diff --git a/core/fpdfapi/page/cpdf_docpagedata.cpp b/core/fpdfapi/page/cpdf_docpagedata.cpp
index 5199f76..a2ed1b9 100644
--- a/core/fpdfapi/page/cpdf_docpagedata.cpp
+++ b/core/fpdfapi/page/cpdf_docpagedata.cpp
@@ -72,7 +72,7 @@
   if (size != GDI_ERROR) {
     LPBYTE buffer = FX_Alloc(BYTE, size);
     ::GetFontData(hDC, 'eman', 0, buffer, size);
-    result = GetNameFromTT(buffer, size, 6);
+    result = GetNameFromTT({buffer, size}, 6);
     FX_Free(buffer);
   }
   return result;
diff --git a/core/fxge/android/cfpf_skiafont.cpp b/core/fxge/android/cfpf_skiafont.cpp
index eb299fb..1c4eece 100644
--- a/core/fxge/android/cfpf_skiafont.cpp
+++ b/core/fxge/android/cfpf_skiafont.cpp
@@ -151,13 +151,12 @@
 }
 
 uint32_t CFPF_SkiaFont::GetFontData(uint32_t dwTable,
-                                    uint8_t* pBuffer,
-                                    uint32_t dwSize) {
+                                    pdfium::span<uint8_t> pBuffer) {
   if (!m_Face)
     return 0;
 
-  FT_ULong ulSize = pdfium::base::checked_cast<FT_ULong>(dwSize);
-  if (FT_Load_Sfnt_Table(GetFaceRec(), dwTable, 0, pBuffer, &ulSize))
+  FT_ULong ulSize = pdfium::base::checked_cast<FT_ULong>(pBuffer.size());
+  if (FT_Load_Sfnt_Table(GetFaceRec(), dwTable, 0, pBuffer.data(), &ulSize))
     return 0;
   return pdfium::base::checked_cast<uint32_t>(ulSize);
 }
diff --git a/core/fxge/android/cfpf_skiafont.h b/core/fxge/android/cfpf_skiafont.h
index 67204d3..702a38e 100644
--- a/core/fxge/android/cfpf_skiafont.h
+++ b/core/fxge/android/cfpf_skiafont.h
@@ -12,6 +12,7 @@
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/cfx_face.h"
 #include "core/fxge/fx_freetype.h"
+#include "third_party/base/span.h"
 
 class CFPF_SkiaFontMgr;
 class CFPF_SkiaPathFont;
@@ -39,7 +40,7 @@
   bool GetBBox(FX_RECT& rtBBox);
   int32_t GetHeight() const;
   int32_t GetItalicAngle() const;
-  uint32_t GetFontData(uint32_t dwTable, uint8_t* pBuffer, uint32_t dwSize);
+  uint32_t GetFontData(uint32_t dwTable, pdfium::span<uint8_t> pBuffer);
   FXFT_FaceRec* GetFaceRec() const { return m_Face->GetRec(); }
 
  private:
diff --git a/core/fxge/android/cfx_androidfontinfo.cpp b/core/fxge/android/cfx_androidfontinfo.cpp
index 63170f9..b033eab 100644
--- a/core/fxge/android/cfx_androidfontinfo.cpp
+++ b/core/fxge/android/cfx_androidfontinfo.cpp
@@ -55,11 +55,10 @@
 
 uint32_t CFX_AndroidFontInfo::GetFontData(void* hFont,
                                           uint32_t table,
-                                          uint8_t* buffer,
-                                          uint32_t size) {
+                                          pdfium::span<uint8_t> buffer) {
   if (!hFont)
     return 0;
-  return static_cast<CFPF_SkiaFont*>(hFont)->GetFontData(table, buffer, size);
+  return static_cast<CFPF_SkiaFont*>(hFont)->GetFontData(table, buffer);
 }
 
 bool CFX_AndroidFontInfo::GetFaceName(void* hFont, ByteString* name) {
diff --git a/core/fxge/android/cfx_androidfontinfo.h b/core/fxge/android/cfx_androidfontinfo.h
index 86b0d34..c8b6d24 100644
--- a/core/fxge/android/cfx_androidfontinfo.h
+++ b/core/fxge/android/cfx_androidfontinfo.h
@@ -11,6 +11,7 @@
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/cfx_fontmapper.h"
 #include "core/fxge/systemfontinfo_iface.h"
+#include "third_party/base/span.h"
 
 class CFPF_SkiaFontMgr;
 
