From 53894390dba2ec571bab75157ebe60d11171ed07 Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Mon, 9 Apr 2018 18:30:24 +0000
Subject: Use pdfium::span<> in CFX_BitStream, CPDF_SimpleParser.

Get bounds checks in parsers automatically when using spans.

Change-Id: I71fbe7b838435d455376db2f89817d807a9cdcfd
Reviewed-on: https://pdfium-review.googlesource.com/29830
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
---
 core/fpdfapi/font/cpdf_cidfont.cpp                 |  2 +-
 core/fpdfapi/font/cpdf_cmap.cpp                    |  2 +-
 core/fpdfapi/font/cpdf_cmap.h                      |  3 +-
 core/fpdfapi/font/cpdf_tounicodemap.cpp            |  2 +-
 core/fpdfapi/page/cpdf_meshstream.cpp              |  5 +--
 core/fpdfapi/page/cpdf_psengine.cpp                |  4 +--
 core/fpdfapi/page/cpdf_psengine.h                  |  3 +-
 core/fpdfapi/page/cpdf_psfunc.cpp                  |  2 +-
 core/fpdfapi/parser/cpdf_hint_tables.cpp           |  3 +-
 core/fpdfapi/parser/cpdf_simple_parser.cpp         | 39 +++++++++++-----------
 core/fpdfapi/parser/cpdf_simple_parser.h           |  5 +--
 .../fpdfapi/parser/cpdf_simple_parser_unittest.cpp |  3 +-
 core/fpdfapi/parser/cpdf_stream_acc.cpp            | 16 +++------
 core/fpdfapi/parser/cpdf_stream_acc.h              | 11 +++---
 core/fpdfdoc/cpdf_defaultappearance.cpp            |  4 +--
 core/fpdfdoc/cpdf_defaultappearance_unittest.cpp   |  3 +-
 core/fxcrt/cfx_bitstream.cpp                       |  6 ++--
 core/fxcrt/cfx_bitstream.h                         |  3 +-
 testing/libfuzzer/pdf_cmap_fuzzer.cc               |  3 +-
 testing/libfuzzer/pdf_hint_table_fuzzer.cc         |  3 +-
 testing/libfuzzer/pdf_psengine_fuzzer.cc           |  3 +-
 21 files changed, 64 insertions(+), 61 deletions(-)

diff --git a/core/fpdfapi/font/cpdf_cidfont.cpp b/core/fpdfapi/font/cpdf_cidfont.cpp
index 4a96b0abcb..7de4d7cd82 100644
--- a/core/fpdfapi/font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/font/cpdf_cidfont.cpp
@@ -376,7 +376,7 @@ bool CPDF_CIDFont::Load() {
     auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
     pAcc->LoadAllDataFiltered();
     m_pCMap = pdfium::MakeRetain<CPDF_CMap>();
-    m_pCMap->LoadEmbedded(pAcc->GetDataView());
+    m_pCMap->LoadEmbedded(pAcc->GetSpan());
   } else {
     return false;
   }
diff --git a/core/fpdfapi/font/cpdf_cmap.cpp b/core/fpdfapi/font/cpdf_cmap.cpp
index e82e86b474..81ad63344c 100644
--- a/core/fpdfapi/font/cpdf_cmap.cpp
+++ b/core/fpdfapi/font/cpdf_cmap.cpp
@@ -290,7 +290,7 @@ void CPDF_CMap::LoadPredefined(CPDF_CMapManager* pMgr,
   m_bLoaded = true;
 }
 
-void CPDF_CMap::LoadEmbedded(const ByteStringView& data) {
+void CPDF_CMap::LoadEmbedded(pdfium::span<const uint8_t> data) {
   m_DirectCharcodeToCIDTable = std::vector<uint16_t>(65536);
   CPDF_CMapParser parser(this);
   CPDF_SimpleParser syntax(data);
diff --git a/core/fpdfapi/font/cpdf_cmap.h b/core/fpdfapi/font/cpdf_cmap.h
index 3ad74ca187..c6fdcae17b 100644
--- a/core/fpdfapi/font/cpdf_cmap.h
+++ b/core/fpdfapi/font/cpdf_cmap.h
@@ -11,6 +11,7 @@
 
