2 files changed, 9 insertions, 2 deletions
diff --git a/core/src/fxcrt/fx_basic_bstring.cpp b/core/src/fxcrt/fx_basic_bstring.cpp
index 2c8f7a766b..9cf084c2fb 100644
--- a/core/src/fxcrt/fx_basic_bstring.cpp
+++ b/core/src/fxcrt/fx_basic_bstring.cpp
@@ -4,6 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
+#include <stddef.h>  // For offsetof().
+
 #include "../../include/fxcrt/fx_basic.h"
 #include "../../../third_party/base/numerics/safe_math.h"
 
@@ -53,7 +55,9 @@ static CFX_StringData* FX_AllocString(int nLen)
         return NULL;
     }
 
-    int overhead = sizeof(long) * 3 + 1;  // 3 longs in header plus 1 for NUL.
+    // Fixed portion of header plus a NUL char not included in m_nAllocLength.
+    // sizeof(FX_CHAR) is always 1, used for consistency with CFX_Widestring.
+    int overhead = offsetof(CFX_StringData, m_String) + sizeof(FX_CHAR);
     pdfium::base::CheckedNumeric<int> nSize = nLen;
     nSize += overhead;
 
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index 42a7ad72a6..742f249e37 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -4,6 +4,8 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
+#include <stddef.h>  // For offsetof().
+
 #include "../../include/fxcrt/fx_basic.h"
 #include "../../../third_party/base/numerics/safe_math.h"
 
@@ -15,7 +17,8 @@ static CFX_StringDataW* FX_AllocStringW(int nLen)
         return NULL;
     }
 
-    int overhead = 3 * sizeof(long) + sizeof(FX_WCHAR);  // +WCHAR is for NUL.
+    // Fixed portion of header plus a NUL wide char not in m_nAllocLength.
+    int overhead = offsetof(CFX_StringDataW, m_String) + sizeof(FX_WCHAR);
     pdfium::base::CheckedNumeric<int> iSize = nLen;
     iSize *= sizeof(FX_WCHAR);
     iSize += overhead;