2 files changed, 8 insertions, 5 deletions
diff --git a/core/fpdfapi/font/cpdf_simplefont.cpp b/core/fpdfapi/font/cpdf_simplefont.cpp
index a6c3ba0547..8c8520f0c4 100644
--- a/core/fpdfapi/font/cpdf_simplefont.cpp
+++ b/core/fpdfapi/font/cpdf_simplefont.cpp
@@ -130,7 +130,7 @@ bool CPDF_SimpleFont::LoadCommon() {
   }
   if (m_pFontFile) {
     if (m_BaseFont.GetLength() > 8 && m_BaseFont[7] == '+')
-      m_BaseFont = m_BaseFont.Mid(8);
+      m_BaseFont = m_BaseFont.Mid(8, m_BaseFont.GetLength() - 8);
   } else {
     LoadSubstFont();
   }
diff --git a/core/fpdfapi/page/cpdf_streamcontentparser.cpp b/core/fpdfapi/page/cpdf_streamcontentparser.cpp
index e00dbc54fd..5f571aa8d6 100644
--- a/core/fpdfapi/page/cpdf_streamcontentparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamcontentparser.cpp
@@ -619,7 +619,8 @@ void CPDF_StreamContentParser::Handle_BeginImage() {
     if (type != CPDF_StreamParser::Name) {
       break;
     }
-    CFX_ByteString key(m_pSyntax->GetWord().Mid(1));
+    auto word = m_pSyntax->GetWord();
+    CFX_ByteString key(word.Mid(1, word.GetLength() - 1));
     auto pObj = m_pSyntax->ReadNextObject(false, false, 0);
     if (!key.IsEmpty()) {
       uint32_t dwObjNum = pObj ? pObj->GetObjNum() : 0;
@@ -1185,7 +1186,7 @@ CPDF_ColorSpace* CPDF_StreamContentParser::FindColorSpace(
   }
   if (name == "DeviceGray" || name == "DeviceCMYK" || name == "DeviceRGB") {
     CFX_ByteString defname = "Default";
-    defname += name.Mid(7);
+    defname += name.Mid(7, name.GetLength() - 7);
     CPDF_Object* pDefObj = FindResourceObj("ColorSpace", defname);
     if (!pDefObj) {
       if (name == "DeviceGray") {
@@ -1522,9 +1523,11 @@ uint32_t CPDF_StreamContentParser::Parse(const uint8_t* pData,
       case CPDF_StreamParser::Number:
         AddNumberParam(syntax.GetWord());
         break;
-      case CPDF_StreamParser::Name:
-        AddNameParam(syntax.GetWord().Mid(1));
+      case CPDF_StreamParser::Name: {
+        auto word = syntax.GetWord();
+        AddNameParam(word.Mid(1, word.GetLength() - 1));
         break;
+      }
       default:
         AddObjectParam(syntax.GetObject());
     }