Replace writable span.data()+offset with span.subspan(offset).data().

Get better bounds checks along the way.

-- fix spelling of Offset in a few places while at it.

Change-Id: Iff5a2ef8d86164e2dfde867358d52a57d709c471
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/85553
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/core/fxcodec/progressive_decoder.cpp b/core/fxcodec/progressive_decoder.cpp
index 4fb0bd6..f1c7184 100644
--- a/core/fxcodec/progressive_decoder.cpp
+++ b/core/fxcodec/progressive_decoder.cpp
@@ -411,7 +411,7 @@
   FX_ARGB argb = m_SrcPalette[pal_index];
   for (int row = 0; row < sizeY; row++) {
     uint8_t* pScanline =
-        pDevice->GetWritableScanline(row + startY).data() + startX * Bpp;
+        pDevice->GetWritableScanline(row + startY).subspan(startX * Bpp).data();
     switch (m_TransMethod) {
       case 3: {
         uint8_t gray =
@@ -486,14 +486,15 @@
 
   int dest_bottom = dest_top + m_sizeY;
   int dest_Bpp = pDIBitmap->GetBPP() >> 3;
-  uint32_t dest_ScanOffet = m_startX * dest_Bpp;
+  uint32_t dest_ScanOffset = m_startX * dest_Bpp;
   if (dest_row + (int)scale_y >= dest_bottom - 1) {
     const uint8_t* scan_src =
-        pDIBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
+        pDIBitmap->GetScanline(dest_row).subspan(dest_ScanOffset).data();
     int cur_row = dest_row;
     while (++cur_row < dest_bottom) {
-      uint8_t* scan_des =
-          pDIBitmap->GetWritableScanline(cur_row).data() + dest_ScanOffet;
+      uint8_t* scan_des = pDIBitmap->GetWritableScanline(cur_row)
+                              .subspan(dest_ScanOffset)
+                              .data();
       uint32_t size = m_sizeX * dest_Bpp;
       memmove(scan_des, scan_src, size);
     }
@@ -549,7 +550,7 @@
     double scale_y,
     int dest_row) {
   int dest_Bpp = pDeviceBitmap->GetBPP() >> 3;
-  uint32_t dest_ScanOffet = m_startX * dest_Bpp;
+  uint32_t dest_ScanOffset = m_startX * dest_Bpp;
   int dest_top = m_startY;
   int dest_bottom = m_startY + m_sizeY;
   FX_SAFE_INT32 check_dest_row_1 = dest_row;
@@ -557,26 +558,28 @@
   int dest_row_1 = check_dest_row_1.ValueOrDie();
   if (dest_row_1 >= dest_bottom - 1) {
     const uint8_t* scan_src =
-        pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
+        pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset).data();
     while (++dest_row < dest_bottom) {
-      uint8_t* scan_des =
-          pDeviceBitmap->GetWritableScanline(dest_row).data() + dest_ScanOffet;
+      uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row)
+                              .subspan(dest_ScanOffset)
+                              .data();
       uint32_t size = m_sizeX * dest_Bpp;
       memmove(scan_des, scan_src, size);
     }
     return;
   }
   for (; dest_row_1 > dest_row; dest_row_1--) {
-    uint8_t* scan_des =
-        pDeviceBitmap->GetWritableScanline(dest_row_1).data() + dest_ScanOffet;
+    uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row_1)
+                            .subspan(dest_ScanOffset)
+                            .data();
     PixelWeight* pWeight = m_WeightVert.GetPixelWeight(dest_row_1 - dest_top);
     const uint8_t* scan_src1 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcStart + dest_top)
-            .subspan(dest_ScanOffet)
+            .subspan(dest_ScanOffset)
             .data();
     const uint8_t* scan_src2 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcEnd + dest_top)
-            .subspan(dest_ScanOffet)
+            .subspan(dest_ScanOffset)
             .data();
     switch (pDeviceBitmap->GetFormat()) {
       case FXDIB_Format::kInvalid:
@@ -837,7 +840,7 @@
     double scale_y,
     int dest_row) {
   int dest_Bpp = pDeviceBitmap->GetBPP() >> 3;
-  uint32_t dest_ScanOffet = m_startX * dest_Bpp;