@@ -31,8 +32,7 @@
   void* GetFont(const char* face) override;
   uint32_t GetFontData(void* hFont,
                        uint32_t table,
-                       uint8_t* buffer,
-                       uint32_t size) override;
+                       pdfium::span<uint8_t> buffer) override;
   bool GetFaceName(void* hFont, ByteString* name) override;
   bool GetFontCharset(void* hFont, int* charset) override;
   void DeleteFont(void* hFont) override;
diff --git a/core/fxge/cfx_folderfontinfo.cpp b/core/fxge/cfx_folderfontinfo.cpp
index 6483859..cc33723 100644
--- a/core/fxge/cfx_folderfontinfo.cpp
+++ b/core/fxge/cfx_folderfontinfo.cpp
@@ -227,11 +227,11 @@
   if (names.IsEmpty())
     return;
 
-  ByteString facename = GetNameFromTT(names.raw_str(), names.GetLength(), 1);
+  ByteString facename = GetNameFromTT(names.AsRawSpan(), 1);
   if (facename.IsEmpty())
     return;
 
-  ByteString style = GetNameFromTT(names.raw_str(), names.GetLength(), 2);
+  ByteString style = GetNameFromTT(names.AsRawSpan(), 2);
   if (style != "Regular")
     facename += " " + style;
 
@@ -343,8 +343,7 @@
 
 uint32_t CFX_FolderFontInfo::GetFontData(void* hFont,
                                          uint32_t table,
-                                         uint8_t* buffer,
-                                         uint32_t size) {
+                                         pdfium::span<uint8_t> buffer) {
   if (!hFont)
     return 0;
 
@@ -366,7 +365,7 @@
     }
   }
 
-  if (!datasize || size < datasize)
+  if (!datasize || buffer.size() < datasize)
     return datasize;
 
   std::unique_ptr<FILE, FxFileCloser> pFile(
@@ -375,7 +374,7 @@
     return 0;
 
   if (fseek(pFile.get(), offset, SEEK_SET) < 0 ||
-      fread(buffer, datasize, 1, pFile.get()) != 1) {
+      fread(buffer.data(), datasize, 1, pFile.get()) != 1) {
     return 0;
   }
   return datasize;
diff --git a/core/fxge/cfx_folderfontinfo.h b/core/fxge/cfx_folderfontinfo.h
index 1f98301..e30f298 100644
--- a/core/fxge/cfx_folderfontinfo.h
+++ b/core/fxge/cfx_folderfontinfo.h
@@ -38,8 +38,7 @@
   void* GetFont(const char* face) override;
   uint32_t GetFontData(void* hFont,
                        uint32_t table,
-                       uint8_t* buffer,
-                       uint32_t size) override;
+                       pdfium::span<uint8_t> buffer) override;
   void DeleteFont(void* hFont) override;
   bool GetFaceName(void* hFont, ByteString* name) override;
   bool GetFontCharset(void* hFont, int* charset) override;
diff --git a/core/fxge/cfx_fontmapper.cpp b/core/fxge/cfx_fontmapper.cpp
index ef79e6f..6d0322a 100644
--- a/core/fxge/cfx_fontmapper.cpp
+++ b/core/fxge/cfx_fontmapper.cpp
@@ -271,8 +271,8 @@
 
 uint32_t CFX_FontMapper::GetChecksumFromTT(void* hFont) {
   uint32_t buffer[256];
-  m_pFontInfo->GetFontData(hFont, kTableTTCF,
-                           reinterpret_cast<uint8_t*>(buffer), sizeof(buffer));
+  m_pFontInfo->GetFontData(
+      hFont, kTableTTCF, pdfium::as_writable_bytes(pdfium::make_span(buffer)));
 