 #include "core/fpdfapi/font/cpdf_cidfont.h"
 #include "core/fxcrt/retain_ptr.h"
+#include "third_party/base/span.h"
 
 class CPDF_CMapManager;
 struct FXCMAP_CMap;
@@ -53,7 +54,7 @@ class CPDF_CMap : public Retainable {
   void LoadPredefined(CPDF_CMapManager* pMgr,
                       const ByteString& name,
                       bool bPromptCJK);
-  void LoadEmbedded(const ByteStringView& data);
+  void LoadEmbedded(pdfium::span<const uint8_t> data);
 
   bool IsLoaded() const { return m_bLoaded; }
   bool IsVertWriting() const { return m_bVertical; }
diff --git a/core/fpdfapi/font/cpdf_tounicodemap.cpp b/core/fpdfapi/font/cpdf_tounicodemap.cpp
index 88904f27f5..f21c4a31f4 100644
--- a/core/fpdfapi/font/cpdf_tounicodemap.cpp
+++ b/core/fpdfapi/font/cpdf_tounicodemap.cpp
@@ -126,7 +126,7 @@ void CPDF_ToUnicodeMap::Load(CPDF_Stream* pStream) {
   CIDSet cid_set = CIDSET_UNKNOWN;
   auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pStream);
   pAcc->LoadAllDataFiltered();
-  CPDF_SimpleParser parser(pAcc->GetDataView());
+  CPDF_SimpleParser parser(pAcc->GetSpan());
   while (1) {
     ByteStringView word = parser.GetWord();
     if (word.IsEmpty()) {
diff --git a/core/fpdfapi/page/cpdf_meshstream.cpp b/core/fpdfapi/page/cpdf_meshstream.cpp
index 083acce68a..579678af41 100644
--- a/core/fpdfapi/page/cpdf_meshstream.cpp
+++ b/core/fpdfapi/page/cpdf_meshstream.cpp
@@ -9,6 +9,7 @@
 #include "core/fpdfapi/page/cpdf_colorspace.h"
 #include "core/fpdfapi/page/cpdf_function.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
+#include "third_party/base/span.h"
 
 namespace {
 
@@ -117,8 +118,8 @@ CPDF_MeshStream::~CPDF_MeshStream() {}
 
 bool CPDF_MeshStream::Load() {
   m_pStream->LoadAllDataFiltered();
-  m_BitStream = pdfium::MakeUnique<CFX_BitStream>(m_pStream->GetData(),
-                                                  m_pStream->GetSize());
+  m_BitStream = pdfium::MakeUnique<CFX_BitStream>(
+      pdfium::make_span(m_pStream->GetData(), m_pStream->GetSize()));
   CPDF_Dictionary* pDict = m_pShadingStream->GetDict();
   m_nCoordBits = pDict->GetIntegerFor("BitsPerCoordinate");
   m_nComponentBits = pDict->GetIntegerFor("BitsPerComponent");
diff --git a/core/fpdfapi/page/cpdf_psengine.cpp b/core/fpdfapi/page/cpdf_psengine.cpp
index adfd45e877..7fa8cd3001 100644
--- a/core/fpdfapi/page/cpdf_psengine.cpp
+++ b/core/fpdfapi/page/cpdf_psengine.cpp
@@ -190,8 +190,8 @@ int CPDF_PSEngine::PopInt() {
   return static_cast<int>(Pop());
 }
 
-bool CPDF_PSEngine::Parse(const ByteStringView& view) {
-  CPDF_SimpleParser parser(view);
+bool CPDF_PSEngine::Parse(pdfium::span<const uint8_t> input) {
+  CPDF_SimpleParser parser(input);
   return parser.GetWord() == "{" && m_MainProc.Parse(&parser, 0);
 }
 
diff --git a/core/fpdfapi/page/cpdf_psengine.h b/core/fpdfapi/page/cpdf_psengine.h
index 042a1c0895..9cb1e1a291 100644
--- a/core/fpdfapi/page/cpdf_psengine.h
+++ b/core/fpdfapi/page/cpdf_psengine.h
@@ -12,6 +12,7 @@
 
