Predictor");
     Colors = pParams->GetIntegerFor("Colors", 1);
@@ -302,8 +300,8 @@ uint32_t FPDFAPI_FlateOrLZWDecode(bool bLZW,
                                   uint32_t src_size,
                                   CPDF_Dictionary* pParams,
                                   uint32_t estimated_size,
-                                  uint8_t*& dest_buf,
-                                  uint32_t& dest_size) {
+                                  uint8_t** dest_buf,
+                                  uint32_t* dest_size) {
   int predictor = 0;
   int Colors = 0;
   int BitsPerComponent = 0;
@@ -326,12 +324,12 @@ uint32_t FPDFAPI_FlateOrLZWDecode(bool bLZW,
 bool PDF_DataDecode(const uint8_t* src_buf,
                     uint32_t src_size,
                     const CPDF_Dictionary* pDict,
-                    uint8_t*& dest_buf,
-                    uint32_t& dest_size,
-                    CFX_ByteString* ImageEncoding,
-                    CPDF_Dictionary*& pImageParms,
                     uint32_t last_estimated_size,
-                    bool bImageAcc) {
+                    bool bImageAcc,
+                    uint8_t** dest_buf,
+                    uint32_t* dest_size,
+                    CFX_ByteString* ImageEncoding,
+                    CPDF_Dictionary** pImageParms) {
   CPDF_Object* pDecoder = pDict ? pDict->GetDirectObjectFor("Filter") : nullptr;
   if (!pDecoder || (!pDecoder->IsArray() && !pDecoder->IsName()))
     return false;
@@ -342,7 +340,7 @@ bool PDF_DataDecode(const uint8_t* src_buf,
   std::vector<std::pair<CFX_ByteString, CPDF_Object*>> DecoderArray;
   if (CPDF_Array* pDecoders = pDecoder->AsArray()) {
     CPDF_Array* pParamsArray = ToArray(pParams);
-    for (size_t i = 0; i < pDecoders->GetCount(); i++) {
+    for (size_t i = 0; i < pDecoders->GetCount(); ++i) {
       DecoderArray.push_back(
           {pDecoders->GetStringAt(i),
            pParamsArray ? pParamsArray->GetDictAt(i) : nullptr});
@@ -354,7 +352,7 @@ bool PDF_DataDecode(const uint8_t* src_buf,
   uint8_t* last_buf = const_cast<uint8_t*>(src_buf);
   uint32_t last_size = src_size;
   int nSize = pdfium::CollectionSize<int>(DecoderArray);
-  for (int i = 0; i < nSize; i++) {
+  for (int i = 0; i < nSize; ++i) {
     int estimated_size = i == nSize - 1 ? last_estimated_size : 0;
     CFX_ByteString decoder = DecoderArray[i].first;
     CPDF_Dictionary* pParam = ToDictionary(DecoderArray[i].second);
@@ -364,49 +362,47 @@ bool PDF_DataDecode(const uint8_t* src_buf,
     if (decoder == "FlateDecode" || decoder == "Fl") {
       if (bImageAcc && i == nSize - 1) {
         *ImageEncoding = "FlateDecode";
-        dest_buf = last_buf;
-        dest_size = last_size;
-        pImageParms = pParam;
+        *dest_buf = last_buf;
+        *dest_size = last_size;
+        *pImageParms = pParam;
         return true;
       }
       offset = FPDFAPI_FlateOrLZWDecode(false, last_buf, last_size, pParam,
-                                        estimated_size, new_buf, new_size);
+                                        estimated_size, &new_buf, &new_size);
     } else if (decoder == "LZWDecode" || decoder == "LZW") {
       offset = FPDFAPI_FlateOrLZWDecode(true, last_buf, last_size, pParam,
-                                        estimated_size, new_buf, new_size);
+                                        estimated_size, &new_buf, &new_size);
     } else if (decoder == "ASCII85Decode" || decoder == "A85") {
-      offset = A85Decode(last_buf, last_size, new_buf, new_size);
+      offset = A85Decode(last_buf, last_size, &new_buf, &new_size);
     } else if (decoder == "ASCIIHexDecode" || decoder == "AHx") {
-      offset = HexDecode(last_buf, last_size, new_buf, new_size);
+      offset = HexDecode(last_buf, last_size, &new_buf, &new_size);
     } else if (decoder == "RunLengthDecode" || decoder == "RL") {
       if (bImageAcc && i == nSize - 1) {
         *ImageEncoding = "RunLengthDecode";
-        dest_buf = last_buf;
-        dest_size = last_size;
-        pImageParms = pParam;
+        *dest_buf = last_buf;
+        *dest_size = last_size;
+        *pImageParms = pParam;
         return true;
       }
-      offset = RunLengthDecode(last_buf, last_size, new_buf, new_size);
+      offset = RunLengthDecode(last_buf, last_size, &new_buf, &new_size);
     } else if (decoder == "Crypt") {
       continue;
     } else {
       // If we get here, assume it's an image decoder.
-      if (decoder == "DCT") {
+      if (decoder == "DCT")
         decoder = "DCTDecode";
-      } else if (decoder == "CCF") {
+      else if (decoder == "CCF")
         decoder = "CCITTFaxDecode";
-      }
       *ImageEncoding = decoder;
-      pImageParms = pParam;
-      dest_buf = last_buf;
-      dest_size = last_size;
+      *pImageParms = pParam;
+      *dest_buf = last_buf;
+      *dest_size = last_size;
       if (CPDF_Array* pDecoders = pDecoder->AsArray())
         pDecoders->Truncate(i + 1);
       return true;
     }
-    if (last_buf != src_buf) {
+    if (last_buf != src_buf)
       FX_Free(last_buf);
-    }
     if (offset == -1) {
       FX_Free(new_buf);
       return false;
@@ -415,9 +411,9 @@ bool PDF_DataDecode(const uint8_t* src_buf,
     last_size = new_size;
   }
   *ImageEncoding = "";
-  pImageParms = nullptr;
-  dest_buf = last_buf;
-  dest_size = last_size;
+  *pImageParms = nullptr;
+  *dest_buf = last_buf;
+  *dest_size = last_size;
   return true;
 }
 