+  uint32_t dest_ScanOffset = m_startX * dest_Bpp;
   int dest_top = m_startY;
   pdfium::base::CheckedNumeric<double> scale_y2 = scale_y;
   scale_y2 *= 2;
@@ -846,16 +849,17 @@
   int dest_row_1 = check_dest_row_1.ValueOrDie();
   dest_row_1 = std::max(dest_row_1, dest_top);
   for (; dest_row_1 < dest_row; dest_row_1++) {
-    uint8_t* scan_des =
-        pDeviceBitmap->GetWritableScanline(dest_row_1).data() + dest_ScanOffet;
+    uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row_1)
+                            .subspan(dest_ScanOffset)
+                            .data();
     PixelWeight* pWeight = m_WeightVert.GetPixelWeight(dest_row_1 - dest_top);
     const uint8_t* scan_src1 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcStart + dest_top)
-            .subspan(dest_ScanOffet)
+            .subspan(dest_ScanOffset)
             .data();
     const uint8_t* scan_src2 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcEnd + dest_top)
-            .subspan(dest_ScanOffet)
+            .subspan(dest_ScanOffset)
             .data();
     switch (pDeviceBitmap->GetFormat()) {
       case FXDIB_Format::kInvalid:
@@ -1063,8 +1067,9 @@
   int32_t src_left = m_clipBox.left;
   int32_t dest_left = m_startX;
   src_scan += src_left * src_Bpp;
-  uint8_t* dest_scan = pDeviceBitmap->GetWritableScanline(dest_line).data() +
-                       dest_left * dest_Bpp;
+  uint8_t* dest_scan = pDeviceBitmap->GetWritableScanline(dest_line)
+                           .subspan(dest_left * dest_Bpp)
+                           .data();
   switch (pDeviceBitmap->GetFormat()) {
     case FXDIB_Format::k1bppMask:
     case FXDIB_Format::k1bppRgb:
@@ -1915,7 +1920,7 @@
     double scale_y,
     int dest_row) {
   int dest_Bpp = pDeviceBitmap->GetBPP() >> 3;
-  uint32_t dest_ScanOffet = m_startX * dest_Bpp;
+  uint32_t dest_ScanOffset = m_startX * dest_Bpp;
   int dest_top = m_startY;
   FX_SAFE_INT32 check_dest_row_1 = dest_row;
   check_dest_row_1 -= pdfium::base::checked_cast<int>(scale_y);
@@ -1924,11 +1929,11 @@
     int dest_bottom = dest_top + m_sizeY;
     if (dest_row + (int)scale_y >= dest_bottom - 1) {
       const uint8_t* scan_src =
-          pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
+          pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset).data();
       while (++dest_row < dest_bottom) {
-        uint8_t* scan_des =
-            pDeviceBitmap->GetWritableScanline(dest_row).data() +
-            dest_ScanOffet;
+        uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row)
+                                .subspan(dest_ScanOffset)
+                                .data();
         uint32_t size = m_sizeX * dest_Bpp;
         memmove(scan_des, scan_src, size);
       }
@@ -1936,16 +1941,17 @@
     return;
   }
   for (; dest_row_1 < dest_row; dest_row_1++) {
-    uint8_t* scan_des =
-        pDeviceBitmap->GetWritableScanline(dest_row_1).data() + dest_ScanOffet;
+    uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row_1)
+                            .subspan(dest_ScanOffset)
+                            .data();
     PixelWeight* pWeight = m_WeightVert.GetPixelWeight(dest_row_1 - dest_top);
     const uint8_t* scan_src1 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcStart + dest_top)
-            .subspan(dest_ScanOffet)
+            .subspan(dest_ScanOffset)
             .data();
     const uint8_t* scan_src2 =
         pDeviceBitmap->GetScanline(pWeight->m_SrcEnd + dest_top)
-            .subspan(dest_ScanOffet)
+            .subspan(dest_ScanOffset)
             .data();
     switch (pDeviceBitmap->GetFormat()) {
       case FXDIB_Format::kInvalid:
@@ -2003,10 +2009,11 @@
   int dest_bottom = dest_top + m_sizeY;
   if (dest_row + (int)scale_y >= dest_bottom - 1) {
     const uint8_t* scan_src =