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "third_party/base/span.h"
 
 class CPDF_PSEngine;
 class CPDF_PSProc;
@@ -109,7 +110,7 @@ class CPDF_PSEngine {
   CPDF_PSEngine();
   ~CPDF_PSEngine();
 
-  bool Parse(const ByteStringView& str);
+  bool Parse(pdfium::span<const uint8_t> input);
   bool Execute();
   bool DoOperator(PDF_PSOP op);
   void Reset() { m_StackCount = 0; }
diff --git a/core/fpdfapi/page/cpdf_psfunc.cpp b/core/fpdfapi/page/cpdf_psfunc.cpp
index af996c056c..5499a47f99 100644
--- a/core/fpdfapi/page/cpdf_psfunc.cpp
+++ b/core/fpdfapi/page/cpdf_psfunc.cpp
@@ -16,7 +16,7 @@ CPDF_PSFunc::~CPDF_PSFunc() {}
 bool CPDF_PSFunc::v_Init(CPDF_Object* pObj) {
   auto pAcc = pdfium::MakeRetain<CPDF_StreamAcc>(pObj->AsStream());
   pAcc->LoadAllDataFiltered();
-  return m_PS.Parse(pAcc->GetDataView());
+  return m_PS.Parse(pAcc->GetSpan());
 }
 
 bool CPDF_PSFunc::v_Call(float* inputs, float* results) const {
diff --git a/core/fpdfapi/parser/cpdf_hint_tables.cpp b/core/fpdfapi/parser/cpdf_hint_tables.cpp
index 381b160233..123e6594c1 100644
--- a/core/fpdfapi/parser/cpdf_hint_tables.cpp
+++ b/core/fpdfapi/parser/cpdf_hint_tables.cpp
@@ -19,6 +19,7 @@
 #include "core/fxcrt/cfx_bitstream.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "third_party/base/numerics/safe_conversions.h"
+#include "third_party/base/span.h"
 
 namespace {
 
@@ -488,7 +489,7 @@ bool CPDF_HintTables::LoadHintStream(CPDF_Stream* pHintStream) {
     return false;
   }
 
-  CFX_BitStream bs(pAcc->GetData(), size);
+  CFX_BitStream bs(pdfium::make_span(pAcc->GetData(), size));
   return ReadPageHintTable(&bs) &&
          ReadSharedObjHintTable(&bs, shared_hint_table_offset);
 }
diff --git a/core/fpdfapi/parser/cpdf_simple_parser.cpp b/core/fpdfapi/parser/cpdf_simple_parser.cpp
index 45ea0d4528..ff6e2cf94d 100644
--- a/core/fpdfapi/parser/cpdf_simple_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_simple_parser.cpp
@@ -8,7 +8,8 @@
 
 #include "core/fpdfapi/parser/fpdf_parser_utility.h"
 
-CPDF_SimpleParser::CPDF_SimpleParser(const ByteStringView& str) : data_(str) {}
+CPDF_SimpleParser::CPDF_SimpleParser(pdfium::span<const uint8_t> input)
+    : data_(input) {}
 
 CPDF_SimpleParser::~CPDF_SimpleParser() = default;
 
@@ -17,12 +18,12 @@ ByteStringView CPDF_SimpleParser::GetWord() {
 
   // Skip whitespace and comment lines.
   while (1) {
-    if (data_.GetLength() <= cur_pos_)
+    if (data_.size() <= cur_pos_)
       return ByteStringView();
 
     ch = data_[cur_pos_++];
     while (PDFCharIsWhitespace(ch)) {
-      if (data_.GetLength() <= cur_pos_)
+      if (data_.size() <= cur_pos_)
         return ByteStringView();
       ch = data_[cur_pos_++];
     }
@@ -31,7 +32,7 @@ ByteStringView CPDF_SimpleParser::GetWord() {
       break;
 
