diff --git a/fpdfsdk/cpdfsdk_helpers.cpp b/fpdfsdk/cpdfsdk_helpers.cpp
index de67468..a6b2337d 100644
--- a/fpdfsdk/cpdfsdk_helpers.cpp
+++ b/fpdfsdk/cpdfsdk_helpers.cpp
@@ -304,29 +304,30 @@
 unsigned long NulTerminateMaybeCopyAndReturnLength(const ByteString& text,
                                                    void* buffer,
                                                    unsigned long buflen) {
-  const unsigned long len =
-      pdfium::checked_cast<unsigned long>(text.GetLength() + 1);
-  // TODO(tsepez): convert to span.
-  if (buffer && len <= buflen) {
-    // SAFETY: check above.
-    UNSAFE_BUFFERS(FXSYS_memcpy(buffer, text.c_str(), len));
+  pdfium::span<const char> text_span = text.span_with_terminator();
+  if (buffer) {
+    // SAFETY: required from caller, enforced by UNSAFE_BUFFER_USAGE on
+    // declaration in header file.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), buflen));
+    fxcrt::try_spancpy(result_span, text_span);
   }
-  return len;
+  return pdfium::checked_cast<unsigned long>(text_span.size());
 }
 
 unsigned long Utf16EncodeMaybeCopyAndReturnLength(const WideString& text,
                                                   void* buffer,
                                                   unsigned long buflen) {
   ByteString encoded_text = text.ToUTF16LE();
-  const unsigned long len =
-      pdfium::checked_cast<unsigned long>(encoded_text.GetLength());
-
-  // TODO(tsepez): convert to span.
-  if (buffer && len <= buflen) {
-    // SAFTEY: check above.
-    UNSAFE_BUFFERS(FXSYS_memcpy(buffer, encoded_text.c_str(), len));
+  pdfium::span<const char> encoded_text_span = encoded_text.span();
+  if (buffer) {
+    // SAFETY: required from caller, enforced by UNSAFE_BUFFER_USAGE on
+    // declaration in header file.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), buflen));
+    fxcrt::try_spancpy(result_span, encoded_text_span);
   }
-  return len;
+  return pdfium::checked_cast<unsigned long>(encoded_text_span.size());
 }
 
 unsigned long GetRawStreamMaybeCopyAndReturnLength(
diff --git a/fpdfsdk/cpdfsdk_helpers.h b/fpdfsdk/cpdfsdk_helpers.h
index f66adbf..93e6f79 100644
--- a/fpdfsdk/cpdfsdk_helpers.h
+++ b/fpdfsdk/cpdfsdk_helpers.h
@@ -12,6 +12,7 @@
 #include "build/build_config.h"
 #include "core/fpdfapi/page/cpdf_page.h"
 #include "core/fpdfapi/parser/cpdf_parser.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxge/cfx_path.h"
 #include "public/fpdf_doc.h"
@@ -266,13 +267,15 @@
 CFX_Matrix CFXMatrixFromFSMatrix(const FS_MATRIX& matrix);
 FS_MATRIX FSMatrixFromCFXMatrix(const CFX_Matrix& matrix);
 
-unsigned long NulTerminateMaybeCopyAndReturnLength(const ByteString& text,
-                                                   void* buffer,
-                                                   unsigned long buflen);
+UNSAFE_BUFFER_USAGE unsigned long NulTerminateMaybeCopyAndReturnLength(
+    const ByteString& text,
+    void* buffer,
+    unsigned long buflen);
 
-unsigned long Utf16EncodeMaybeCopyAndReturnLength(const WideString& text,
-                                                  void* buffer,
-                                                  unsigned long buflen);
+UNSAFE_BUFFER_USAGE unsigned long Utf16EncodeMaybeCopyAndReturnLength(
+    const WideString& text,
+    void* buffer,
+    unsigned long buflen);
 
