2 files changed, 16 insertions, 5 deletions
diff --git a/xfa/fde/css/cfde_csstextbuf.cpp b/xfa/fde/css/cfde_csstextbuf.cpp
index c408a95b03..8ccdca9fed 100644
--- a/xfa/fde/css/cfde_csstextbuf.cpp
+++ b/xfa/fde/css/cfde_csstextbuf.cpp
@@ -10,6 +10,7 @@
 
 CFDE_CSSTextBuf::CFDE_CSSTextBuf()
     : m_bExtBuf(false),
+      m_pExtBuffer(nullptr),
       m_pBuffer(nullptr),
       m_iBufLen(0),
       m_iDatLen(0),
@@ -21,7 +22,7 @@ CFDE_CSSTextBuf::~CFDE_CSSTextBuf() {
 
 void CFDE_CSSTextBuf::AttachBuffer(const wchar_t* pBuffer, int32_t iBufLen) {
   Reset();
-  m_pBuffer = const_cast<wchar_t*>(pBuffer);
+  m_pExtBuffer = pBuffer;
   m_iDatLen = m_iBufLen = iBufLen;
   m_bExtBuf = true;
 }
@@ -36,6 +37,8 @@ bool CFDE_CSSTextBuf::EstimateSize(int32_t iAllocSize) {
 bool CFDE_CSSTextBuf::AppendChar(wchar_t wch) {
   if (m_iDatLen >= m_iBufLen && !ExpandBuf(m_iBufLen * 2))
     return false;
+
+  ASSERT(!m_bExtBuf);
   m_pBuffer[m_iDatLen++] = wch;
   return true;
 }
@@ -49,12 +52,17 @@ void CFDE_CSSTextBuf::Reset() {
 }
 
 int32_t CFDE_CSSTextBuf::TrimEnd() {
+  ASSERT(!m_bExtBuf);
   while (m_iDatLen > 0 && m_pBuffer[m_iDatLen - 1] <= ' ')
     --m_iDatLen;
   AppendChar(0);
   return --m_iDatLen;
 }
 
+const wchar_t* CFDE_CSSTextBuf::GetBuffer() const {
+  return m_bExtBuf ? m_pExtBuffer : m_pBuffer;
+}
+
 bool CFDE_CSSTextBuf::ExpandBuf(int32_t iDesiredSize) {
   if (m_bExtBuf)
     return false;
@@ -73,6 +81,7 @@ bool CFDE_CSSTextBuf::ExpandBuf(int32_t iDesiredSize) {
 
 void CFDE_CSSTextBuf::Subtract(int32_t iStart, int32_t iLength) {
   ASSERT(iStart >= 0 && iLength >= 0);
+  ASSERT(!m_bExtBuf);
 
   iLength = pdfium::clamp(iLength, 0, m_iDatLen - iStart);
   memmove(m_pBuffer, m_pBuffer + iStart, iLength * sizeof(wchar_t));
diff --git a/xfa/fde/css/cfde_csstextbuf.h b/xfa/fde/css/cfde_csstextbuf.h
index eaeb085971..be6800fe3a 100644
--- a/xfa/fde/css/cfde_csstextbuf.h
+++ b/xfa/fde/css/cfde_csstextbuf.h
@@ -29,20 +29,22 @@ class CFDE_CSSTextBuf {
   void Subtract(int32_t iStart, int32_t iLength);
   bool IsEOF() const { return m_iDatPos >= m_iDatLen; }
 
-  wchar_t GetAt(int32_t index) const { return m_pBuffer[index]; }
-  wchar_t GetChar() const { return m_pBuffer[m_iDatPos]; }
+  wchar_t GetAt(int32_t index) const { return GetBuffer()[index]; }
+  wchar_t GetChar() const { return GetBuffer()[m_iDatPos]; }
   wchar_t GetNextChar() const {
-    return (m_iDatPos + 1 >= m_iDatLen) ? 0 : m_pBuffer[m_iDatPos + 1];
+    return (m_iDatPos + 1 >= m_iDatLen) ? 0 : GetBuffer()[m_iDatPos + 1];
   }
 
   void MoveNext() { m_iDatPos++; }
 
   int32_t GetLength() const { return m_iDatLen; }
-  const wchar_t* GetBuffer() const { return m_pBuffer; }
+  const wchar_t* GetBuffer() const;
 
  protected:
   bool ExpandBuf(int32_t iDesiredSize);
+
   bool m_bExtBuf;
+  const wchar_t* m_pExtBuffer;
   wchar_t* m_pBuffer;
   int32_t m_iBufLen;
   int32_t m_iDatLen;