     while (1) {
-      if (data_.GetLength() <= cur_pos_)
+      if (data_.size() <= cur_pos_)
         return ByteStringView();
 
       ch = data_[cur_pos_++];
@@ -46,7 +47,7 @@ ByteStringView CPDF_SimpleParser::GetWord() {
     // Find names
     if (ch == '/') {
       while (1) {
-        if (data_.GetLength() <= cur_pos_)
+        if (data_.size() <= cur_pos_)
           break;
 
         ch = data_[cur_pos_++];
@@ -56,29 +57,29 @@ ByteStringView CPDF_SimpleParser::GetWord() {
           break;
         }
       }
-      return data_.Mid(start_pos, dwSize);
+      return data_.subspan(start_pos, dwSize);
     }
 
     dwSize = 1;
     if (ch == '<') {
-      if (data_.GetLength() <= cur_pos_)
-        return data_.Mid(start_pos, dwSize);
+      if (data_.size() <= cur_pos_)
+        return data_.subspan(start_pos, dwSize);
 
       ch = data_[cur_pos_++];
       if (ch == '<') {
         dwSize = 2;
       } else {
-        while (cur_pos_ < data_.GetLength() && data_[cur_pos_] != '>')
+        while (cur_pos_ < data_.size() && data_[cur_pos_] != '>')
           cur_pos_++;
 
-        if (cur_pos_ < data_.GetLength())
+        if (cur_pos_ < data_.size())
           cur_pos_++;
 
         dwSize = cur_pos_ - start_pos;
       }
     } else if (ch == '>') {
-      if (data_.GetLength() <= cur_pos_)
-        return data_.Mid(start_pos, dwSize);
+      if (data_.size() <= cur_pos_)
+        return data_.subspan(start_pos, dwSize);
 
       ch = data_[cur_pos_++];
       if (ch == '>')
@@ -87,7 +88,7 @@ ByteStringView CPDF_SimpleParser::GetWord() {
         cur_pos_--;
     } else if (ch == '(') {
       int level = 1;
-      while (cur_pos_ < data_.GetLength()) {
+      while (cur_pos_ < data_.size()) {
         if (data_[cur_pos_] == ')') {
           level--;
           if (level == 0)
@@ -95,28 +96,28 @@ ByteStringView CPDF_SimpleParser::GetWord() {
         }
 
         if (data_[cur_pos_] == '\\') {
-          if (data_.GetLength() <= cur_pos_)
+          if (data_.size() <= cur_pos_)
             break;
 
           cur_pos_++;
         } else if (data_[cur_pos_] == '(') {
           level++;
         }
-        if (data_.GetLength() <= cur_pos_)
+        if (data_.size() <= cur_pos_)
           break;
 
         cur_pos_++;
       }
-      if (cur_pos_ < data_.GetLength())
+      if (cur_pos_ < data_.size())
         cur_pos_++;
 
       dwSize = cur_pos_ - start_pos;
     }
-    return data_.Mid(start_pos, dwSize);
+    return data_.subspan(start_pos, dwSize);
   }
 
   dwSize = 1;
-  while (cur_pos_ < data_.GetLength()) {
+  while (cur_pos_ < data_.size()) {
     ch = data_[cur_pos_++];
 
     if (PDFCharIsDelimiter(ch) || PDFCharIsWhitespace(ch)) {
@@ -125,5 +126,5 @@ ByteStringView CPDF_SimpleParser::GetWord() {
     }
     dwSize++;
   }
-  return data_.Mid(start_pos, dwSize);
+  return data_.subspan(start_pos, dwSize);
 }
diff --git a/core/fpdfapi/parser/cpdf_simple_parser.h b/core/fpdfapi/parser/cpdf_simple_parser.h
index 8a07323a69..c8dae23ba6 100644
--- a/core/fpdfapi/parser/cpdf_simple_parser.h
+++ b/core/fpdfapi/parser/cpdf_simple_parser.h
@@ -11,10 +11,11 @@
 