 // Returns the length of the raw stream data from |stream|. The raw data is the
 // stream's data as stored in the PDF without applying any filters. If |buffer|
diff --git a/fpdfsdk/cpdfsdk_helpers_unittest.cpp b/fpdfsdk/cpdfsdk_helpers_unittest.cpp
index c2a42a3..492e3bc 100644
--- a/fpdfsdk/cpdfsdk_helpers_unittest.cpp
+++ b/fpdfsdk/cpdfsdk_helpers_unittest.cpp
@@ -18,30 +18,35 @@
     constexpr size_t kExpectedToBeCopiedLen = 10;
     ASSERT_EQ(kExpectedToBeCopiedLen, to_be_copied.GetLength());
 
+    // SAFETY: nullptr argument.
     EXPECT_EQ(kExpectedToBeCopiedLen + 1,
-              NulTerminateMaybeCopyAndReturnLength(to_be_copied, nullptr, 0));
+              UNSAFE_BUFFERS(NulTerminateMaybeCopyAndReturnLength(to_be_copied,
+                                                                  nullptr, 0)));
 
     // Buffer should not change if declared length is too short.
     char buf[kExpectedToBeCopiedLen + 1];
     // TODO(tsepez): convert to span.
     UNSAFE_BUFFERS(FXSYS_memset(buf, 0x42, kExpectedToBeCopiedLen + 1));
     ASSERT_EQ(kExpectedToBeCopiedLen + 1,
-              NulTerminateMaybeCopyAndReturnLength(to_be_copied, buf,
-                                                   kExpectedToBeCopiedLen));
+              UNSAFE_BUFFERS(NulTerminateMaybeCopyAndReturnLength(
+                  to_be_copied, buf, kExpectedToBeCopiedLen)));
     for (char c : buf)
       EXPECT_EQ(0x42, c);
 
     // Buffer should copy over if long enough.
+    // TODO(tsepez): convert to span.
     ASSERT_EQ(kExpectedToBeCopiedLen + 1,
-              NulTerminateMaybeCopyAndReturnLength(to_be_copied, buf,
-                                                   kExpectedToBeCopiedLen + 1));
+              UNSAFE_BUFFERS(NulTerminateMaybeCopyAndReturnLength(
+                  to_be_copied, buf, kExpectedToBeCopiedLen + 1)));
     EXPECT_EQ(to_be_copied, ByteString(buf));
   }
   {
     // Empty ByteString should still copy NUL terminator.
     const ByteString empty;
     char buf[1];
-    ASSERT_EQ(1u, NulTerminateMaybeCopyAndReturnLength(empty, buf, 1));
+    // TODO(tsepez): convert to span.
+    ASSERT_EQ(1u, UNSAFE_BUFFERS(
+                      NulTerminateMaybeCopyAndReturnLength(empty, buf, 1)));
     EXPECT_EQ(empty, ByteString(buf));
   }
 }
diff --git a/fpdfsdk/fpdf_doc.cpp b/fpdfsdk/fpdf_doc.cpp
index f548fd9..8f2ad24 100644
--- a/fpdfsdk/fpdf_doc.cpp
+++ b/fpdfsdk/fpdf_doc.cpp
@@ -31,9 +31,12 @@
 #include "core/fpdfdoc/cpdf_linklist.h"
 #include "core/fpdfdoc/cpdf_pagelabel.h"
 #include "core/fxcrt/check.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/containers/contains.h"
 #include "core/fxcrt/fx_memcpy_wrappers.h"
 #include "core/fxcrt/numerics/safe_conversions.h"
+#include "core/fxcrt/span.h"
+#include "core/fxcrt/span_util.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "public/fpdf_formfill.h"
 
