2 files changed, 29 insertions, 32 deletions

diff --git a/xfa/fgas/layout/fgas_rtfbreak.cpp b/xfa/fgas/layout/fgas_rtfbreak.cpp
index dd3f34c739..fdc9a57038 100644
--- a/xfa/fgas/layout/fgas_rtfbreak.cpp
+++ b/xfa/fgas/layout/fgas_rtfbreak.cpp
@@ -882,11 +882,8 @@ int32_t CFX_RTFBreak::GetDisplayPos(const FX_RTFTEXTOBJ* pText,
   if (!pText || pText->iLength < 1)
     return 0;
 
-  ASSERT(pText->pStr && pText->pWidths && pText->pFont && pText->pRect);
+  ASSERT(pText->pFont && pText->pRect);
 
-  const FX_WCHAR* pStr = pText->pStr;
-  int32_t* pWidths = pText->pWidths;
-  int32_t iLength = pText->iLength - 1;
   CFX_RetainPtr<CFGAS_GEFont> pFont = pText->pFont;
   CFX_RectF rtText(*pText->pRect);
   bool bRTLPiece = FX_IsOdd(pText->iBidiLevel);
@@ -920,9 +917,9 @@ int32_t CFX_RTFBreak::GetDisplayPos(const FX_RTFTEXTOBJ* pText,
 
   fY += fAscent;
   int32_t iCount = 0;
-  for (int32_t i = 0; i <= iLength; i++) {
-    wch = *pStr++;
-    iWidth = *pWidths++;
+  for (int32_t i = 0; i < pText->iLength; i++) {
+    wch = pText->pStr[i];
+    iWidth = pText->pWidths[i];
     dwProps = FX_GetUnicodeProperties(wch);
     dwCharType = (dwProps & FX_CHARTYPEBITSMASK);
     if (dwCharType == FX_CHARTYPE_ArabicAlef && iWidth == 0) {
@@ -942,10 +939,10 @@ int32_t CFX_RTFBreak::GetDisplayPos(const FX_RTFTEXTOBJ* pText,
       iCharWidth /= iFontSize;
       wForm = wch;
       if (dwCharType >= FX_CHARTYPE_ArabicAlef) {
-        if (i < iLength) {
-          wNext = *pStr;
-          if (*pWidths < 0 && i + 1 < iLength)
-            wNext = pStr[1];
+        if (i + 1 < pText->iLength) {
+          wNext = pText->pStr[i + 1];
+          if (pText->pWidths[i + 1] < 0 && i + 2 < pText->iLength)
+            wNext = pText->pStr[i + 2];
         } else {
           wNext = 0xFEFF;
         }
@@ -1040,14 +1037,12 @@ CFX_RTFLine::~CFX_RTFLine() {
 }
 
 FX_RTFTEXTOBJ::FX_RTFTEXTOBJ()
-    : pStr(nullptr),
-      pWidths(nullptr),
-      iLength(0),
-      pFont(nullptr),
-      fFontSize(12.0f),
-      iBidiLevel(0),
+    : pFont(nullptr),
       pRect(nullptr),
       wLineBreakChar(L'\n'),
+      fFontSize(12.0f),
+      iLength(0),
+      iBidiLevel(0),
       iHorizontalScale(100),
       iVerticalScale(100) {}
 
diff --git a/xfa/fgas/layout/fgas_rtfbreak.h b/xfa/fgas/layout/fgas_rtfbreak.h
index 81ec60ee48..55b99ae298 100644
--- a/xfa/fgas/layout/fgas_rtfbreak.h
+++ b/xfa/fgas/layout/fgas_rtfbreak.h
@@ -33,14 +33,14 @@ struct FX_RTFTEXTOBJ {
   FX_RTFTEXTOBJ();
   ~FX_RTFTEXTOBJ();
 
-  const FX_WCHAR* pStr;
-  int32_t* pWidths;
-  int32_t iLength;
+  CFX_WideString pStr;
+  std::vector<int32_t> pWidths;
   CFX_RetainPtr<CFGAS_GEFont> pFont;
-  FX_FLOAT fFontSize;
-  int32_t iBidiLevel;
   const CFX_RectF* pRect;
   FX_WCHAR wLineBreakChar;
+  FX_FLOAT fFontSize;
+  int32_t iLength;
+  int32_t iBidiLevel;
   int32_t iHorizontalScale;
   int32_t iVerticalScale;
 };
@@ -59,18 +59,20 @@ class CFX_RTFPiece {
     return (*m_pChars)[m_iStartChar + index];
   }
 
-  void GetString(FX_WCHAR* pText) const {
-    ASSERT(pText);
-    int32_t iEndChar = m_iStartChar + m_iChars;
-    for (int32_t i = m_iStartChar; i < iEndChar; i++)
-      *pText++ = static_cast<FX_WCHAR>((*m_pChars)[i].m_wCharCode);
+  CFX_WideString GetString() const {
+    CFX_WideString ret;
+    ret.Reserve(m_iChars);
+    for (int32_t i = m_iStartChar; i < m_iStartChar + m_iChars; i++)
+      ret += static_cast<FX_WCHAR>((*m_pChars)[i].m_wCharCode);
+    return ret;
   }
 
-  void GetWidths(int32_t* pWidths) const {
-    ASSERT(pWidths);
-    int32_t iEndChar = m_iStartChar + m_iChars;
-    for (int32_t i = m_iStartChar; i < iEndChar; i++)
-      *pWidths++ = (*m_pChars)[i].m_iCharWidth;
+  std::vector<int32_t> GetWidths() const {
+    std::vector<int32_t> ret;
+    ret.reserve(m_iChars);
+    for (int32_t i = m_iStartChar; i < m_iStartChar + m_iChars; i++)
+      ret.push_back((*m_pChars)[i].m_iCharWidth);
+    return ret;
   }
 
   void Reset() {