   uint32_t checksum = 0;
   for (auto x : buffer)
@@ -282,16 +282,13 @@
 }
 
 ByteString CFX_FontMapper::GetPSNameFromTT(void* hFont) {
-  uint32_t size = m_pFontInfo->GetFontData(hFont, kTableNAME, nullptr, 0);
+  uint32_t size = m_pFontInfo->GetFontData(hFont, kTableNAME, {});
   if (!size)
     return ByteString();
 
   std::vector<uint8_t> buffer(size);
-  uint8_t* buffer_ptr = buffer.data();
-  uint32_t bytes_read =
-      m_pFontInfo->GetFontData(hFont, kTableNAME, buffer_ptr, size);
-  return bytes_read == size ? GetNameFromTT(buffer_ptr, bytes_read, 6)
-                            : ByteString();
+  uint32_t bytes_read = m_pFontInfo->GetFontData(hFont, kTableNAME, buffer);
+  return bytes_read == size ? GetNameFromTT(buffer, 6) : ByteString();
 }
 
 void CFX_FontMapper::AddInstalledFont(const ByteString& name, int charset) {
@@ -629,8 +626,8 @@
   m_pFontInfo->GetFaceName(hFont, &SubstName);
   if (Charset == FX_CHARSET_Default)
     m_pFontInfo->GetFontCharset(hFont, &Charset);
-  uint32_t ttc_size = m_pFontInfo->GetFontData(hFont, kTableTTCF, nullptr, 0);
-  uint32_t font_size = m_pFontInfo->GetFontData(hFont, 0, nullptr, 0);
+  uint32_t ttc_size = m_pFontInfo->GetFontData(hFont, kTableTTCF, {});
+  uint32_t font_size = m_pFontInfo->GetFontData(hFont, 0, {});
   if (font_size == 0 && ttc_size == 0) {
     m_pFontInfo->DeleteFont(hFont);
     return nullptr;
@@ -689,7 +686,7 @@
   if (!pFontDesc) {
     std::unique_ptr<uint8_t, FxFreeDeleter> pFontData(
         FX_Alloc(uint8_t, ttc_size));
-    m_pFontInfo->GetFontData(hFont, kTableTTCF, pFontData.get(), ttc_size);
+    m_pFontInfo->GetFontData(hFont, kTableTTCF, {pFontData.get(), ttc_size});
     pFontDesc = m_pFontMgr->AddCachedTTCFontDesc(
         ttc_size, checksum, std::move(pFontData), ttc_size);
   }
@@ -720,7 +717,7 @@
   if (!pFontDesc) {
     std::unique_ptr<uint8_t, FxFreeDeleter> pFontData(
         FX_Alloc(uint8_t, font_size));
-    m_pFontInfo->GetFontData(hFont, 0, pFontData.get(), font_size);
+    m_pFontInfo->GetFontData(hFont, 0, {pFontData.get(), font_size});
     pFontDesc = m_pFontMgr->AddCachedFontDesc(SubstName, weight, bItalic,
                                               std::move(pFontData), font_size);
   }
diff --git a/core/fxge/fx_font.cpp b/core/fxge/fx_font.cpp
index 940f9ea..fc47a33c 100644
--- a/core/fxge/fx_font.cpp
+++ b/core/fxge/fx_font.cpp
@@ -13,14 +13,14 @@
 
 namespace {
 
-ByteString GetStringFromTable(const uint8_t* string_ptr,
-                              uint32_t string_ptr_length,
+ByteString GetStringFromTable(pdfium::span<const uint8_t> string_span,
                               uint16_t offset,
                               uint16_t length) {
-  if (string_ptr_length < static_cast<uint32_t>(offset + length)) {
+  if (string_span.size() < static_cast<uint32_t>(offset + length))
     return ByteString();
-  }
-  return ByteString(string_ptr + offset, length);
+
+  string_span = string_span.subspan(offset, length);
+  return ByteString(string_span.data(), string_span.size());
 }
 
