1 files changed, 10 insertions, 6 deletions
diff --git a/fxjs/cfxjse_formcalc_context.cpp b/fxjs/cfxjse_formcalc_context.cpp
index 85d0ef8d57..a6d151b468 100644
--- a/fxjs/cfxjse_formcalc_context.cpp
+++ b/fxjs/cfxjse_formcalc_context.cpp
@@ -509,12 +509,16 @@ ByteString GUIDString(bool bSeparator) {
   data[6] = (data[6] & 0x0F) | 0x40;
 
   ByteString bsStr;
-  char* pBuf = bsStr.GetBuffer(40);
-  for (int32_t i = 0; i < 16; ++i, pBuf += 2) {
-    if (bSeparator && (i == 4 || i == 6 || i == 8 || i == 10))
-      *pBuf++ = L'-';
-
-    FXSYS_IntToTwoHexChars(data[i], pBuf);
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<char> pBuf = bsStr.GetBuffer(40);
+    size_t out_index = 0;
+    for (size_t i = 0; i < 16; ++i, out_index += 2) {
+      if (bSeparator && (i == 4 || i == 6 || i == 8 || i == 10))
+        pBuf[out_index++] = L'-';
+
+      FXSYS_IntToTwoHexChars(data[i], &pBuf[out_index]);
+    }
   }
   bsStr.ReleaseBuffer(bSeparator ? 36 : 32);
   return bsStr;