@@ -427,12 +423,11 @@ CFX_WideString PDF_DecodeText(const uint8_t* src_data, uint32_t src_len) {
                        (src_data[0] == 0xff && src_data[1] == 0xfe))) {
     bool bBE = src_data[0] == 0xfe;
     uint32_t max_chars = (src_len - 2) / 2;
-    if (!max_chars) {
+    if (!max_chars)
       return result;
-    }
-    if (src_data[0] == 0xff) {
+
+    if (src_data[0] == 0xff)
       bBE = !src_data[2];
-    }
     wchar_t* dest_buf = result.GetBuffer(max_chars);
     const uint8_t* uni_str = src_data + 2;
     int dest_pos = 0;
@@ -455,7 +450,7 @@ CFX_WideString PDF_DecodeText(const uint8_t* src_data, uint32_t src_len) {
     result.ReleaseBuffer(dest_pos);
   } else {
     wchar_t* dest_buf = result.GetBuffer(src_len);
-    for (uint32_t i = 0; i < src_len; i++)
+    for (uint32_t i = 0; i < src_len; ++i)
       dest_buf[i] = PDFDocEncoding[src_data[i]];
     result.ReleaseBuffer(src_len);
   }
@@ -463,31 +458,32 @@ CFX_WideString PDF_DecodeText(const uint8_t* src_data, uint32_t src_len) {
 }
 
 CFX_WideString PDF_DecodeText(const CFX_ByteString& bstr) {
-  return PDF_DecodeText((const uint8_t*)bstr.c_str(), bstr.GetLength());
+  return PDF_DecodeText(reinterpret_cast<const uint8_t*>(bstr.c_str()),
+                        bstr.GetLength());
 }
 