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
+#include "third_party/base/span.h"
 
 class CPDF_SimpleParser {
  public:
-  explicit CPDF_SimpleParser(const ByteStringView& str);
+  explicit CPDF_SimpleParser(pdfium::span<const uint8_t> input);
   ~CPDF_SimpleParser();
 
   ByteStringView GetWord();
@@ -23,7 +24,7 @@ class CPDF_SimpleParser {
   uint32_t GetCurPos() const { return cur_pos_; }
 
  private:
-  const ByteStringView data_;
+  const pdfium::span<const uint8_t> data_;
   uint32_t cur_pos_ = 0;
 };
 
diff --git a/core/fpdfapi/parser/cpdf_simple_parser_unittest.cpp b/core/fpdfapi/parser/cpdf_simple_parser_unittest.cpp
index 2fb50f1ff3..254d084bb0 100644
--- a/core/fpdfapi/parser/cpdf_simple_parser_unittest.cpp
+++ b/core/fpdfapi/parser/cpdf_simple_parser_unittest.cpp
@@ -9,6 +9,7 @@
 #include "core/fpdfapi/parser/fpdf_parser_utility.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/test_support.h"
+#include "third_party/base/span.h"
 
 TEST(SimpleParserTest, GetWord) {
   static const pdfium::StrFuncTestData test_data[] = {
@@ -49,7 +50,7 @@ TEST(SimpleParserTest, GetWord) {
   };
   for (size_t i = 0; i < FX_ArraySize(test_data); ++i) {
     const pdfium::StrFuncTestData& data = test_data[i];
-    CPDF_SimpleParser parser(ByteStringView(data.input, data.input_size));
+    CPDF_SimpleParser parser(pdfium::make_span(data.input, data.input_size));
     ByteStringView word = parser.GetWord();
     EXPECT_EQ(data.expected_size, word.GetLength()) << " for case " << i;
     if (data.expected_size != word.GetLength())
diff --git a/core/fpdfapi/parser/cpdf_stream_acc.cpp b/core/fpdfapi/parser/cpdf_stream_acc.cpp
index d115b48226..9cce894fff 100644
--- a/core/fpdfapi/parser/cpdf_stream_acc.cpp
+++ b/core/fpdfapi/parser/cpdf_stream_acc.cpp
@@ -68,12 +68,10 @@ CPDF_Dictionary* CPDF_StreamAcc::GetDict() const {
   return m_pStream ? m_pStream->GetDict() : nullptr;
 }
 
-const uint8_t* CPDF_StreamAcc::GetData() const {
-  return GetDataHelper();
-}
-
-uint8_t* CPDF_StreamAcc::GetData() {
-  return GetDataHelper();
+uint8_t* CPDF_StreamAcc::GetData() const {
+  if (m_bNewBuf)
+    return m_pData;
+  return m_pStream ? m_pStream->GetRawData() : nullptr;
 }
 
 uint32_t CPDF_StreamAcc::GetSize() const {
@@ -93,9 +91,3 @@ std::unique_ptr<uint8_t, FxFreeDeleter> CPDF_StreamAcc::DetachData() {
   memcpy(p.get(), m_pData, m_dwSize);
   return p;
 }
-
-uint8_t* CPDF_StreamAcc::GetDataHelper() const {
-  if (m_bNewBuf)
-    return m_pData;
-  return m_pStream ? m_pStream->GetRawData() : nullptr;
-}
diff --git a/core/fpdfapi/parser/cpdf_stream_acc.h b/core/fpdfapi/parser/cpdf_stream_acc.h
index ac5253a68b..89a454a0f0 100644
--- a/core/fpdfapi/parser/cpdf_stream_acc.h
+++ b/core/fpdfapi/parser/cpdf_stream_acc.h
@@ -14,6 +14,7 @@
 #include "core/fxcrt/fx_string.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxcrt/retain_ptr.h"
+#include "third_party/base/span.h"
 
 class CPDF_StreamAcc : public Retainable {
  public:
@@ -30,11 +31,11 @@ class CPDF_StreamAcc : public Retainable {
   const CPDF_Stream* GetStream() const { return m_pStream.Get(); }
   CPDF_Dictionary* GetDict() const;
 
