1 files changed, 40 insertions, 33 deletions

diff --git a/core/fxcodec/codec/fx_codec.cpp b/core/fxcodec/codec/fx_codec.cpp
index 1a21c92415..efae53908e 100644
--- a/core/fxcodec/codec/fx_codec.cpp
+++ b/core/fxcodec/codec/fx_codec.cpp
@@ -1357,19 +1357,18 @@ CCodec_ModuleMgr::CCodec_ModuleMgr()
 
 CCodec_ModuleMgr::~CCodec_ModuleMgr() {}
 
-bool CCodec_BasicModule::RunLengthEncode(const uint8_t* src_buf,
-                                         uint32_t src_size,
+bool CCodec_BasicModule::RunLengthEncode(pdfium::span<const uint8_t> src_span,
                                          uint8_t** dest_buf,
                                          uint32_t* dest_size) {
   // Check inputs
-  if (!src_buf || !dest_buf || !dest_size || src_size == 0)
+  if (src_span.empty() || !dest_buf || !dest_size)
     return false;
 
   // Edge case
-  if (src_size == 1) {
+  if (src_span.size() == 1) {
     *dest_buf = FX_Alloc(uint8_t, 3);
     (*dest_buf)[0] = 0;
-    (*dest_buf)[1] = src_buf[0];
+    (*dest_buf)[1] = src_span[0];
     (*dest_buf)[2] = 128;
     *dest_size = 3;
     return true;
@@ -1378,25 +1377,29 @@ bool CCodec_BasicModule::RunLengthEncode(const uint8_t* src_buf,
   // Worst case: 1 nonmatch, 2 match, 1 nonmatch, 2 match, etc. This becomes
   // 4 output chars for every 3 input, plus up to 4 more for the 1-2 chars
   // rounded off plus the terminating character.
-  uint32_t est_size = 4 * ((src_size + 2) / 3) + 1;
-  *dest_buf = FX_Alloc(uint8_t, est_size);
+  FX_SAFE_SIZE_T estimated_size = src_span.size();
+  estimated_size += 2;
+  estimated_size /= 3;
+  estimated_size *= 4;
+  estimated_size += 1;
+  *dest_buf = FX_Alloc(uint8_t, estimated_size.ValueOrDie());
 
   // Set up pointers.
   uint8_t* out = *dest_buf;
   uint32_t run_start = 0;
   uint32_t run_end = 1;
-  uint8_t x = src_buf[run_start];
-  uint8_t y = src_buf[run_end];
-  while (run_end < src_size) {
-    uint32_t max_len = std::min((uint32_t)128, src_size - run_start);
+  uint8_t x = src_span[run_start];
+  uint8_t y = src_span[run_end];
+  while (run_end < src_span.size()) {
+    size_t max_len = std::min<size_t>(128, src_span.size() - run_start);
     while (x == y && (run_end - run_start < max_len - 1))
-      y = src_buf[++run_end];
+      y = src_span[++run_end];
 
     // Reached end with matched run. Update variables to expected values.
     if (x == y) {
       run_end++;
-      if (run_end < src_size)
-        y = src_buf[run_end];
+      if (run_end < src_span.size())
+        y = src_span[run_end];
     }
     if (run_end - run_start > 1) {  // Matched run but not at end of input.
       out[0] = 257 - (run_end - run_start);
@@ -1404,8 +1407,8 @@ bool CCodec_BasicModule::RunLengthEncode(const uint8_t* src_buf,
       x = y;
       run_start = run_end;
       run_end++;
-      if (run_end < src_size)
-        y = src_buf[run_end];
+      if (run_end < src_span.size())
+        y = src_span[run_end];
       out += 2;
       continue;
     }
@@ -1414,20 +1417,20 @@ bool CCodec_BasicModule::RunLengthEncode(const uint8_t* src_buf,
       out[run_end - run_start] = x;
       x = y;
       run_end++;
-      if (run_end == src_size) {
+      if (run_end == src_span.size()) {
         if (run_end <= run_start + max_len) {
           out[run_end - run_start] = x;
           run_end++;
         }
         break;
       }
-      y = src_buf[run_end];
+      y = src_span[run_end];
     }
     out[0] = run_end - run_start - 2;
     out += run_end - run_start;
     run_start = run_end - 1;
   }
-  if (run_start < src_size) {  // 1 leftover character
+  if (run_start < src_span.size()) {  // 1 leftover character
     out[0] = 0;
     out[1] = x;
     out += 2;
@@ -1437,15 +1440,14 @@ bool CCodec_BasicModule::RunLengthEncode(const uint8_t* src_buf,
   return true;
 }
 
-bool CCodec_BasicModule::A85Encode(const uint8_t* src_buf,
-                                   uint32_t src_size,
+bool CCodec_BasicModule::A85Encode(pdfium::span<const uint8_t> src_span,
                                    uint8_t** dest_buf,
                                    uint32_t* dest_size) {
   // Check inputs.
-  if (!src_buf || !dest_buf || !dest_size)
+  if (!dest_buf || !dest_size)
     return false;
 
-  if (src_size == 0) {
+  if (src_span.empty()) {
     *dest_size = 0;
     return false;
   }
@@ -1453,18 +1455,23 @@ bool CCodec_BasicModule::A85Encode(const uint8_t* src_buf,
   // Worst case: 5 output for each 4 input (plus up to 4 from leftover), plus
   // 2 character new lines each 75 output chars plus 2 termination chars. May
   // have fewer if there are special "z" chars.
-  uint32_t est_size = 5 * (src_size / 4) + 4 + src_size / 30 + 2;
-  *dest_buf = FX_Alloc(uint8_t, est_size);
+  FX_SAFE_SIZE_T estimated_size = src_span.size();
+  estimated_size /= 4;
+  estimated_size *= 5;
+  estimated_size += 4;
+  estimated_size += src_span.size() / 30;
+  estimated_size += 2;
+  *dest_buf = FX_Alloc(uint8_t, estimated_size.ValueOrDie());
 
   // Set up pointers.
   uint8_t* out = *dest_buf;
   uint32_t pos = 0;
   uint32_t line_length = 0;
-  while (src_size >= 4 && pos < src_size - 3) {
-    uint32_t val = ((uint32_t)(src_buf[pos]) << 24) +
-                   ((uint32_t)(src_buf[pos + 1]) << 16) +
-                   ((uint32_t)(src_buf[pos + 2]) << 8) +
-                   (uint32_t)(src_buf[pos + 3]);
+  while (src_span.size() >= 4 && pos < src_span.size() - 3) {
+    uint32_t val = ((uint32_t)(src_span[pos]) << 24) +
+                   ((uint32_t)(src_span[pos + 1]) << 16) +
+                   ((uint32_t)(src_span[pos + 2]) << 8) +
+                   (uint32_t)(src_span[pos + 3]);
     pos += 4;
     if (val == 0) {  // All zero special case
       *out = 'z';
@@ -1484,11 +1491,11 @@ bool CCodec_BasicModule::A85Encode(const uint8_t* src_buf,
       line_length = 0;
     }
   }
-  if (pos < src_size) {  // Leftover bytes
+  if (pos < src_span.size()) {  // Leftover bytes
     uint32_t val = 0;
     int count = 0;
-    while (pos < src_size) {
-      val += (uint32_t)(src_buf[pos]) << (8 * (3 - count));
+    while (pos < src_span.size()) {
+      val += (uint32_t)(src_span[pos]) << (8 * (3 - count));
       count++;
       pos++;
     }