 CFX_ByteString PDF_EncodeText(const wchar_t* pString, int len) {
-  if (len == -1) {
+  if (len == -1)
     len = FXSYS_wcslen(pString);
-  }
+
   CFX_ByteString result;
   char* dest_buf1 = result.GetBuffer(len);
   int i;
-  for (i = 0; i < len; i++) {
+  for (i = 0; i < len; ++i) {
     int code;
-    for (code = 0; code < 256; code++)
-      if (PDFDocEncoding[code] == pString[i]) {
+    for (code = 0; code < 256; ++code) {
+      if (PDFDocEncoding[code] == pString[i])
         break;
-      }
-    if (code == 256) {
-      break;
     }
+
+    if (code == 256)
+      break;
+
     dest_buf1[i] = code;
   }
   result.ReleaseBuffer(i);
-  if (i == len) {
+  if (i == len)
     return result;
-  }
 
   if (len > INT_MAX / 2 - 1) {
     result.ReleaseBuffer(0);
@@ -496,13 +492,13 @@ CFX_ByteString PDF_EncodeText(const wchar_t* pString, int len) {
 
   int encLen = len * 2 + 2;
 
-  uint8_t* dest_buf2 = (uint8_t*)result.GetBuffer(encLen);
+  uint8_t* dest_buf2 = reinterpret_cast<uint8_t*>(result.GetBuffer(encLen));
   dest_buf2[0] = 0xfe;
   dest_buf2[1] = 0xff;
   dest_buf2 += 2;
-  for (int j = 0; j < len; j++) {
+  for (int j = 0; j < len; ++j) {
     *dest_buf2++ = pString[j] >> 8;
-    *dest_buf2++ = (uint8_t)pString[j];
+    *dest_buf2++ = static_cast<uint8_t>(pString[j]);
   }
   result.ReleaseBuffer(encLen);
   return result;
@@ -517,7 +513,7 @@ CFX_ByteString PDF_EncodeString(const CFX_ByteString& src, bool bHex) {
   int srclen = src.GetLength();
   if (bHex) {
     result << '<';
-    for (int i = 0; i < srclen; i++) {
+    for (int i = 0; i < srclen; ++i) {
       char buf[2];
       FXSYS_IntToTwoHexChars(src[i], buf);
       result << buf[0];
@@ -527,7 +523,7 @@ CFX_ByteString PDF_EncodeString(const CFX_ByteString& src, bool bHex) {
     return CFX_ByteString(result);
   }
   result << '(';
-  for (int i = 0; i < srclen; i++) {
+  for (int i = 0; i < srclen; ++i) {
     uint8_t ch = src[i];
     if (ch == 0x0a) {
       result << "\\n";
@@ -565,8 +561,8 @@ bool PngEncode(const uint8_t* src_buf,
 
 uint32_t FlateDecode(const uint8_t* src_buf,
                      uint32_t src_size,
-                     uint8_t*& dest_buf,
-                     uint32_t& dest_size) {
+                     uint8_t** dest_buf,
+                     uint32_t* dest_size) {
   CCodec_ModuleMgr* pEncoders = CPDF_ModuleMgr::Get()->GetCodecModule();
   return pEncoders->GetFlateModule()->FlateOrLZWDecode(
       false, src_buf, src_size, false, 0, 0, 0, 0, 0, dest_buf, dest_size);
diff --git a/core/fpdfapi/parser/fpdf_parser_decode.h b/core/fpdfapi/parser/fpdf_parser_decode.h
index 955a8cfb32..4d2c6732e0 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode.h
+++ b/core/fpdfapi/parser/fpdf_parser_decode.h
@@ -20,10 +20,10 @@ extern const uint16_t PDFDocEncoding[256];
 CFX_ByteString PDF_NameDecode(const CFX_ByteStringC& orig);
 CFX_ByteString PDF_NameDecode(const CFX_ByteString& orig);
 CFX_ByteString PDF_NameEncode(const CFX_ByteString& orig);
-CFX_ByteString PDF_EncodeString(const CFX_ByteString& src, bool bHex = false);
+CFX_ByteString PDF_EncodeString(const CFX_ByteString& src, bool bHex);
 CFX_WideString PDF_DecodeText(const uint8_t* pData, uint32_t size);
 CFX_WideString PDF_DecodeText(const CFX_ByteString& bstr);
-CFX_ByteString PDF_EncodeText(const wchar_t* pString, int len = -1);
+CFX_ByteString PDF_EncodeText(const wchar_t* pString, int len);
 CFX_ByteString PDF_EncodeText(const CFX_WideString& str);
 
