6 files changed, 9 insertions, 8 deletions
diff --git a/xfa/fxfa/parser/cscript_hostpseudomodel.cpp b/xfa/fxfa/parser/cscript_hostpseudomodel.cpp
index b229b23151..d9eb5d699f 100644
--- a/xfa/fxfa/parser/cscript_hostpseudomodel.cpp
+++ b/xfa/fxfa/parser/cscript_hostpseudomodel.cpp
@@ -325,7 +325,7 @@ static int32_t XFA_FilterName(const CFX_WideStringC& wsExpression,
   }
   wchar_t* pBuf = wsFilter.GetBuffer(iLength - nStart);
   int32_t nCount = 0;
-  const wchar_t* pSrc = wsExpression.c_str();
+  const wchar_t* pSrc = wsExpression.unterminated_c_str();
   wchar_t wCur;
   while (nStart < iLength) {
     wCur = pSrc[nStart++];
diff --git a/xfa/fxfa/parser/cxfa_data.cpp b/xfa/fxfa/parser/cxfa_data.cpp
index bdfc25c79c..7bf18a5d3e 100644
--- a/xfa/fxfa/parser/cxfa_data.cpp
+++ b/xfa/fxfa/parser/cxfa_data.cpp
@@ -17,7 +17,7 @@ FX_ARGB CXFA_Data::ToColor(const CFX_WideStringC& wsValue) {
     return 0xff000000;
 
   int cc = 0;
-  const wchar_t* str = wsValue.c_str();
+  const wchar_t* str = wsValue.unterminated_c_str();
   int len = wsValue.GetLength();
   while (FXSYS_iswspace(str[cc]) && cc < len)
     cc++;
diff --git a/xfa/fxfa/parser/cxfa_itemlayoutprocessor.cpp b/xfa/fxfa/parser/cxfa_itemlayoutprocessor.cpp
index b6e6e7f8e9..694b24dc27 100644
--- a/xfa/fxfa/parser/cxfa_itemlayoutprocessor.cpp
+++ b/xfa/fxfa/parser/cxfa_itemlayoutprocessor.cpp
@@ -1748,7 +1748,7 @@ void CXFA_ItemLayoutProcessor::DoLayoutTableContainer(CXFA_Node* pLayoutNode) {
                               : containerSize.width - fLeftInset - fRightInset;
   CFX_WideStringC wsColumnWidths;
   if (pLayoutNode->TryCData(XFA_ATTRIBUTE_ColumnWidths, wsColumnWidths)) {
-    auto widths = SeparateStringW(wsColumnWidths.c_str(),
+    auto widths = SeparateStringW(wsColumnWidths.unterminated_c_str(),
                                   wsColumnWidths.GetLength(), L' ');
     for (auto& width : widths) {
       width.TrimLeft(L' ');
diff --git a/xfa/fxfa/parser/cxfa_measurement.cpp b/xfa/fxfa/parser/cxfa_measurement.cpp
index 9173223d3c..70420d7b5e 100644
--- a/xfa/fxfa/parser/cxfa_measurement.cpp
+++ b/xfa/fxfa/parser/cxfa_measurement.cpp
@@ -28,7 +28,7 @@ void CXFA_Measurement::Set(const CFX_WideStringC& wsMeasure) {
   }
   int32_t iUsedLen = 0;
   int32_t iOffset = (wsMeasure.GetAt(0) == L'=') ? 1 : 0;
-  float fValue = FXSYS_wcstof(wsMeasure.c_str() + iOffset,
+  float fValue = FXSYS_wcstof(wsMeasure.unterminated_c_str() + iOffset,
                               wsMeasure.GetLength() - iOffset, &iUsedLen);
   XFA_UNIT eUnit = GetUnit(wsMeasure.Mid(iOffset + iUsedLen));
   Set(fValue, eUnit);
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index 845d3f379d..5c4f8d102e 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -3591,7 +3591,7 @@ bool CXFA_Node::SetAttribute(XFA_ATTRIBUTE eAttr,
       return SetBoolean(pAttr->eName, wsValue != L"0", bNotify);
     case XFA_ATTRIBUTETYPE_Integer:
       return SetInteger(pAttr->eName,
-                        FXSYS_round(FXSYS_wcstof(wsValue.c_str(),
+                        FXSYS_round(FXSYS_wcstof(wsValue.unterminated_c_str(),
                                                  wsValue.GetLength(), nullptr)),
                         bNotify);
     case XFA_ATTRIBUTETYPE_Measure:
@@ -4554,7 +4554,8 @@ bool CXFA_Node::RemoveChild(CXFA_Node* pNode, bool bNotify) {
             static_cast<CFX_XMLElement*>(pNode->m_pXMLNode);
         CFX_WideStringC wsAttributeName =
             pNode->GetCData(XFA_ATTRIBUTE_QualifiedName);
-        pXMLElement->RemoveAttribute(wsAttributeName.c_str());
+        // TODO(tsepez): check usage of c_str() below.
+        pXMLElement->RemoveAttribute(wsAttributeName.unterminated_c_str());
       }
       CFX_WideString wsName;
       pNode->GetAttribute(XFA_ATTRIBUTE_Name, wsName, false);
@@ -4850,7 +4851,7 @@ bool CXFA_Node::GetMapModuleValue(void* pKey, void*& pValue) {
 }
 
 void CXFA_Node::SetMapModuleString(void* pKey, const CFX_WideStringC& wsValue) {
-  SetMapModuleBuffer(pKey, (void*)wsValue.c_str(),
+  SetMapModuleBuffer(pKey, (void*)wsValue.unterminated_c_str(),
                      wsValue.GetLength() * sizeof(wchar_t));
 }
 
diff --git a/xfa/fxfa/parser/cxfa_resolveprocessor.cpp b/xfa/fxfa/parser/cxfa_resolveprocessor.cpp
index add8cb8fcb..93b2d86061 100644
--- a/xfa/fxfa/parser/cxfa_resolveprocessor.cpp
+++ b/xfa/fxfa/parser/cxfa_resolveprocessor.cpp
@@ -502,7 +502,7 @@ int32_t CXFA_ResolveProcessor::GetFilter(const CFX_WideStringC& wsExpression,
   int32_t nConditionCount = 0;
   std::vector<int32_t> stack;
   int32_t nType = -1;
-  const wchar_t* pSrc = wsExpression.c_str();
+  const wchar_t* pSrc = wsExpression.unterminated_c_str();
   wchar_t wPrev = 0, wCur;
   bool bIsCondition = false;
   while (nStart < iLength) {