4 files changed, 15 insertions, 10 deletions
diff --git a/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp b/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp
index a3f4ce9519..e3565835c3 100644
--- a/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp
+++ b/xfa/fxfa/parser/cxfa_layoutpagemgr.cpp
@@ -162,7 +162,7 @@ CXFA_Node* ResolveBreakTarget(CXFA_Node* pPageSetRoot,
     if (wsExpr.GetAt(0) == '#') {
       CXFA_Node* pNode = pDocument->GetNodeByID(
           ToNode(pDocument->GetXFAObject(XFA_HASHCODE_Template)),
-          wsExpr.Mid(1).AsStringC());
+          wsExpr.Mid(1, wsExpr.GetLength() - 1).AsStringC());
       if (pNode)
         return pNode;
     } else if (bNewExprStyle) {
diff --git a/xfa/fxfa/parser/cxfa_measurement.cpp b/xfa/fxfa/parser/cxfa_measurement.cpp
index f161e49e49..50076583bb 100644
--- a/xfa/fxfa/parser/cxfa_measurement.cpp
+++ b/xfa/fxfa/parser/cxfa_measurement.cpp
@@ -40,7 +40,8 @@ void CXFA_Measurement::SetString(const CFX_WideStringC& wsMeasure) {
   int32_t iOffset = (wsMeasure.GetAt(0) == L'=') ? 1 : 0;
   float fValue = FXSYS_wcstof(wsMeasure.unterminated_c_str() + iOffset,
                               wsMeasure.GetLength() - iOffset, &iUsedLen);
-  XFA_UNIT eUnit = GetUnitFromString(wsMeasure.Mid(iOffset + iUsedLen));
+  XFA_UNIT eUnit = GetUnitFromString(wsMeasure.Mid(
+      iOffset + iUsedLen, wsMeasure.GetLength() - (iOffset + iUsedLen)));
   Set(fValue, eUnit);
 }
 
diff --git a/xfa/fxfa/parser/cxfa_node.cpp b/xfa/fxfa/parser/cxfa_node.cpp
index eac7ac04b0..1265988902 100644
--- a/xfa/fxfa/parser/cxfa_node.cpp
+++ b/xfa/fxfa/parser/cxfa_node.cpp
@@ -77,7 +77,7 @@ int32_t GetCount(CXFA_Node* pInstMgrNode) {
       CFX_WideStringC wsName = pNode->GetCData(XFA_ATTRIBUTE_Name);
       CFX_WideStringC wsInstName = pInstMgrNode->GetCData(XFA_ATTRIBUTE_Name);
       if (wsInstName.GetLength() < 1 || wsInstName.GetAt(0) != '_' ||
-          wsInstName.Mid(1) != wsName) {
+          wsInstName.Mid(1, wsInstName.GetLength() - 1) != wsName) {
         return iCount;
       }
       dwNameHash = pNode->GetNameHash();
@@ -198,7 +198,7 @@ CXFA_Node* GetItem(CXFA_Node* pInstMgrNode, int32_t iIndex) {
       CFX_WideStringC wsName = pNode->GetCData(XFA_ATTRIBUTE_Name);
       CFX_WideStringC wsInstName = pInstMgrNode->GetCData(XFA_ATTRIBUTE_Name);
       if (wsInstName.GetLength() < 1 || wsInstName.GetAt(0) != '_' ||
-          wsInstName.Mid(1) != wsName) {
+          wsInstName.Mid(1, wsInstName.GetLength() - 1) != wsName) {
         return nullptr;
       }
       dwNameHash = pNode->GetNameHash();
@@ -2737,7 +2737,7 @@ void CXFA_Node::Script_Subform_InstanceManager(CFXJSE_Value* pValue,
     if (pNode->GetElementType() == XFA_Element::InstanceManager) {
       CFX_WideStringC wsInstMgrName = pNode->GetCData(XFA_ATTRIBUTE_Name);
       if (wsInstMgrName.GetLength() >= 1 && wsInstMgrName.GetAt(0) == '_' &&
-          wsInstMgrName.Mid(1) == wsName) {
+          wsInstMgrName.Mid(1, wsInstMgrName.GetLength() - 1) == wsName) {
         pInstanceMgr = pNode;
       }
       break;
@@ -3162,9 +3162,10 @@ int32_t CXFA_Node::InstanceManager_SetInstances(int32_t iDesired) {
   }
   if (iDesired < iCount) {
     CFX_WideStringC wsInstManagerName = GetCData(XFA_ATTRIBUTE_Name);
-    CFX_WideString wsInstanceName =
-        CFX_WideString(wsInstManagerName.IsEmpty() ? wsInstManagerName
-                                                   : wsInstManagerName.Mid(1));
+    CFX_WideString wsInstanceName = CFX_WideString(
+        wsInstManagerName.IsEmpty()
+            ? wsInstManagerName
+            : wsInstManagerName.Mid(1, wsInstManagerName.GetLength() - 1));
     uint32_t dInstanceNameHash =
         FX_HashCode_GetW(wsInstanceName.AsStringC(), false);
     CXFA_Node* pPrevSibling =
@@ -4664,7 +4665,7 @@ CXFA_Node* CXFA_Node::GetInstanceMgrOfSubform() {
         CFX_WideStringC wsName = GetCData(XFA_ATTRIBUTE_Name);
         CFX_WideStringC wsInstName = pNode->GetCData(XFA_ATTRIBUTE_Name);
         if (wsInstName.GetLength() > 0 && wsInstName.GetAt(0) == '_' &&
-            wsInstName.Mid(1) == wsName) {
+            wsInstName.Mid(1, wsInstName.GetLength() - 1) == wsName) {
           pInstanceMgr = pNode;
         }
         break;
diff --git a/xfa/fxfa/parser/cxfa_widgetdata.cpp b/xfa/fxfa/parser/cxfa_widgetdata.cpp
index cbe0d14c91..1920e9f3fd 100644
--- a/xfa/fxfa/parser/cxfa_widgetdata.cpp
+++ b/xfa/fxfa/parser/cxfa_widgetdata.cpp
@@ -1323,7 +1323,10 @@ bool CXFA_WidgetData::GetBarcodeAttribute_WideNarrowRatio(float* val) {
     } else {
       int32_t fA, fB;
       fA = FXSYS_wtoi(wsWideNarrowRatio.Left(ptPos).c_str());
-      fB = FXSYS_wtoi(wsWideNarrowRatio.Mid(ptPos + 1).c_str());
+      fB = FXSYS_wtoi(
+          wsWideNarrowRatio
+              .Mid(ptPos + 1, wsWideNarrowRatio.GetLength() - (ptPos + 1))
+              .c_str());
       if (fB)
         fRatio = (float)fA / fB;
     }