@@ -231,21 +234,22 @@
                       void* buffer,
                       unsigned long buflen) {
   CPDF_Document* pDoc = CPDFDocumentFromFPDFDocument(document);
-  if (!pDoc)
+  if (!pDoc) {
     return 0;
-
+  }
   unsigned long type = FPDFAction_GetType(action);
-  if (type != PDFACTION_URI)
+  if (type != PDFACTION_URI) {
     return 0;
-
+  }
   CPDF_Action cAction(pdfium::WrapRetain(CPDFDictionaryFromFPDFAction(action)));
   ByteString path = cAction.GetURI(pDoc);
-
-  const unsigned long len =
-      pdfium::checked_cast<unsigned long>(path.GetLength() + 1);
-  if (buffer && len <= buflen)
-    FXSYS_memcpy(buffer, path.c_str(), len);
-  return len;
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), buflen));
+    fxcrt::try_spancpy(result_span, path.span_with_terminator());
+  }
+  return static_cast<unsigned long>(path.span_with_terminator().size());
 }
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFDest_GetDestPageIndex(FPDF_DOCUMENT document,
diff --git a/fpdfsdk/fpdf_editpage.cpp b/fpdfsdk/fpdf_editpage.cpp
index 7735261..4ee20b1 100644
--- a/fpdfsdk/fpdf_editpage.cpp
+++ b/fpdfsdk/fpdf_editpage.cpp
@@ -38,10 +38,12 @@
 #include "core/fpdfapi/render/cpdf_docrenderdata.h"
 #include "core/fpdfdoc/cpdf_annot.h"
 #include "core/fpdfdoc/cpdf_annotlist.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/fx_extension.h"
 #include "core/fxcrt/fx_memcpy_wrappers.h"
 #include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/span.h"
+#include "core/fxcrt/span_util.h"
 #include "core/fxcrt/stl_util.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "public/fpdf_formfill.h"
@@ -482,14 +484,14 @@
   if (!pObj || !pObj->IsString())
     return false;
 
-  ByteString result = pObj->GetString();
-  const unsigned long len =
-      pdfium::checked_cast<unsigned long>(result.GetLength());
-
-  if (buffer && len <= buflen)
-    FXSYS_memcpy(buffer, result.c_str(), len);
-
-  *out_buflen = len;
+  ByteString value = pObj->GetString();
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), buflen));
+    fxcrt::try_spancpy(result_span, value.span());
+  }
+  *out_buflen = pdfium::checked_cast<unsigned long>(value.span().size());
   return true;
 }
 
@@ -985,17 +987,18 @@
 FPDFPageObj_GetDashArray(FPDF_PAGEOBJECT page_object,
                          float* dash_array,
                          size_t dash_count) {
+  if (!dash_array) {
+    return false;
+  }
   auto* pPageObj = CPDFPageObjectFromFPDFPageObject(page_object);
-  if (!pPageObj || !dash_array)
+  if (!pPageObj) {
     return false;
+  }
 
+  // SAFETY: required from caller.
+  auto result_span = UNSAFE_BUFFERS(pdfium::make_span(dash_array, dash_count));
   auto dash_vector = pPageObj->graph_state().GetLineDashArray();
-  if (dash_vector.size() > dash_count)
-    return false;
-
-  FXSYS_memcpy(dash_array, dash_vector.data(),
-               dash_vector.size() * sizeof(float));
-  return true;
+  return fxcrt::try_spancpy(result_span, pdfium::make_span(dash_vector));
 }
 
 FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV
diff --git a/fpdfsdk/fpdf_edittext.cpp b/fpdfsdk/fpdf_edittext.cpp
index 617a6bc..e9595a4 100644
--- a/fpdfsdk/fpdf_edittext.cpp
+++ b/fpdfsdk/fpdf_edittext.cpp
@@ -856,14 +856,15 @@
   if (!pFont)
     return 0;
 
-  CFX_Font* pCfxFont = pFont->GetFont();
-  ByteString name = pCfxFont->GetFamilyName();
-  const unsigned long dwStringLen =
-      pdfium::checked_cast<unsigned long>(name.GetLength() + 1);
-  if (buffer && length >= dwStringLen)
-    FXSYS_memcpy(buffer, name.c_str(), dwStringLen);
-
-  return dwStringLen;
+  ByteString name = pFont->GetFont()->GetFamilyName();
+  pdfium::span<const char> name_span = name.span_with_terminator();
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(buffer, length));
+    fxcrt::try_spancpy(result_span, name_span);
+  }
+  return static_cast<unsigned long>(name_span.size());
 }
 
