1 files changed, 29 insertions, 26 deletions
diff --git a/core/fxcrt/cfx_blockbuffer.cpp b/core/fxcrt/cfx_blockbuffer.cpp
index 13134f0e7b..6a7d98aa18 100644
--- a/core/fxcrt/cfx_blockbuffer.cpp
+++ b/core/fxcrt/cfx_blockbuffer.cpp
@@ -77,36 +77,39 @@ WideString CFX_BlockBuffer::GetTextData(size_t start, size_t length) const {
   size_t maybeDataLength = m_BufferSize - 1 - m_StartPosition;
   if (start > maybeDataLength)
     return WideString();
-  length = std::min(length, maybeDataLength);
 
-  WideString wsTextData;
-  wchar_t* pBuf = wsTextData.GetBuffer(length);
-  if (!pBuf)
+  length = std::min(length, maybeDataLength);
+  if (!length)
     return WideString();
 
-  size_t startBlock = 0;
-  size_t startInner = 0;
-  std::tie(startBlock, startInner) = TextDataIndex2BufIndex(start);
-
-  size_t endBlock = 0;
-  size_t endInner = 0;
-  std::tie(endBlock, endInner) = TextDataIndex2BufIndex(start + length);
-
-  size_t pointer = 0;
-  for (size_t i = startBlock; i <= endBlock; ++i) {
-    size_t bufferPointer = 0;
-    size_t copyLength = kAllocStep;
-    if (i == startBlock) {
-      copyLength -= startInner;
-      bufferPointer = startInner;
+  WideString wsTextData;
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<wchar_t> pBuf = wsTextData.GetBuffer(length);
+    size_t startBlock = 0;
+    size_t startInner = 0;
+    std::tie(startBlock, startInner) = TextDataIndex2BufIndex(start);
+
+    size_t endBlock = 0;
+    size_t endInner = 0;
+    std::tie(endBlock, endInner) = TextDataIndex2BufIndex(start + length);
+
+    size_t pointer = 0;
+    for (size_t i = startBlock; i <= endBlock; ++i) {
+      size_t bufferPointer = 0;
+      size_t copyLength = kAllocStep;
+      if (i == startBlock) {
+        copyLength -= startInner;
+        bufferPointer = startInner;
+      }
+      if (i == endBlock)
+        copyLength -= ((kAllocStep - 1) - endInner);
+
+      wchar_t* pBlockBuf = m_BlockArray[i].get();
+      memcpy(&pBuf[pointer], pBlockBuf + bufferPointer,
+             copyLength * sizeof(wchar_t));
+      pointer += copyLength;
     }
-    if (i == endBlock)
-      copyLength -= ((kAllocStep - 1) - endInner);
-
-    wchar_t* pBlockBuf = m_BlockArray[i].get();
-    memcpy(pBuf + pointer, pBlockBuf + bufferPointer,
-           copyLength * sizeof(wchar_t));
-    pointer += copyLength;
   }
   wsTextData.ReleaseBuffer(length);
   return wsTextData;