-  ByteStringView GetDataView() { return ByteStringView(GetData(), GetSize()); }
-
-  const uint8_t* GetData() const;
-  uint8_t* GetData();
+  uint8_t* GetData() const;
   uint32_t GetSize() const;
+  pdfium::span<uint8_t> GetSpan() const {
+    return pdfium::make_span(GetData(), GetSize());
+  }
   const ByteString& GetImageDecoder() const { return m_ImageDecoder; }
   const CPDF_Dictionary* GetImageParam() const { return m_pImageParam; }
   std::unique_ptr<uint8_t, FxFreeDeleter> DetachData();
@@ -44,8 +45,6 @@ class CPDF_StreamAcc : public Retainable {
   ~CPDF_StreamAcc() override;
 
  private:
-  uint8_t* GetDataHelper() const;
-
   uint8_t* m_pData = nullptr;
   uint32_t m_dwSize = 0;
   bool m_bNewBuf = false;
diff --git a/core/fpdfdoc/cpdf_defaultappearance.cpp b/core/fpdfdoc/cpdf_defaultappearance.cpp
index 4efb0655b4..de85c9cb33 100644
--- a/core/fpdfdoc/cpdf_defaultappearance.cpp
+++ b/core/fpdfdoc/cpdf_defaultappearance.cpp
@@ -59,7 +59,7 @@ Optional<ByteString> CPDF_DefaultAppearance::GetFont(float* fFontSize) {
     return {};
 
   ByteString csFontNameTag;
-  CPDF_SimpleParser syntax(m_csDA.AsStringView());
+  CPDF_SimpleParser syntax(m_csDA.AsStringView().span());
   if (FindTagParamFromStart(&syntax, "Tf", 2)) {
     csFontNameTag = ByteString(syntax.GetWord());
     csFontNameTag.Delete(0, 1);
@@ -75,7 +75,7 @@ Optional<CFX_Color::Type> CPDF_DefaultAppearance::GetColor(float fc[4]) {
   if (m_csDA.IsEmpty())
     return {};
 
-  CPDF_SimpleParser syntax(m_csDA.AsStringView());
+  CPDF_SimpleParser syntax(m_csDA.AsStringView().span());
   if (FindTagParamFromStart(&syntax, "g", 1)) {
     fc[0] = FX_atof(syntax.GetWord());
     return {CFX_Color::kGray};
diff --git a/core/fpdfdoc/cpdf_defaultappearance_unittest.cpp b/core/fpdfdoc/cpdf_defaultappearance_unittest.cpp
index 031fa8c89d..6f6c525052 100644
--- a/core/fpdfdoc/cpdf_defaultappearance_unittest.cpp
+++ b/core/fpdfdoc/cpdf_defaultappearance_unittest.cpp
@@ -6,6 +6,7 @@
 
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/test_support.h"
+#include "third_party/base/span.h"
 
 TEST(CPDFDefaultAppearanceTest, FindTagParamFromStart) {
   static const struct FindTagTestStruct {
@@ -37,7 +38,7 @@ TEST(CPDFDefaultAppearanceTest, FindTagParamFromStart) {
   CPDF_DefaultAppearance da;
   for (size_t i = 0; i < FX_ArraySize(test_data); ++i) {
     CPDF_SimpleParser parser(
-        ByteStringView(test_data[i].input, test_data[i].input_size));
+        pdfium::make_span(test_data[i].input, test_data[i].input_size));
     EXPECT_EQ(test_data[i].result,
               da.FindTagParamFromStartForTesting(&parser, test_data[i].token,
                                                  test_data[i].num_params))
diff --git a/core/fxcrt/cfx_bitstream.cpp b/core/fxcrt/cfx_bitstream.cpp
index 7cf6d36adf..114b5a9d2a 100644
--- a/core/fxcrt/cfx_bitstream.cpp
+++ b/core/fxcrt/cfx_bitstream.cpp
@@ -10,9 +10,9 @@
 
