diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.cpp b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
index e52b96f..75abdc5 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.cpp
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.cpp
@@ -27,6 +27,7 @@
 #include "fpdfsdk/formfiller/cffl_perwindowdata.h"
 #include "fxjs/ijs_runtime.h"
 #include "third_party/base/check.h"
+#include "third_party/base/numerics/safe_conversions.h"
 
 static_assert(FXCT_ARROW ==
                   static_cast<int>(IPWL_SystemHandler::CursorStyle::kArrow),
@@ -210,13 +211,13 @@
                                 AsFPDFWideString(&bsTitle), Type, Icon);
 }
 
-int CPDFSDK_FormFillEnvironment::JS_appResponse(const WideString& Question,
-                                                const WideString& Title,
-                                                const WideString& Default,
-                                                const WideString& Label,
-                                                FPDF_BOOL bPassword,
-                                                void* response,
-                                                int length) {
+int CPDFSDK_FormFillEnvironment::JS_appResponse(
+    const WideString& Question,
+    const WideString& Title,
+    const WideString& Default,
+    const WideString& Label,
+    FPDF_BOOL bPassword,
+    pdfium::span<uint8_t> response) {
   IPDF_JSPLATFORM* js_platform = GetJSPlatform();
   if (!js_platform || !js_platform->app_response)
     return -1;
@@ -228,7 +229,7 @@
   return js_platform->app_response(
       js_platform, AsFPDFWideString(&bsQuestion), AsFPDFWideString(&bsTitle),
       AsFPDFWideString(&bsDefault), AsFPDFWideString(&bsLabel), bPassword,
-      response, length);
+      response.data(), pdfium::base::checked_cast<int>(response.size()));
 }
 
 void CPDFSDK_FormFillEnvironment::JS_appBeep(int nType) {
@@ -259,8 +260,7 @@
   return WideString::FromDefANSI(ByteStringView(pBuff));
 }
 
-void CPDFSDK_FormFillEnvironment::JS_docmailForm(void* mailData,
-                                                 int length,
+void CPDFSDK_FormFillEnvironment::JS_docmailForm(pdfium::span<uint8_t> mailData,
                                                  FPDF_BOOL bUI,
                                                  const WideString& To,
                                                  const WideString& Subject,
@@ -276,7 +276,8 @@
   ByteString bsCC = CC.ToUTF16LE();
   ByteString bsBcc = BCC.ToUTF16LE();
   ByteString bsMsg = Msg.ToUTF16LE();
-  js_platform->Doc_mail(js_platform, mailData, length, bUI,
+  js_platform->Doc_mail(js_platform, mailData.data(),
+                        pdfium::base::checked_cast<int>(mailData.size()), bUI,
                         AsFPDFWideString(&bsTo), AsFPDFWideString(&bsSubject),
                         AsFPDFWideString(&bsCC), AsFPDFWideString(&bsBcc),
                         AsFPDFWideString(&bsMsg));
diff --git a/fpdfsdk/cpdfsdk_formfillenvironment.h b/fpdfsdk/cpdfsdk_formfillenvironment.h
index 9fb5851..193edbf 100644
--- a/fpdfsdk/cpdfsdk_formfillenvironment.h
+++ b/fpdfsdk/cpdfsdk_formfillenvironment.h
@@ -7,6 +7,8 @@
 #ifndef FPDFSDK_CPDFSDK_FORMFILLENVIRONMENT_H_
 #define FPDFSDK_CPDFSDK_FORMFILLENVIRONMENT_H_
 
+#include <stdint.h>
+
 #include <map>
 #include <memory>
 #include <vector>
@@ -24,6 +26,7 @@
 #include "fpdfsdk/pwl/cpwl_wnd.h"
 #include "fpdfsdk/pwl/ipwl_systemhandler.h"
 #include "public/fpdf_formfill.h"
+#include "third_party/base/span.h"
 
