4 files changed, 10 insertions, 6 deletions
diff --git a/core/fxcodec/codec/ccodec_pngmodule.cpp b/core/fxcodec/codec/ccodec_pngmodule.cpp
index 0531ff10b1..40bdfba7ce 100644
--- a/core/fxcodec/codec/ccodec_pngmodule.cpp
+++ b/core/fxcodec/codec/ccodec_pngmodule.cpp
@@ -183,8 +183,8 @@ static void _png_get_row_func(png_structp png_ptr,
   if (!pContext)
     return;
 
-  uint8_t* src_buf = nullptr;
-  if (!pContext->m_pDelegate->PngAskScanlineBuf(row_num, src_buf))
+  uint8_t* src_buf;
+  if (!pContext->m_pDelegate->PngAskScanlineBuf(row_num, &src_buf))
     png_error(png_ptr, "Ask Scanline buffer Callback Error");
 
   if (src_buf)
diff --git a/core/fxcodec/codec/ccodec_pngmodule.h b/core/fxcodec/codec/ccodec_pngmodule.h
index 121e646a86..847f67e8eb 100644
--- a/core/fxcodec/codec/ccodec_pngmodule.h
+++ b/core/fxcodec/codec/ccodec_pngmodule.h
@@ -28,7 +28,11 @@ class CCodec_PngModule {
                                int pass,
                                int* color_type,
                                double* gamma) = 0;
-    virtual bool PngAskScanlineBuf(int line, uint8_t*& src_buf) = 0;
+
+    // Returns true on success. |pSrcBuf| will be set if this succeeds.
+    // |pSrcBuf| does not take ownership of the buffer.
+    virtual bool PngAskScanlineBuf(int line, uint8_t** pSrcBuf) = 0;
+
     virtual void PngFillScanlineBufCompleted(int pass, int line) = 0;
   };
 
diff --git a/core/fxcodec/codec/ccodec_progressivedecoder.h b/core/fxcodec/codec/ccodec_progressivedecoder.h
index 05b7c92078..ea51429688 100644
--- a/core/fxcodec/codec/ccodec_progressivedecoder.h
+++ b/core/fxcodec/codec/ccodec_progressivedecoder.h
@@ -131,7 +131,7 @@ class CCodec_ProgressiveDecoder : public CCodec_BmpModule::Delegate,
                      int pass,
                      int* color_type,
                      double* gamma) override;
-  bool PngAskScanlineBuf(int line, uint8_t*& src_buf) override;
+  bool PngAskScanlineBuf(int line, uint8_t** pSrcBuf) override;
   void PngFillScanlineBufCompleted(int pass, int line) override;
 
   // CCodec_GifModule::Delegate
diff --git a/core/fxcodec/codec/fx_codec_progress.cpp b/core/fxcodec/codec/fx_codec_progress.cpp
index 746a574bbc..f20e18c06b 100644
--- a/core/fxcodec/codec/fx_codec_progress.cpp
+++ b/core/fxcodec/codec/fx_codec_progress.cpp
@@ -395,7 +395,7 @@ bool CCodec_ProgressiveDecoder::PngReadHeader(int width,
   return true;
 }
 
-bool CCodec_ProgressiveDecoder::PngAskScanlineBuf(int line, uint8_t*& src_buf) {
+bool CCodec_ProgressiveDecoder::PngAskScanlineBuf(int line, uint8_t** pSrcBuf) {
   RetainPtr<CFX_DIBitmap> pDIBitmap = m_pDeviceBitmap;
   if (!pDIBitmap) {
     NOTREACHED();
@@ -406,7 +406,7 @@ bool CCodec_ProgressiveDecoder::PngAskScanlineBuf(int line, uint8_t*& src_buf) {
     int32_t row = (int32_t)((line - m_clipBox.top) * scale_y) + m_startY;
     uint8_t* src_scan = (uint8_t*)pDIBitmap->GetScanline(row);
     uint8_t* des_scan = m_pDecodeBuf;
-    src_buf = m_pDecodeBuf;
+    *pSrcBuf = m_pDecodeBuf;
     int32_t src_Bpp = pDIBitmap->GetBPP() >> 3;
     int32_t des_Bpp = (m_SrcFormat & 0xff) >> 3;
     int32_t src_left = m_startX;