 FPDF_EXPORT FPDF_BOOL FPDF_CALLCONV FPDFFont_GetFontData(FPDF_FONT font,
@@ -874,9 +875,13 @@
   if (!cfont || !out_buflen)
     return false;
 
-  pdfium::span<uint8_t> data = cfont->GetFont()->GetFontSpan();
-  if (buffer && buflen >= data.size())
-    fxcrt::spancpy(pdfium::make_span(buffer, buflen), data);
+  pdfium::span<const uint8_t> data = cfont->GetFont()->GetFontSpan();
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<uint8_t> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(buffer, buflen));
+    fxcrt::try_spancpy(result_span, data);
+  }
   *out_buflen = data.size();
   return true;
 }
diff --git a/fpdfsdk/fpdf_formfill.cpp b/fpdfsdk/fpdf_formfill.cpp
index bc07d93..9ae2c77 100644
--- a/fpdfsdk/fpdf_formfill.cpp
+++ b/fpdfsdk/fpdf_formfill.cpp
@@ -519,11 +519,12 @@
                     void* buffer,
                     unsigned long buflen) {
   CPDFSDK_PageView* pPageView = FormHandleToPageView(hHandle, page);
-  if (!pPageView)
+  if (!pPageView) {
     return 0;
-
-  return Utf16EncodeMaybeCopyAndReturnLength(pPageView->GetFocusedFormText(),
-                                             buffer, buflen);
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(Utf16EncodeMaybeCopyAndReturnLength(
+      pPageView->GetFocusedFormText(), buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -532,11 +533,12 @@
                      void* buffer,
                      unsigned long buflen) {
   CPDFSDK_PageView* pPageView = FormHandleToPageView(hHandle, page);
-  if (!pPageView)
+  if (!pPageView) {
     return 0;
-
-  return Utf16EncodeMaybeCopyAndReturnLength(pPageView->GetSelectedText(),
-                                             buffer, buflen);
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(Utf16EncodeMaybeCopyAndReturnLength(
+      pPageView->GetSelectedText(), buffer, buflen));
 }
 