 bool FlateEncode(const uint8_t* src_buf,
@@ -41,12 +41,13 @@ bool PngEncode(const uint8_t* src_buf,
 
 uint32_t FlateDecode(const uint8_t* src_buf,
                      uint32_t src_size,
-                     uint8_t*& dest_buf,
-                     uint32_t& dest_size);
+                     uint8_t** dest_buf,
+                     uint32_t* dest_size);
+
 uint32_t RunLengthDecode(const uint8_t* src_buf,
                          uint32_t src_size,
-                         uint8_t*& dest_buf,
-                         uint32_t& dest_size);
+                         uint8_t** dest_buf,
+                         uint32_t* dest_size);
 
 std::unique_ptr<CCodec_ScanlineDecoder> FPDFAPI_CreateFaxDecoder(
     const uint8_t* src_buf,
@@ -64,32 +65,32 @@ std::unique_ptr<CCodec_ScanlineDecoder> FPDFAPI_CreateFlateDecoder(
     int bpc,
     const CPDF_Dictionary* pParams);
 
-// Public for testing.
 uint32_t A85Decode(const uint8_t* src_buf,
                    uint32_t src_size,
-                   uint8_t*& dest_buf,
-                   uint32_t& dest_size);
-// Public for testing.
+                   uint8_t** dest_buf,
+                   uint32_t* dest_size);
+
 uint32_t HexDecode(const uint8_t* src_buf,
                    uint32_t src_size,
-                   uint8_t*& dest_buf,
-                   uint32_t& dest_size);
-// Public for testing.
+                   uint8_t** dest_buf,
+                   uint32_t* dest_size);
+
 uint32_t FPDFAPI_FlateOrLZWDecode(bool bLZW,
                                   const uint8_t* src_buf,
                                   uint32_t src_size,
                                   CPDF_Dictionary* pParams,
                                   uint32_t estimated_size,
-                                  uint8_t*& dest_buf,
-                                  uint32_t& dest_size);
+                                  uint8_t** dest_buf,
+                                  uint32_t* dest_size);
+
 bool PDF_DataDecode(const uint8_t* src_buf,
                     uint32_t src_size,
                     const CPDF_Dictionary* pDict,
-                    uint8_t*& dest_buf,
-                    uint32_t& dest_size,
-                    CFX_ByteString* ImageEncoding,
-                    CPDF_Dictionary*& pImageParms,
                     uint32_t estimated_size,
-                    bool bImageAcc);
+                    bool bImageAcc,
+                    uint8_t** dest_buf,
+                    uint32_t* dest_size,
+                    CFX_ByteString* ImageEncoding,
+                    CPDF_Dictionary** pImageParms);
 
