diff --git a/core/fpdfapi/font/cfx_cttgsubtable.cpp b/core/fpdfapi/font/cfx_cttgsubtable.cpp
index da3ce76..c19649e 100644
--- a/core/fpdfapi/font/cfx_cttgsubtable.cpp
+++ b/core/fpdfapi/font/cfx_cttgsubtable.cpp
@@ -27,7 +27,7 @@
 
 }  // namespace
 
-CFX_CTTGSUBTable::CFX_CTTGSUBTable(const uint8_t* gsub) {
+CFX_CTTGSUBTable::CFX_CTTGSUBTable(pdfium::span<const uint8_t> gsub) {
   if (!LoadGSUBTable(gsub))
     return;
 
@@ -55,13 +55,18 @@
 
 CFX_CTTGSUBTable::~CFX_CTTGSUBTable() = default;
 
-bool CFX_CTTGSUBTable::LoadGSUBTable(const uint8_t* gsub) {
+bool CFX_CTTGSUBTable::LoadGSUBTable(pdfium::span<const uint8_t> gsub) {
   if (FXSYS_UINT32_GET_MSBFIRST(gsub) != 0x00010000)
     return false;
 
-  Parse(&gsub[FXSYS_UINT16_GET_MSBFIRST(gsub + 4)],
-        &gsub[FXSYS_UINT16_GET_MSBFIRST(gsub + 6)],
-        &gsub[FXSYS_UINT16_GET_MSBFIRST(gsub + 8)]);
+  auto scriptlist_span = gsub.subspan(4, 2);
+  auto featurelist_span = gsub.subspan(6, 2);
+  auto lookuplist_span = gsub.subspan(8, 2);
+  size_t scriptlist_index = FXSYS_UINT16_GET_MSBFIRST(scriptlist_span);
+  size_t featurelist_index = FXSYS_UINT16_GET_MSBFIRST(featurelist_span);
+  size_t lookuplist_index = FXSYS_UINT16_GET_MSBFIRST(lookuplist_span);
+  Parse(gsub.subspan(scriptlist_index), gsub.subspan(featurelist_index),
+        gsub.subspan(lookuplist_index));
   return true;
 }
 
@@ -176,16 +181,16 @@
   return ret;
 }
 
-void CFX_CTTGSUBTable::Parse(const uint8_t* scriptlist,
-                             const uint8_t* featurelist,
-                             const uint8_t* lookuplist) {
+void CFX_CTTGSUBTable::Parse(pdfium::span<const uint8_t> scriptlist,
+                             pdfium::span<const uint8_t> featurelist,
+                             pdfium::span<const uint8_t> lookuplist) {
   ParseScriptList(scriptlist);
   ParseFeatureList(featurelist);
   ParseLookupList(lookuplist);
 }
 
-void CFX_CTTGSUBTable::ParseScriptList(const uint8_t* raw) {
-  const uint8_t* sp = raw;
+void CFX_CTTGSUBTable::ParseScriptList(pdfium::span<const uint8_t> raw) {
+  const uint8_t* sp = raw.data();
   script_list_ = std::vector<ScriptRecord>(GetUInt16(sp));
   for (auto& script : script_list_) {
     // Skip over "ScriptTag" field.
@@ -218,8 +223,8 @@
   return result;
 }
 
-void CFX_CTTGSUBTable::ParseFeatureList(const uint8_t* raw) {
-  const uint8_t* sp = raw;
+void CFX_CTTGSUBTable::ParseFeatureList(pdfium::span<const uint8_t> raw) {
+  const uint8_t* sp = raw.data();
   feature_list_ = std::vector<FeatureRecord>(GetUInt16(sp));
   for (auto& record : feature_list_) {
     record.feature_tag = GetUInt32(sp);
@@ -239,8 +244,8 @@
   return result;
 }
 
-void CFX_CTTGSUBTable::ParseLookupList(const uint8_t* raw) {
-  const uint8_t* sp = raw;
+void CFX_CTTGSUBTable::ParseLookupList(pdfium::span<const uint8_t> raw) {
+  const uint8_t* sp = raw.data();
   lookup_list_ = std::vector<Lookup>(GetUInt16(sp));
   for (auto& lookup : lookup_list_) {
     lookup = ParseLookup(&raw[GetUInt16(sp)]);
diff --git a/core/fpdfapi/font/cfx_cttgsubtable.h b/core/fpdfapi/font/cfx_cttgsubtable.h
index de55f73..3e6bac8 100644
--- a/core/fpdfapi/font/cfx_cttgsubtable.h
+++ b/core/fpdfapi/font/cfx_cttgsubtable.h
@@ -16,10 +16,11 @@
 #include "core/fxge/freetype/fx_freetype.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 #include "third_party/abseil-cpp/absl/types/variant.h"
+#include "third_party/base/span.h"
 
 class CFX_CTTGSUBTable {
  public:
-  explicit CFX_CTTGSUBTable(const uint8_t* gsub);
+  explicit CFX_CTTGSUBTable(pdfium::span<const uint8_t> gsub);
   ~CFX_CTTGSUBTable();
 
   uint32_t GetVerticalGlyph(uint32_t glyphnum) const;
@@ -77,16 +78,16 @@
     SubTables sub_tables;
   };
 
-  bool LoadGSUBTable(const uint8_t* gsub);
-  void Parse(const uint8_t* scriptlist,
-             const uint8_t* featurelist,
-             const uint8_t* lookuplist);
-  void ParseScriptList(const uint8_t* raw);
+  bool LoadGSUBTable(pdfium::span<const uint8_t> gsub);
+  void Parse(pdfium::span<const uint8_t> scriptlist,
+             pdfium::span<const uint8_t> featurelist,
+             pdfium::span<const uint8_t> lookuplist);
+  void ParseScriptList(pdfium::span<const uint8_t> raw);
   ScriptRecord ParseScript(const uint8_t* raw);
   FeatureIndices ParseLangSys(const uint8_t* raw);
-  void ParseFeatureList(const uint8_t* raw);
+  void ParseFeatureList(pdfium::span<const uint8_t> raw);
   DataVector<uint16_t> ParseFeatureLookupListIndices(const uint8_t* raw);
-  void ParseLookupList(const uint8_t* raw);
+  void ParseLookupList(pdfium::span<const uint8_t> raw);
   Lookup ParseLookup(const uint8_t* raw);
   CoverageFormat ParseCoverage(const uint8_t* raw);
   SubTable ParseSingleSubst(const uint8_t* raw);
diff --git a/core/fpdfapi/font/cpdf_cidfont.cpp b/core/fpdfapi/font/cpdf_cidfont.cpp
index 0d02494..f5a51b2 100644
--- a/core/fpdfapi/font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/font/cpdf_cidfont.cpp
@@ -676,7 +676,7 @@
 
   // CFX_CTTGSUBTable parses the data and stores all the values in its structs.
   // It does not store pointers into `sub_data`.
-  m_pTTGSUBTable = std::make_unique<CFX_CTTGSUBTable>(sub_data.span().data());
+  m_pTTGSUBTable = std::make_unique<CFX_CTTGSUBTable>(sub_data.span());
   return GetVerticalGlyph(index, pVertGlyph);
 }