 FPDF_EXPORT void FPDF_CALLCONV
diff --git a/fpdfsdk/fpdf_javascript.cpp b/fpdfsdk/fpdf_javascript.cpp
index 6f61013..0377197 100644
--- a/fpdfsdk/fpdf_javascript.cpp
+++ b/fpdfsdk/fpdf_javascript.cpp
@@ -11,6 +11,7 @@
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfdoc/cpdf_action.h"
 #include "core/fpdfdoc/cpdf_nametree.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/numerics/safe_conversions.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 
@@ -73,9 +74,12 @@
                              unsigned long buflen) {
   CPDF_JavaScript* js =
       CPDFJavaScriptActionFromFPDFJavaScriptAction(javascript);
-  if (!js)
+  if (!js) {
     return 0;
-  return Utf16EncodeMaybeCopyAndReturnLength(js->name, buffer, buflen);
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(
+      Utf16EncodeMaybeCopyAndReturnLength(js->name, buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -84,7 +88,10 @@
                                unsigned long buflen) {
   CPDF_JavaScript* js =
       CPDFJavaScriptActionFromFPDFJavaScriptAction(javascript);
-  if (!js)
+  if (!js) {
     return 0;
-  return Utf16EncodeMaybeCopyAndReturnLength(js->script, buffer, buflen);
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(
+      Utf16EncodeMaybeCopyAndReturnLength(js->script, buffer, buflen));
 }
diff --git a/fpdfsdk/fpdf_signature.cpp b/fpdfsdk/fpdf_signature.cpp
index 6a36bf4..c7c41a7 100644
--- a/fpdfsdk/fpdf_signature.cpp
+++ b/fpdfsdk/fpdf_signature.cpp
@@ -16,8 +16,11 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_document.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/fx_memcpy_wrappers.h"
 #include "core/fxcrt/numerics/safe_conversions.h"
+#include "core/fxcrt/span.h"
+#include "core/fxcrt/span_util.h"
 #include "core/fxcrt/stl_util.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 
@@ -79,21 +82,22 @@
                              unsigned long length) {
   const CPDF_Dictionary* signature_dict =
       CPDFDictionaryFromFPDFSignature(signature);
-  if (!signature_dict)
+  if (!signature_dict) {
     return 0;
-
+  }
   RetainPtr<const CPDF_Dictionary> value_dict =
       signature_dict->GetDictFor(pdfium::form_fields::kV);
-  if (!value_dict)
+  if (!value_dict) {
     return 0;
-
+  }
   ByteString contents = value_dict->GetByteStringFor("Contents");
-  const unsigned long contents_len =
-      pdfium::checked_cast<unsigned long>(contents.GetLength());
-  if (buffer && length >= contents_len)
-    FXSYS_memcpy(buffer, contents.c_str(), contents_len);
-
-  return contents_len;
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), length));
+    fxcrt::try_spancpy(result_span, contents.span());
+  }
+  return pdfium::checked_cast<unsigned long>(contents.span().size());
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
diff --git a/fpdfsdk/fpdf_structtree.cpp b/fpdfsdk/fpdf_structtree.cpp
index 84afc5b..231f4b0 100644
--- a/fpdfsdk/fpdf_structtree.cpp
+++ b/fpdfsdk/fpdf_structtree.cpp
@@ -20,13 +20,15 @@
 
 namespace {
 
-unsigned long WideStringToBuffer(const WideString& str,
-                                 void* buffer,
-                                 unsigned long buflen) {
-  if (str.IsEmpty())
+UNSAFE_BUFFER_USAGE unsigned long WideStringToBuffer(const WideString& str,
+                                                     void* buffer,
+                                                     unsigned long buflen) {
+  if (str.IsEmpty()) {
     return 0;
-
-  return Utf16EncodeMaybeCopyAndReturnLength(str, buffer, buflen);
+  }
+  // SAFETY: required from caller and enforced by UNSAFE_BUFFER_USAGE.
+  return UNSAFE_BUFFERS(
+      Utf16EncodeMaybeCopyAndReturnLength(str, buffer, buflen));
 }
 
 int GetMcidFromDict(const CPDF_Dictionary* dict) {
@@ -85,7 +87,11 @@
                               unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  return elem ? WideStringToBuffer(elem->GetAltText(), buffer, buflen) : 0;
+  if (!elem) {
+    return 0;
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(WideStringToBuffer(elem->GetAltText(), buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -94,7 +100,12 @@
                                  unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  return elem ? WideStringToBuffer(elem->GetActualText(), buffer, buflen) : 0;
+  if (!elem) {
+    return 0;
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(
+      WideStringToBuffer(elem->GetActualText(), buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -103,12 +114,16 @@
                          unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  if (!elem)
+  if (!elem) {
     return 0;
+  }
   std::optional<WideString> id = elem->GetID();
-  if (!id.has_value())
+  if (!id.has_value()) {
     return 0;
-  return Utf16EncodeMaybeCopyAndReturnLength(id.value(), buffer, buflen);
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(
+      Utf16EncodeMaybeCopyAndReturnLength(id.value(), buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -117,12 +132,16 @@
                            unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  if (!elem)
+  if (!elem) {
     return 0;
+  }
   std::optional<WideString> lang = elem->GetLang();
-  if (!lang.has_value())
+  if (!lang.has_value()) {
     return 0;
-  return Utf16EncodeMaybeCopyAndReturnLength(lang.value(), buffer, buflen);
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(
+      Utf16EncodeMaybeCopyAndReturnLength(lang.value(), buffer, buflen));
 }
 