 class CPDFSDK_ActionHandler;
 class CPDFSDK_AnnotHandlerMgr;
@@ -133,12 +136,10 @@
                      const WideString& Default,
                      const WideString& cLabel,
                      FPDF_BOOL bPassword,
-                     void* response,
-                     int length);
+                     pdfium::span<uint8_t> response);
   void JS_appBeep(int nType);
   WideString JS_fieldBrowse();
-  void JS_docmailForm(void* mailData,
-                      int length,
+  void JS_docmailForm(pdfium::span<uint8_t> mailData,
                       FPDF_BOOL bUI,
                       const WideString& To,
                       const WideString& Subject,
diff --git a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
index 35d33db..c0f2917 100644
--- a/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
+++ b/fpdfsdk/fpdfxfa/cpdfxfa_context.cpp
@@ -345,8 +345,7 @@
   int nLength = 2048;
   std::vector<uint8_t, FxAllocAllocator<uint8_t>> pBuff(nLength);
   nLength = m_pFormFillEnv->JS_appResponse(wsQuestion, wsTitle, wsDefaultAnswer,
-                                           WideString(), bMark, pBuff.data(),
-                                           nLength);
+                                           WideString(), bMark, pBuff);
   if (nLength <= 0)
     return WideString();
 
diff --git a/fxjs/cjs_app.cpp b/fxjs/cjs_app.cpp
index b3f2de2..3a45683 100644
--- a/fxjs/cjs_app.cpp
+++ b/fxjs/cjs_app.cpp
@@ -458,8 +458,8 @@
     cMsg = pRuntime->ToWideString(newParams[5]);
 
   pRuntime->BeginBlock();
-  pRuntime->GetFormFillEnv()->JS_docmailForm(nullptr, 0, bUI, cTo, cSubject,
-                                             cCc, cBcc, cMsg);
+  pRuntime->GetFormFillEnv()->JS_docmailForm(pdfium::span<uint8_t>(), bUI, cTo,
+                                             cSubject, cCc, cBcc, cMsg);
   pRuntime->EndBlock();
   return CJS_Result::Success();
 }
@@ -549,8 +549,8 @@
   const int MAX_INPUT_BYTES = 2048;
   std::vector<uint8_t, FxAllocAllocator<uint8_t>> pBuff(MAX_INPUT_BYTES + 2);
   int nLengthBytes = pRuntime->GetFormFillEnv()->JS_appResponse(
-      swQuestion, swTitle, swDefault, swLabel, bPassword, pBuff.data(),
-      MAX_INPUT_BYTES);
+      swQuestion, swTitle, swDefault, swLabel, bPassword,
+      pdfium::make_span(pBuff).first(MAX_INPUT_BYTES));
 
   if (nLengthBytes < 0 || nLengthBytes > MAX_INPUT_BYTES)
     return CJS_Result::Failure(JSMessage::kParamTooLongError);
diff --git a/fxjs/cjs_document.cpp b/fxjs/cjs_document.cpp
index 983116c..61fe0e1 100644
--- a/fxjs/cjs_document.cpp
+++ b/fxjs/cjs_document.cpp
@@ -345,8 +345,8 @@
     cMsg = pRuntime->ToWideString(newParams[5]);
 
   pRuntime->BeginBlock();
-  m_pFormFillEnv->JS_docmailForm(nullptr, 0, bUI, cTo, cSubject, cCc, cBcc,
-                                 cMsg);
+  m_pFormFillEnv->JS_docmailForm(pdfium::span<uint8_t>(), bUI, cTo, cSubject,
+                                 cCc, cBcc, cMsg);
   pRuntime->EndBlock();
   return CJS_Result::Success();
 }
@@ -396,11 +396,11 @@
   if (IsExpandedParamKnown(newParams[5]))
     cMsg = pRuntime->ToWideString(newParams[5]);
 
-  std::vector<char, FxAllocAllocator<char>> mutable_buf(sTextBuf.begin(),
-                                                        sTextBuf.end());
+  std::vector<uint8_t, FxAllocAllocator<uint8_t>> mutable_buf(sTextBuf.begin(),
+                                                              sTextBuf.end());
   pRuntime->BeginBlock();
-  m_pFormFillEnv->JS_docmailForm(mutable_buf.data(), mutable_buf.size(), bUI,
-                                 cTo, cSubject, cCc, cBcc, cMsg);
+  m_pFormFillEnv->JS_docmailForm(mutable_buf, bUI, cTo, cSubject, cCc, cBcc,
+                                 cMsg);
   pRuntime->EndBlock();
   return CJS_Result::Success();
 }