1 files changed, 11 insertions, 9 deletions
diff --git a/fxjs/xfa/cjx_hostpseudomodel.cpp b/fxjs/xfa/cjx_hostpseudomodel.cpp
index 6ca431e78d..fe26d3161d 100644
--- a/fxjs/xfa/cjx_hostpseudomodel.cpp
+++ b/fxjs/xfa/cjx_hostpseudomodel.cpp
@@ -29,16 +29,18 @@ int32_t FilterName(const WideStringView& wsExpression,
   if (nStart >= iLength)
     return iLength;
 
-  wchar_t* pBuf = wsFilter.GetBuffer(iLength - nStart);
   int32_t nCount = 0;
-  const wchar_t* pSrc = wsExpression.unterminated_c_str();
-  wchar_t wCur;
-  while (nStart < iLength) {
-    wCur = pSrc[nStart++];
-    if (wCur == ',')
-      break;
-
-    pBuf[nCount++] = wCur;
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<wchar_t> pBuf = wsFilter.GetBuffer(iLength - nStart);
+    const wchar_t* pSrc = wsExpression.unterminated_c_str();
+    while (nStart < iLength) {
+      wchar_t wCur = pSrc[nStart++];
+      if (wCur == ',')
+        break;
+
+      pBuf[nCount++] = wCur;
+    }
   }
   wsFilter.ReleaseBuffer(nCount);
   wsFilter.Trim();