 }  // namespace
@@ -69,34 +69,30 @@
   return rect;
 }
 
-ByteString GetNameFromTT(const uint8_t* name_table,
-                         uint32_t name_table_size,
+ByteString GetNameFromTT(pdfium::span<const uint8_t> name_table,
                          uint32_t name_id) {
-  if (!name_table || name_table_size < 6) {
+  if (name_table.size() < 6)
     return ByteString();
-  }
-  uint32_t name_count = GET_TT_SHORT(name_table + 2);
-  uint32_t string_offset = GET_TT_SHORT(name_table + 4);
+
+  uint32_t name_count = GET_TT_SHORT(&name_table[2]);
+  uint32_t string_offset = GET_TT_SHORT(&name_table[4]);
   // We will ignore the possibility of overlap of structures and
   // string table as if it's all corrupt there's not a lot we can do.
-  if (name_table_size < string_offset) {
+  if (name_table.size() < string_offset)
     return ByteString();
-  }
 
-  const uint8_t* string_ptr = name_table + string_offset;
-  uint32_t string_ptr_size = name_table_size - string_offset;
-  name_table += 6;
-  name_table_size -= 6;
-  if (name_table_size < name_count * 12) {
+  pdfium::span<const uint8_t> string_span = name_table.subspan(string_offset);
+  name_table = name_table.subspan(6);
+  if (name_table.size() < name_count * 12)
     return ByteString();
-  }
 
-  for (uint32_t i = 0; i < name_count; i++, name_table += 12) {
-    if (GET_TT_SHORT(name_table + 6) == name_id &&
-        GET_TT_SHORT(name_table) == 1 && GET_TT_SHORT(name_table + 2) == 0) {
-      return GetStringFromTable(string_ptr, string_ptr_size,
-                                GET_TT_SHORT(name_table + 10),
-                                GET_TT_SHORT(name_table + 8));
+  for (uint32_t i = 0; i < name_count;
+       i++, name_table = name_table.subspan(12)) {
+    if (GET_TT_SHORT(&name_table[6]) == name_id &&
+        GET_TT_SHORT(&name_table[0]) == 1 &&
+        GET_TT_SHORT(&name_table[2]) == 0) {
+      return GetStringFromTable(string_span, GET_TT_SHORT(&name_table[10]),
+                                GET_TT_SHORT(&name_table[8]));
     }
   }
   return ByteString();
diff --git a/core/fxge/fx_font.h b/core/fxge/fx_font.h
index f9f33ac..78bed86 100644
--- a/core/fxge/fx_font.h
+++ b/core/fxge/fx_font.h
@@ -55,10 +55,7 @@
 
 FX_RECT GetGlyphsBBox(const std::vector<TextGlyphPos>& glyphs, int anti_alias);
 
-ByteString GetNameFromTT(const uint8_t* name_table,
-                         uint32_t name_table_size,
-                         uint32_t name);
-
+ByteString GetNameFromTT(pdfium::span<const uint8_t> name_table, uint32_t name);
 int GetTTCIndex(pdfium::span<const uint8_t> pFontData, uint32_t font_offset);
 
 inline bool FontStyleIsBold(uint32_t style) {
diff --git a/core/fxge/systemfontinfo_iface.h b/core/fxge/systemfontinfo_iface.h
index bfd1538..520d737 100644
--- a/core/fxge/systemfontinfo_iface.h
+++ b/core/fxge/systemfontinfo_iface.h
@@ -10,6 +10,7 @@
 #include <memory>
 
 #include "core/fxge/cfx_fontmapper.h"
+#include "third_party/base/span.h"
 
 const uint32_t kTableNAME = FXDWORD_GET_MSBFIRST("name");
 const uint32_t kTableTTCF = FXDWORD_GET_MSBFIRST("ttcf");
@@ -38,8 +39,7 @@
   virtual void* GetFont(const char* face) = 0;
   virtual uint32_t GetFontData(void* hFont,
                                uint32_t table,
-                               uint8_t* buffer,
-                               uint32_t size) = 0;
+                               pdfium::span<uint8_t> buffer) = 0;
   virtual bool GetFaceName(void* hFont, ByteString* name) = 0;
   virtual bool GetFontCharset(void* hFont, int* charset) = 0;
   virtual int GetFaceIndex(void* hFont);
diff --git a/core/fxge/win32/fx_win32_device.cpp b/core/fxge/win32/fx_win32_device.cpp
index a73c903..7d57f40 100644
--- a/core/fxge/win32/fx_win32_device.cpp
+++ b/core/fxge/win32/fx_win32_device.cpp
@@ -27,6 +27,7 @@
 #include "core/fxge/win32/cfx_windowsdib.h"
 #include "core/fxge/win32/win32_int.h"
 #include "third_party/base/ptr_util.h"
+#include "third_party/base/span.h"
 #include "third_party/base/win/win_util.h"
 
