From 1dbfe996b946f0d2a1afc52669ff5fca22a85070 Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Tue, 17 Apr 2018 17:19:30 +0000
Subject: Re-land "Return pdfium::span<char> from ByteString::GetBuffer().""

This reverts commit 3d523e3cf89440e2ffc6571b1c687ad5e3f0318f.
Fixes bounding errors now caught by tests.

Change-Id: I4d0f1791bdcc45a10615a62abf7a4d20e7e538f2
Reviewed-on: https://pdfium-review.googlesource.com/30799
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
---
 core/fxge/win32/fx_win32_dib.cpp | 62 +++++++++++++++++++++-------------------
 1 file changed, 33 insertions(+), 29 deletions(-)

(limited to 'core/fxge/win32/fx_win32_dib.cpp')

diff --git a/core/fxge/win32/fx_win32_dib.cpp b/core/fxge/win32/fx_win32_dib.cpp
index 452d033f64..b6bed7a987 100644
--- a/core/fxge/win32/fx_win32_dib.cpp
+++ b/core/fxge/win32/fx_win32_dib.cpp
@@ -13,39 +13,43 @@
 
 ByteString CFX_WindowsDIB::GetBitmapInfo(
     const RetainPtr<CFX_DIBitmap>& pBitmap) {
-  ByteString result;
   int len = sizeof(BITMAPINFOHEADER);
-  if (pBitmap->GetBPP() == 1 || pBitmap->GetBPP() == 8) {
+  if (pBitmap->GetBPP() == 1 || pBitmap->GetBPP() == 8)
     len += sizeof(DWORD) * (int)(1 << pBitmap->GetBPP());
-  }
-  BITMAPINFOHEADER* pbmih = (BITMAPINFOHEADER*)result.GetBuffer(len);
-  memset(pbmih, 0, sizeof(BITMAPINFOHEADER));
-  pbmih->biSize = sizeof(BITMAPINFOHEADER);
-  pbmih->biBitCount = pBitmap->GetBPP();
-  pbmih->biCompression = BI_RGB;
-  pbmih->biHeight = -(int)pBitmap->GetHeight();
-  pbmih->biPlanes = 1;
-  pbmih->biWidth = pBitmap->GetWidth();
-  if (pBitmap->GetBPP() == 8) {
-    uint32_t* pPalette = (uint32_t*)(pbmih + 1);
-    if (pBitmap->GetPalette()) {
-      for (int i = 0; i < 256; i++) {
-        pPalette[i] = pBitmap->GetPalette()[i];
-      }
-    } else {
-      for (int i = 0; i < 256; i++) {
-        pPalette[i] = i * 0x010101;
+
+  ByteString result;
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<char> cspan = result.GetBuffer(len);
+    BITMAPINFOHEADER* pbmih = reinterpret_cast<BITMAPINFOHEADER*>(cspan.data());
+    memset(pbmih, 0, sizeof(BITMAPINFOHEADER));
+    pbmih->biSize = sizeof(BITMAPINFOHEADER);
+    pbmih->biBitCount = pBitmap->GetBPP();
+    pbmih->biCompression = BI_RGB;
+    pbmih->biHeight = -(int)pBitmap->GetHeight();
+    pbmih->biPlanes = 1;
+    pbmih->biWidth = pBitmap->GetWidth();
+    if (pBitmap->GetBPP() == 8) {
+      uint32_t* pPalette = (uint32_t*)(pbmih + 1);
+      if (pBitmap->GetPalette()) {
+        for (int i = 0; i < 256; i++) {
+          pPalette[i] = pBitmap->GetPalette()[i];
+        }
+      } else {
+        for (int i = 0; i < 256; i++) {
+          pPalette[i] = i * 0x010101;
+        }
       }
     }
-  }
-  if (pBitmap->GetBPP() == 1) {
-    uint32_t* pPalette = (uint32_t*)(pbmih + 1);
-    if (pBitmap->GetPalette()) {
-      pPalette[0] = pBitmap->GetPalette()[0];
-      pPalette[1] = pBitmap->GetPalette()[1];
-    } else {
-      pPalette[0] = 0;
-      pPalette[1] = 0xffffff;
+    if (pBitmap->GetBPP() == 1) {
+      uint32_t* pPalette = (uint32_t*)(pbmih + 1);
+      if (pBitmap->GetPalette()) {
+        pPalette[0] = pBitmap->GetPalette()[0];
+        pPalette[1] = pBitmap->GetPalette()[1];
+      } else {
+        pPalette[0] = 0;
+        pPalette[1] = 0xffffff;
+      }
     }
   }
   result.ReleaseBuffer(len);
-- 
cgit v1.2.3