Return pdfium::span<wchar_t> from WideString::GetBuffer().

Adds bounds checking "for free", but beware of span outliving
a ReleaseBuffer() call.  Scoping as such avoids the possibility
of using an invalid span (and it is flagged as a lifetime issue).

Change-Id: Ica63f4b1429823d0254ec6951aeaeb08160cb93c
Reviewed-on: https://pdfium-review.googlesource.com/30310
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

1 files changed, 15 insertions, 13 deletions

diff --git a/xfa/fxfa/cxfa_textlayout.cpp b/xfa/fxfa/cxfa_textlayout.cpp
index e360c16dde..5359a340e5 100644
--- a/xfa/fxfa/cxfa_textlayout.cpp
+++ b/xfa/fxfa/cxfa_textlayout.cpp
@@ -911,21 +911,23 @@ void CXFA_TextLayout::ProcessText(WideString& wsText) {
   if (iLen == 0)
     return;
 
-  wchar_t* psz = wsText.GetBuffer(iLen);
   int32_t iTrimLeft = 0;
-  wchar_t wch = 0, wPrev = 0;
-  for (int32_t i = 0; i < iLen; i++) {
-    wch = psz[i];
-    if (wch < 0x20)
-      wch = 0x20;
-    if (wch == 0x20 && wPrev == 0x20)
-      continue;
-
-    wPrev = wch;
-    psz[iTrimLeft++] = wch;
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<wchar_t> psz = wsText.GetBuffer(iLen);
+    wchar_t wPrev = 0;
+    for (int32_t i = 0; i < iLen; i++) {
+      wchar_t wch = psz[i];
+      if (wch < 0x20)
+        wch = 0x20;
+      if (wch == 0x20 && wPrev == 0x20)
+        continue;
+
+      wPrev = wch;
+      psz[iTrimLeft++] = wch;
+    }
   }
-  wsText.ReleaseBuffer(iLen);
-  wsText = wsText.Left(iTrimLeft);
+  wsText.ReleaseBuffer(iTrimLeft);
 }
 
 void CXFA_TextLayout::EndBreak(CFX_BreakType dwStatus,