-        pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffet).data();
+        pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset).data();
     while (++dest_row < dest_bottom) {
-      uint8_t* scan_des =
-          pDeviceBitmap->GetWritableScanline(dest_row).data() + dest_ScanOffet;
+      uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row)
+                              .subspan(dest_ScanOffset)
+                              .data();
       uint32_t size = m_sizeX * dest_Bpp;
       memmove(scan_des, scan_src, size);
     }
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index ccc1041..7ce6a73 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -351,7 +351,8 @@
   int srcBytes = pSrcClone->GetBPP() / 8;
   int destBytes = pDst->GetBPP() / 8;
   for (int row = 0; row < m_Height; row++) {
-    uint8_t* dest_pos = pDst->GetWritableScanline(row).data() + destOffset;
+    uint8_t* dest_pos =
+        pDst->GetWritableScanline(row).subspan(destOffset).data();
     const uint8_t* src_pos =
         pSrcClone->GetScanline(row).subspan(srcOffset).data();
     for (int col = 0; col < m_Width; col++) {
@@ -774,10 +775,10 @@
             ? pSrcAlphaMask->GetScanline(src_top + row).subspan(src_left).data()
             : nullptr;
     uint8_t* dst_scan_extra_alpha =
-        m_pAlphaMask
-            ? m_pAlphaMask->GetWritableScanline(dest_top + row).data() +
-                  dest_left
-            : nullptr;
+        m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(dest_top + row)
+                           .subspan(dest_left)
+                           .data()
+                     : nullptr;
     const uint8_t* clip_scan = nullptr;
     if (pClipMask) {
       clip_scan = pClipMask->m_pBuffer.Get() +
@@ -847,10 +848,10 @@
         m_pBuffer.Get() + (dest_top + row) * m_Pitch + dest_left * Bpp;
     const uint8_t* src_scan = pMask->GetScanline(src_top + row).data();
     uint8_t* dst_scan_extra_alpha =
-        m_pAlphaMask
-            ? m_pAlphaMask->GetWritableScanline(dest_top + row).data() +
-                  dest_left
-            : nullptr;
+        m_pAlphaMask ? m_pAlphaMask->GetWritableScanline(dest_top + row)
+                           .subspan(dest_left)
+                           .data()
+                     : nullptr;
     const uint8_t* clip_scan = nullptr;
     if (pClipMask) {
       clip_scan = pClipMask->m_pBuffer.Get() +
@@ -919,9 +920,10 @@
       index = (static_cast<uint8_t>(color) == 0xff) ? 1 : 0;
     }
     for (int row = rect.top; row < rect.bottom; row++) {
-      uint8_t* dest_scan_top = GetWritableScanline(row).data() + rect.left / 8;
+      uint8_t* dest_scan_top =
+          GetWritableScanline(row).subspan(rect.left / 8).data();
       uint8_t* dest_scan_top_r =
-          GetWritableScanline(row).data() + rect.right / 8;
+          GetWritableScanline(row).subspan(rect.right / 8).data();
       uint8_t left_flag = *dest_scan_top & (255 << (8 - left_shift));
       uint8_t right_flag = *dest_scan_top_r & (255 >> right_shift);
       if (new_width) {
@@ -958,7 +960,7 @@
       uint8_t* dest_scan = m_pBuffer.Get() + row * m_Pitch + rect.left * Bpp;
       uint8_t* dest_scan_alpha =
           m_pAlphaMask
-              ? m_pAlphaMask->GetWritableScanline(row).data() + rect.left
+              ? m_pAlphaMask->GetWritableScanline(row).subspan(rect.left).data()
               : nullptr;
       if (dest_scan_alpha)
         memset(dest_scan_alpha, 0xff, width);
@@ -1002,7 +1004,7 @@
         }
       } else {
         uint8_t* dest_scan_alpha =
-            m_pAlphaMask->GetWritableScanline(row).data() + rect.left;
+            m_pAlphaMask->GetWritableScanline(row).subspan(rect.left).data();
         for (int col = 0; col < width; col++) {
           uint8_t back_alpha = *dest_scan_alpha;
           if (back_alpha == 0) {