 FPDF_EXPORT int FPDF_CALLCONV
@@ -191,13 +210,16 @@
   CPDF_ArrayLocker locker(array);
   for (const RetainPtr<CPDF_Object>& obj : locker) {
     const CPDF_Dictionary* obj_dict = obj->AsDictionary();
-    if (!obj_dict)
+    if (!obj_dict) {
       continue;
+    }
     RetainPtr<const CPDF_Object> attr = obj_dict->GetObjectFor(attr_name);
-    if (!attr || !(attr->IsString() || attr->IsName()))
+    if (!attr || !(attr->IsString() || attr->IsName())) {
       continue;
-    return Utf16EncodeMaybeCopyAndReturnLength(attr->GetUnicodeText(), buffer,
-                                               buflen);
+    }
+    // SAFETY: required from caller.
+    return UNSAFE_BUFFERS(Utf16EncodeMaybeCopyAndReturnLength(
+        attr->GetUnicodeText(), buffer, buflen));
   }
   return 0;
 }
@@ -218,10 +240,12 @@
                            unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  return elem ? WideStringToBuffer(
-                    WideString::FromUTF8(elem->GetType().AsStringView()),
-                    buffer, buflen)
-              : 0;
+  if (!elem) {
+    return 0;
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(WideStringToBuffer(
+      WideString::FromUTF8(elem->GetType().AsStringView()), buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -230,10 +254,12 @@
                               unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  return elem ? WideStringToBuffer(
-                    WideString::FromUTF8(elem->GetObjType().AsStringView()),
-                    buffer, buflen)
-              : 0;
+  if (!elem) {
+    return 0;
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(WideStringToBuffer(
+      WideString::FromUTF8(elem->GetObjType().AsStringView()), buffer, buflen));
 }
 
 FPDF_EXPORT unsigned long FPDF_CALLCONV
@@ -242,7 +268,11 @@
                             unsigned long buflen) {
   CPDF_StructElement* elem =
       CPDFStructElementFromFPDFStructElement(struct_element);
-  return elem ? WideStringToBuffer(elem->GetTitle(), buffer, buflen) : 0;
+  if (!elem) {
+    return 0;
+  }
+  // SAFETY: required from caller.
+  return UNSAFE_BUFFERS(WideStringToBuffer(elem->GetTitle(), buffer, buflen));
 }
 
 FPDF_EXPORT int FPDF_CALLCONV
@@ -317,8 +347,9 @@
   CPDF_DictionaryLocker locker(dict);
   for (auto& it : locker) {
     if (index == 0) {
-      *out_buflen =
-          NulTerminateMaybeCopyAndReturnLength(it.first, buffer, buflen);
+      // SAFETY: required from caller.
+      *out_buflen = UNSAFE_BUFFERS(
+          NulTerminateMaybeCopyAndReturnLength(it.first, buffer, buflen));
       return true;
     }
     --index;
@@ -396,8 +427,9 @@
   if (!obj || !(obj->IsString() || obj->IsName()))
     return false;
 
-  *out_buflen = Utf16EncodeMaybeCopyAndReturnLength(
-      WideString::FromUTF8(obj->GetString().AsStringView()), buffer, buflen);
+  // SAFETY: required from caller.
+  *out_buflen = UNSAFE_BUFFERS(Utf16EncodeMaybeCopyAndReturnLength(
+      WideString::FromUTF8(obj->GetString().AsStringView()), buffer, buflen));
   return true;
 }
 
@@ -419,16 +451,14 @@
   if (!obj || !obj->IsString())
     return false;
 