 #include "core/fxcrt/fx_system.h"
 
-CFX_BitStream::CFX_BitStream(const uint8_t* pData, uint32_t dwSize)
-    : m_BitPos(0), m_BitSize(dwSize * 8), m_pData(pData) {
-  ASSERT(dwSize <= std::numeric_limits<uint32_t>::max() / 8);
+CFX_BitStream::CFX_BitStream(pdfium::span<const uint8_t> pData)
+    : m_BitPos(0), m_BitSize(pData.size() * 8), m_pData(pData.data()) {
+  ASSERT(pData.size() <= std::numeric_limits<uint32_t>::max() / 8);
 }
 
 CFX_BitStream::~CFX_BitStream() {}
diff --git a/core/fxcrt/cfx_bitstream.h b/core/fxcrt/cfx_bitstream.h
index 168760ddd8..baa2a9f544 100644
--- a/core/fxcrt/cfx_bitstream.h
+++ b/core/fxcrt/cfx_bitstream.h
@@ -10,10 +10,11 @@
 #include <stdint.h>
 
 #include "core/fxcrt/unowned_ptr.h"
+#include "third_party/base/span.h"
 
 class CFX_BitStream {
  public:
-  CFX_BitStream(const uint8_t* pData, uint32_t dwSize);
+  explicit CFX_BitStream(pdfium::span<const uint8_t> pData);
   ~CFX_BitStream();
 
   void ByteAlign();
diff --git a/testing/libfuzzer/pdf_cmap_fuzzer.cc b/testing/libfuzzer/pdf_cmap_fuzzer.cc
index 0f2a22dcf2..0c0ff11f36 100644
--- a/testing/libfuzzer/pdf_cmap_fuzzer.cc
+++ b/testing/libfuzzer/pdf_cmap_fuzzer.cc
@@ -6,8 +6,9 @@
 
 #include "core/fpdfapi/font/cpdf_cmap.h"
 #include "third_party/base/ptr_util.h"
+#include "third_party/base/span.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  pdfium::MakeRetain<CPDF_CMap>()->LoadEmbedded(ByteStringView(data, size));
+  pdfium::MakeRetain<CPDF_CMap>()->LoadEmbedded(pdfium::make_span(data, size));
   return 0;
 }
diff --git a/testing/libfuzzer/pdf_hint_table_fuzzer.cc b/testing/libfuzzer/pdf_hint_table_fuzzer.cc
index ee51e25f24..50ca5cd693 100644
--- a/testing/libfuzzer/pdf_hint_table_fuzzer.cc
+++ b/testing/libfuzzer/pdf_hint_table_fuzzer.cc
@@ -12,6 +12,7 @@
 #include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fxcrt/cfx_bitstream.h"
 #include "third_party/base/ptr_util.h"
+#include "third_party/base/span.h"
 
 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) {
   const int32_t* ret = *data32;
@@ -36,7 +37,7 @@ class HintTableForFuzzing : public CPDF_HintTables {
     if (size < static_cast<size_t>(shared_hint_table_offset_))
       return;
 
-    CFX_BitStream bs(data, size);
+    CFX_BitStream bs(pdfium::make_span(data, size));
     if (!ReadPageHintTable(&bs))
       return;
     ReadSharedObjHintTable(&bs, shared_hint_table_offset_);
diff --git a/testing/libfuzzer/pdf_psengine_fuzzer.cc b/testing/libfuzzer/pdf_psengine_fuzzer.cc
index 253b43e381..d72088d4e3 100644
--- a/testing/libfuzzer/pdf_psengine_fuzzer.cc
+++ b/testing/libfuzzer/pdf_psengine_fuzzer.cc
@@ -5,10 +5,11 @@
 #include <cstdint>
 
 #include "core/fpdfapi/page/cpdf_psengine.h"
+#include "third_party/base/span.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   CPDF_PSEngine engine;
-  if (engine.Parse(ByteStringView(data, size)))
+  if (engine.Parse(pdfium::make_span(data, size)))
     engine.Execute();
   return 0;
 }
-- 
cgit v1.2.3