4 files changed, 28 insertions, 4 deletions
diff --git a/core/include/fxcrt/fx_string.h b/core/include/fxcrt/fx_string.h
index a7cf2e1c16..1efb814b08 100644
--- a/core/include/fxcrt/fx_string.h
+++ b/core/include/fxcrt/fx_string.h
@@ -320,6 +320,8 @@ public:
 
     FX_LPSTR				GetBuffer(FX_STRSIZE len);
 
+    FX_LPSTR				LockBuffer();
+
     void					ReleaseBuffer(FX_STRSIZE len = -1);
 
     CFX_ByteString			Mid(FX_STRSIZE first) const;
@@ -728,6 +730,8 @@ public:
 
     FX_LPWSTR				GetBuffer(FX_STRSIZE len);
 
+    FX_LPWSTR				LockBuffer();
+
     void					ReleaseBuffer(FX_STRSIZE len = -1);
 
     int						GetInteger() const;
diff --git a/core/src/fpdfdoc/doc_bookmark.cpp b/core/src/fpdfdoc/doc_bookmark.cpp
index 88dcf21be1..9814de61bf 100644
--- a/core/src/fpdfdoc/doc_bookmark.cpp
+++ b/core/src/fpdfdoc/doc_bookmark.cpp
@@ -55,13 +55,15 @@ CFX_WideString CPDF_Bookmark::GetTitle() const
         return CFX_WideString();
     }
     CFX_WideString title = pString->GetUnicodeText();
+    FX_LPWSTR buf = title.LockBuffer();
     int len = title.GetLength();
-    FX_WCHAR buf[len];
     for (int i = 0; i < len; i++) {
-        FX_WCHAR w = title[i];
-        buf[i] = w > 0x20 ? w : 0x20;
+        if (buf[i] < 0x20) {
+            buf[i] = 0x20;
+        }
     }
-    return CFX_WideString(buf, len);
+    title.ReleaseBuffer(len);
+    return title;
 }
 CPDF_Dest CPDF_Bookmark::GetDest(CPDF_Document* pDocument) const
 {
diff --git a/core/src/fxcrt/fx_basic_bstring.cpp b/core/src/fxcrt/fx_basic_bstring.cpp
index 961aebe69c..cda7d1fdd7 100644
--- a/core/src/fxcrt/fx_basic_bstring.cpp
+++ b/core/src/fxcrt/fx_basic_bstring.cpp
@@ -341,6 +341,15 @@ void CFX_ByteString::ReleaseBuffer(FX_STRSIZE nNewLength)
     m_pData->m_nDataLength = nNewLength;
     m_pData->m_String[nNewLength] = 0;
 }
+FX_LPSTR CFX_ByteString::LockBuffer()
+{
+    if (m_pData == NULL) {
+        return NULL;
+    }
+    FX_LPSTR lpsz = GetBuffer(0);
+    m_pData->m_nRefs = -1;
+    return lpsz;
+}
 void CFX_ByteString::Reserve(FX_STRSIZE len)
 {
     GetBuffer(len);
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index 2ea23e4f19..e255aa0779 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -535,6 +535,15 @@ int CFX_WideString::Compare(const CFX_WideString& str) const
     }
     return 0;
 }
+FX_LPWSTR CFX_WideString::LockBuffer()
+{
+    if (m_pData == NULL) {
+        return NULL;
+    }
+    FX_LPWSTR lpsz = GetBuffer(0);
+    m_pData->m_nRefs = -1;
+    return lpsz;
+}
 void CFX_WideString::SetAt(FX_STRSIZE nIndex, FX_WCHAR ch)
 {
     if (m_pData == NULL) {