 #endif  // CORE_FPDFAPI_PARSER_FPDF_PARSER_DECODE_H_
diff --git a/core/fpdfapi/parser/fpdf_parser_decode_embeddertest.cpp b/core/fpdfapi/parser/fpdf_parser_decode_embeddertest.cpp
index 136d7c9f2f..bb3cf15a0f 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode_embeddertest.cpp
+++ b/core/fpdfapi/parser/fpdf_parser_decode_embeddertest.cpp
@@ -76,7 +76,7 @@ TEST_F(FPDFParserDecodeEmbeddertest, FlateDecode) {
     unsigned char* result = nullptr;
     unsigned int result_size;
     EXPECT_EQ(data.processed_size,
-              FlateDecode(data.input, data.input_size, result, result_size))
+              FlateDecode(data.input, data.input_size, &result, &result_size))
         << " for case " << i;
     ASSERT_TRUE(result);
     EXPECT_EQ(std::string((const char*)data.expected, data.expected_size),
diff --git a/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp b/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp
index f8c9863c32..c8e0c7a0e1 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp
+++ b/core/fpdfapi/parser/fpdf_parser_decode_unittest.cpp
@@ -31,7 +31,7 @@ TEST(fpdf_parser_decode, A85Decode) {
     uint8_t* result = nullptr;
     uint32_t result_size = 0;
     EXPECT_EQ(ptr->processed_size,
-              A85Decode(ptr->input, ptr->input_size, result, result_size))
+              A85Decode(ptr->input, ptr->input_size, &result, &result_size))
         << "for case " << i;
     ASSERT_EQ(ptr->expected_size, result_size);
     for (size_t j = 0; j < result_size; ++j) {
@@ -66,7 +66,7 @@ TEST(fpdf_parser_decode, HexDecode) {
     uint8_t* result = nullptr;
     uint32_t result_size = 0;
     EXPECT_EQ(ptr->processed_size,
-              HexDecode(ptr->input, ptr->input_size, result, result_size))
+              HexDecode(ptr->input, ptr->input_size, &result, &result_size))
         << "for case " << i;
     ASSERT_EQ(ptr->expected_size, result_size);
     for (size_t j = 0; j < result_size; ++j) {
diff --git a/core/fpdfdoc/cpdf_formfield.cpp b/core/fpdfdoc/cpdf_formfield.cpp
index cd47f269bc..acb46a5beb 100644
--- a/core/fpdfdoc/cpdf_formfield.cpp
+++ b/core/fpdfdoc/cpdf_formfield.cpp
@@ -662,8 +662,7 @@ int CPDF_FormField::InsertOption(CFX_WideString csOptLabel,
   if (bNotify && !NotifyListOrComboBoxBeforeChange(csOptLabel))
     return -1;
 
-  CFX_ByteString csStr =
-      PDF_EncodeText(csOptLabel.c_str(), csOptLabel.GetLength());
+  CFX_ByteString csStr = PDF_EncodeText(csOptLabel);
   CPDF_Array* pOpt = ToArray(FPDF_GetFieldAttr(m_pDict.Get(), "Opt"));
   if (!pOpt)
     pOpt = m_pDict->SetNewFor<CPDF_Array>("Opt");
diff --git a/core/fpdfdoc/cpvt_generateap.cpp b/core/fpdfdoc/cpvt_generateap.cpp
index bcd3aa1d00..d542e8cb32 100644
--- a/core/fpdfdoc/cpvt_generateap.cpp
+++ b/core/fpdfdoc/cpvt_generateap.cpp
@@ -1348,7 +1348,7 @@ CFX_ByteString CPVT_GenerateAP::GetPDFWordString(IPVT_FontMap* pFontMap,
 CFX_ByteString CPVT_GenerateAP::GetWordRenderString(
     const CFX_ByteString& strWords) {
   if (strWords.GetLength() > 0)
-    return PDF_EncodeString(strWords) + " Tj\n";
+    return PDF_EncodeString(strWords, false) + " Tj\n";
   return "";
 }
 