-  ByteString result = obj->GetString();
-  const unsigned long len =
-      pdfium::checked_cast<unsigned long>(result.GetLength());
-
-  // TODO(tsepez): convert to span.
-  if (buffer && len <= buflen) {
-    // SAFETY: check above.
-    UNSAFE_BUFFERS(FXSYS_memcpy(buffer, result.c_str(), len));
+  ByteString blob_value = obj->GetString();
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), buflen));
+    fxcrt::try_spancpy(result_span, blob_value.span());
   }
-  *out_buflen = len;
+  *out_buflen = pdfium::checked_cast<unsigned long>(blob_value.span().size());
   return true;
 }
 
diff --git a/fpdfsdk/fpdf_text.cpp b/fpdfsdk/fpdf_text.cpp
index fd3cabe..524bdf8 100644
--- a/fpdfsdk/fpdf_text.cpp
+++ b/fpdfsdk/fpdf_text.cpp
@@ -133,15 +133,14 @@
     *flags = font->GetFontFlags();
 
   ByteString basefont = font->GetBaseFontName();
-  const unsigned long length =
-      pdfium::checked_cast<unsigned long>(basefont.GetLength() + 1);
-
-  // TODO(tsepez): convert to span.
-  if (buffer && length <= buflen) {
-    // SAFETY: check above.
-    UNSAFE_BUFFERS(FXSYS_memcpy(buffer, basefont.c_str(), length));
+  auto basefont_span = basefont.span_with_terminator();
+  if (buffer) {
+    // SAFETY: required from caller.
+    pdfium::span<char> result_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), buflen));
+    fxcrt::try_spancpy(result_span, basefont_span);
   }
-  return length;
+  return pdfium::checked_cast<unsigned long>(basefont_span.size());
 }
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFText_GetFontWeight(FPDF_TEXTPAGE text_page,
@@ -347,10 +346,11 @@
 
   // Includes two-byte terminator in string data itself.
   ByteString str = textpage->GetPageText(start_index, char_count).ToUCS2LE();
-  pdfium::span<const char> str_span = str.AsStringView().span();
-  auto copy_span = fxcrt::reinterpret_span<const unsigned short>(str_span);
-  fxcrt::spancpy(result_span, copy_span);
-  return static_cast<int>(copy_span.size());
+  auto str_span = fxcrt::reinterpret_span<const unsigned short>(str.span());
+
+  // Hard CHECK() in spancpy if retrieved text is too long.
+  fxcrt::spancpy(result_span, str_span);
+  return pdfium::checked_cast<int>(str_span.size());
 }
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFText_CountRects(FPDF_TEXTPAGE text_page,
@@ -506,18 +506,19 @@
     wsUrl = pageLink->GetURL(link_index);
   }
   ByteString cbUTF16URL = wsUrl.ToUTF16LE();
-  int required = pdfium::checked_cast<int>(cbUTF16URL.GetLength() /
-                                           sizeof(unsigned short));
-  if (!buffer || buflen <= 0)
-    return required;
-
-  int size = std::min(required, buflen);
-  if (size > 0) {
-    int buf_size = size * sizeof(unsigned short);
-    // TODO(tsepez): invesstigate safety.
-    UNSAFE_BUFFERS(FXSYS_memcpy(buffer, cbUTF16URL.c_str(), buf_size));
+  auto url_span =
+      fxcrt::reinterpret_span<const unsigned short>(cbUTF16URL.span());
+  if (!buffer || buflen <= 0) {
+    return pdfium::checked_cast<int>(url_span.size());
   }
-  return size;
+
+  // SAFETY: required from caller.
+  pdfium::span<unsigned short> result_span =
+      UNSAFE_BUFFERS(pdfium::make_span(buffer, buflen));
+
+  size_t size = std::min(url_span.size(), result_span.size());
+  fxcrt::spancpy(result_span, url_span.first(size));
+  return pdfium::checked_cast<int>(size);
 }
 
 FPDF_EXPORT int FPDF_CALLCONV FPDFLink_CountRects(FPDF_PAGELINK link_page,
diff --git a/fpdfsdk/fpdf_view.cpp b/fpdfsdk/fpdf_view.cpp
index 70b24ed..3f9a7f0 100644
--- a/fpdfsdk/fpdf_view.cpp
+++ b/fpdfsdk/fpdf_view.cpp
@@ -38,6 +38,7 @@
 #include "core/fxcrt/cfx_read_only_span_stream.h"
 #include "core/fxcrt/cfx_timer.h"
 #include "core/fxcrt/check_op.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/fx_memcpy_wrappers.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "core/fxcrt/fx_stream.h"
@@ -1187,13 +1188,18 @@
     return 0;
   }
 
-  if (bstr->str && bstr->len < length)
-    bstr->str = FX_Realloc(char, bstr->str, length + 1);
-  else if (!bstr->str)
+  if (!bstr->str) {
     bstr->str = FX_Alloc(char, length + 1);
+  } else if (bstr->len < length) {
+    bstr->str = FX_Realloc(char, bstr->str, length + 1);
+  }
 
-  bstr->str[length] = 0;
-  FXSYS_memcpy(bstr->str, cstr, length);
+  // SAFETY: only alloc/realloc is performed above and will ensure at least
+  // length + 1 bytes are available.
+  UNSAFE_BUFFERS({
+    bstr->str[length] = 0;
+    FXSYS_memcpy(bstr->str, cstr, length);
+  });
   bstr->len = length;
   return 0;
 }
@@ -1275,7 +1281,10 @@
   if (!buffer) {
     *buflen = len;
   } else if (len <= *buflen) {
-    FXSYS_memcpy(buffer, utf16Name.c_str(), len);
+    // SAFETY: required from caller.
+    auto buffer_span =
+        UNSAFE_BUFFERS(pdfium::make_span(static_cast<char*>(buffer), *buflen));
+    fxcrt::spancpy(buffer_span, utf16Name.span());
     *buflen = len;
   } else {
     *buflen = -1;
diff --git a/fpdfsdk/fpdf_view_embeddertest.cpp b/fpdfsdk/fpdf_view_embeddertest.cpp
index 0c58bd4..ddd75a3 100644
--- a/fpdfsdk/fpdf_view_embeddertest.cpp
+++ b/fpdfsdk/fpdf_view_embeddertest.cpp
@@ -698,8 +698,7 @@
   EXPECT_STREQ("ABCD", buf);
 
   // Note "Foo" is a different key from "foo".
-  EXPECT_EQ(4U,
-            FPDF_VIEWERREF_GetName(document(), "Foo", nullptr, sizeof(buf)));
+  EXPECT_EQ(4U, FPDF_VIEWERREF_GetName(document(), "Foo", nullptr, 0));
   ASSERT_EQ(4U, FPDF_VIEWERREF_GetName(document(), "Foo", buf, sizeof(buf)));
   EXPECT_STREQ("foo", buf);
 
diff --git a/public/fpdfview.h b/public/fpdfview.h
index e1b3a32..f7d8ea6 100644
--- a/public/fpdfview.h
+++ b/public/fpdfview.h
@@ -1309,14 +1309,14 @@
 //          document    -   Handle to the loaded document.
 //          key         -   Name of the key in the viewer pref dictionary,
 //                          encoded in UTF-8.
-//          buffer      -   A string to write the contents of the key to.
+//          buffer      -   Caller-allocate buffer to receive the key, or NULL
+//                      -   to query the required length.
 //          length      -   Length of the buffer.
 // Return value:
 //          The number of bytes in the contents, including the NULL terminator.
 //          Thus if the return value is 0, then that indicates an error, such
-//          as when |document| is invalid or |buffer| is NULL. If |length| is
-//          less than the returned length, or |buffer| is NULL, |buffer| will
-//          not be modified.
+//          as when |document| is invalid. If |length| is less than the required
+//          length, or |buffer| is NULL, |buffer| will not be modified.
 FPDF_EXPORT unsigned long FPDF_CALLCONV
 FPDF_VIEWERREF_GetName(FPDF_DOCUMENT document,
                        FPDF_BYTESTRING key,