diff --git a/core/fxcodec/codec/ccodec_flatemodule.h b/core/fxcodec/codec/ccodec_flatemodule.h
index 5178943ca0..ae34103f3b 100644
--- a/core/fxcodec/codec/ccodec_flatemodule.h
+++ b/core/fxcodec/codec/ccodec_flatemodule.h
@@ -34,12 +34,14 @@ class CCodec_FlateModule {
                             int BitsPerComponent,
                             int Columns,
                             uint32_t estimated_size,
-                            uint8_t*& dest_buf,
-                            uint32_t& dest_size);
+                            uint8_t** dest_buf,
+                            uint32_t* dest_size);
+
   bool Encode(const uint8_t* src_buf,
               uint32_t src_size,
               uint8_t** dest_buf,
               uint32_t* dest_size);
+
   bool PngEncode(const uint8_t* src_buf,
                  uint32_t src_size,
                  uint8_t** dest_buf,
diff --git a/core/fxcodec/codec/fx_codec_flate.cpp b/core/fxcodec/codec/fx_codec_flate.cpp
index 5af3e99c2e..02be295ce6 100644
--- a/core/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/fxcodec/codec/fx_codec_flate.cpp
@@ -766,48 +766,44 @@ uint32_t CCodec_FlateModule::FlateOrLZWDecode(bool bLZW,
                                               int BitsPerComponent,
                                               int Columns,
                                               uint32_t estimated_size,
-                                              uint8_t*& dest_buf,
-                                              uint32_t& dest_size) {
-  dest_buf = nullptr;
+                                              uint8_t** dest_buf,
+                                              uint32_t* dest_size) {
+  *dest_buf = nullptr;
   uint32_t offset = 0;
   int predictor_type = 0;
   if (predictor) {
-    if (predictor >= 10) {
+    if (predictor >= 10)
       predictor_type = 2;
-    } else if (predictor == 2) {
+    else if (predictor == 2)
       predictor_type = 1;
-    }
   }
   if (bLZW) {
-    {
-      auto decoder = pdfium::MakeUnique<CLZWDecoder>();
-      dest_size = 0xFFFFFFFF;
-      offset = src_size;
-      int err =
-          decoder->Decode(nullptr, dest_size, src_buf, offset, bEarlyChange);
-      if (err || dest_size == 0 || dest_size + 1 < dest_size) {
-        return FX_INVALID_OFFSET;
-      }
-    }
-    {
-      auto decoder = pdfium::MakeUnique<CLZWDecoder>();
-      dest_buf = FX_Alloc(uint8_t, dest_size + 1);
-      dest_buf[dest_size] = '\0';
-      decoder->Decode(dest_buf, dest_size, src_buf, offset, bEarlyChange);
-    }
+    auto decoder = pdfium::MakeUnique<CLZWDecoder>();
+    *dest_size = 0xFFFFFFFF;
+    offset = src_size;
+    int err =
+        decoder->Decode(nullptr, *dest_size, src_buf, offset, bEarlyChange);
+    if (err || *dest_size == 0 || *dest_size + 1 < *dest_size)
+      return FX_INVALID_OFFSET;
+
+    decoder = pdfium::MakeUnique<CLZWDecoder>();
+    *dest_buf = FX_Alloc(uint8_t, *dest_size + 1);
+    (*dest_buf)[*dest_size] = '\0';
+    decoder->Decode(*dest_buf, *dest_size, src_buf, offset, bEarlyChange);
   } else {
-    FlateUncompress(src_buf, src_size, estimated_size, dest_buf, dest_size,
+    FlateUncompress(src_buf, src_size, estimated_size, *dest_buf, *dest_size,
                     offset);
   }
-  if (predictor_type == 0) {
+  if (predictor_type == 0)
     return offset;
-  }
+
   bool ret = true;
   if (predictor_type == 2) {
-    ret = PNG_Predictor(dest_buf, dest_size, Colors, BitsPerComponent, Columns);
-  } else if (predictor_type == 1) {
     ret =
-        TIFF_Predictor(dest_buf, dest_size, Colors, BitsPerComponent, Columns);
+        PNG_Predictor(*dest_buf, *dest_size, Colors, BitsPerComponent, Columns);
+  } else if (predictor_type == 1) {
+    ret = TIFF_Predictor(*dest_buf, *dest_size, Colors, BitsPerComponent,
+                         Columns);
   }
   return ret ? offset : FX_INVALID_OFFSET;
 }
diff --git a/core/fxcodec/codec/fx_codec_rle_unittest.cpp b/core/fxcodec/codec/fx_codec_rle_unittest.cpp
index d90a515d45..f9a4b3fcb7 100644
--- a/core/fxcodec/codec/fx_codec_rle_unittest.cpp
+++ b/core/fxcodec/codec/fx_codec_rle_unittest.cpp
@@ -75,7 +75,7 @@ TEST(fxcodec, RLETestNormalInputs) {
       pEncoders->RunLengthEncode(src_buf_1, src_size, &dest_buf, &dest_size));
   uint8_t* decoded_buf = nullptr;
   uint32_t decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_1[i], decoded_buf[i]) << " at " << i;
@@ -89,7 +89,7 @@ TEST(fxcodec, RLETestNormalInputs) {
       pEncoders->RunLengthEncode(src_buf_2, src_size, &dest_buf, &dest_size));
   decoded_buf = nullptr;
   decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_2[i], decoded_buf[i]) << " at " << i;
@@ -103,7 +103,7 @@ TEST(fxcodec, RLETestNormalInputs) {
       pEncoders->RunLengthEncode(src_buf_3, src_size, &dest_buf, &dest_size));
   decoded_buf = nullptr;
   decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_3[i], decoded_buf[i]) << " at " << i;
@@ -144,7 +144,7 @@ TEST(fxcodec, RLETestFullLengthInputs) {
       pEncoders->RunLengthEncode(src_buf_1, src_size, &dest_buf, &dest_size));
   uint8_t* decoded_buf = nullptr;
   uint32_t decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_1[i], decoded_buf[i]) << " at " << i;
@@ -158,7 +158,7 @@ TEST(fxcodec, RLETestFullLengthInputs) {
       pEncoders->RunLengthEncode(src_buf_2, src_size, &dest_buf, &dest_size));
   decoded_buf = nullptr;
   decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_2[i], decoded_buf[i]) << " at " << i;
@@ -172,7 +172,7 @@ TEST(fxcodec, RLETestFullLengthInputs) {
       pEncoders->RunLengthEncode(src_buf_3, src_size, &dest_buf, &dest_size));
   decoded_buf = nullptr;
   decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_3[i], decoded_buf[i]) << " at " << i;
@@ -186,7 +186,7 @@ TEST(fxcodec, RLETestFullLengthInputs) {
       pEncoders->RunLengthEncode(src_buf_4, src_size, &dest_buf, &dest_size));
   decoded_buf = nullptr;
   decoded_size = 0;
-  RunLengthDecode(dest_buf, dest_size, decoded_buf, decoded_size);
+  RunLengthDecode(dest_buf, dest_size, &decoded_buf, &decoded_size);
   ASSERT_EQ(src_size, decoded_size);
   for (uint32_t i = 0; i < src_size; i++)
     EXPECT_EQ(src_buf_4[i], decoded_buf[i]) << " at " << i;
diff --git a/fpdfsdk/fxedit/fxet_edit.cpp b/fpdfsdk/fxedit/fxet_edit.cpp
index 130a81d335..f11f631907 100644
--- a/fpdfsdk/fxedit/fxet_edit.cpp
+++ b/fpdfsdk/fxedit/fxet_edit.cpp
@@ -38,7 +38,7 @@ const int kEditUndoMaxItems = 10000;
 
 CFX_ByteString GetWordRenderString(const CFX_ByteString& strWords) {
   if (strWords.GetLength() > 0)
-    return PDF_EncodeString(strWords) + " Tj\n";
+    return PDF_EncodeString(strWords, false) + " Tj\n";
   return CFX_ByteString();
 }
 
diff --git a/xfa/fxfa/parser/cxfa_localemgr.cpp b/xfa/fxfa/parser/cxfa_localemgr.cpp
index e9b47e7921..633f4b41fd 100644
--- a/xfa/fxfa/parser/cxfa_localemgr.cpp
+++ b/xfa/fxfa/parser/cxfa_localemgr.cpp
@@ -1068,7 +1068,7 @@ static std::unique_ptr<IFX_Locale> XFA_GetLocaleFromBuffer(const uint8_t* pBuf,
   uint32_t dwSize;
   CCodec_ModuleMgr* pCodecMgr = CPDF_ModuleMgr::Get()->GetCodecModule();
   pCodecMgr->GetFlateModule()->FlateOrLZWDecode(false, pBuf, nBufLen, true, 0,
-                                                0, 0, 0, 0, pOut, dwSize);
+                                                0, 0, 0, 0, &pOut, &dwSize);
   if (!pOut)
     return nullptr;