 #ifndef _SKIA_SUPPORT_
@@ -326,8 +327,7 @@
   void* GetFont(const char* face) override { return nullptr; }
   uint32_t GetFontData(void* hFont,
                        uint32_t table,
-                       uint8_t* buffer,
-                       uint32_t size) override;
+                       pdfium::span<uint8_t> buffer) override;
   bool GetFaceName(void* hFont, ByteString* name) override;
   bool GetFontCharset(void* hFont, int* charset) override;
   void DeleteFont(void* hFont) override;
@@ -363,10 +363,10 @@
 bool CFX_Win32FontInfo::IsOpenTypeFromDiv(const LOGFONTA* plf) {
   HFONT hFont = CreateFontIndirectA(plf);
   bool ret = false;
-  uint32_t font_size = GetFontData(hFont, 0, nullptr, 0);
+  uint32_t font_size = GetFontData(hFont, 0, {});
   if (font_size != GDI_ERROR && font_size >= sizeof(uint32_t)) {
     uint32_t lVersion = 0;
-    GetFontData(hFont, 0, (uint8_t*)(&lVersion), sizeof(uint32_t));
+    GetFontData(hFont, 0, {(uint8_t*)(&lVersion), sizeof(uint32_t)});
     lVersion = (((uint32_t)(uint8_t)(lVersion)) << 24) |
                ((uint32_t)((uint8_t)(lVersion >> 8))) << 16 |
                ((uint32_t)((uint8_t)(lVersion >> 16))) << 8 |
@@ -384,10 +384,10 @@
 bool CFX_Win32FontInfo::IsSupportFontFormDiv(const LOGFONTA* plf) {
   HFONT hFont = CreateFontIndirectA(plf);
   bool ret = false;
-  uint32_t font_size = GetFontData(hFont, 0, nullptr, 0);
+  uint32_t font_size = GetFontData(hFont, 0, {});
   if (font_size != GDI_ERROR && font_size >= sizeof(uint32_t)) {
     uint32_t lVersion = 0;
-    GetFontData(hFont, 0, (uint8_t*)(&lVersion), sizeof(uint32_t));
+    GetFontData(hFont, 0, {(uint8_t*)(&lVersion), sizeof(lVersion)});
     lVersion = (((uint32_t)(uint8_t)(lVersion)) << 24) |
                ((uint32_t)((uint8_t)(lVersion >> 8))) << 16 |
                ((uint32_t)((uint8_t)(lVersion >> 16))) << 8 |
@@ -627,11 +627,10 @@
 
 uint32_t CFX_Win32FontInfo::GetFontData(void* hFont,
                                         uint32_t table,
-                                        uint8_t* buffer,
-                                        uint32_t size) {
+                                        pdfium::span<uint8_t> buffer) {
   HFONT hOldFont = (HFONT)::SelectObject(m_hDC, (HFONT)hFont);
   table = FXDWORD_GET_MSBFIRST(reinterpret_cast<uint8_t*>(&table));
-  size = ::GetFontData(m_hDC, table, 0, buffer, size);
+  uint32_t size = ::GetFontData(m_hDC, table, 0, buffer.data(), buffer.size());
   ::SelectObject(m_hDC, hOldFont);
   if (size == GDI_ERROR) {
     return 0;
diff --git a/fpdfsdk/fpdf_sysfontinfo.cpp b/fpdfsdk/fpdf_sysfontinfo.cpp
index 220cb6d..31fc64c 100644
--- a/fpdfsdk/fpdf_sysfontinfo.cpp
+++ b/fpdfsdk/fpdf_sysfontinfo.cpp
@@ -69,11 +69,11 @@
 
   uint32_t GetFontData(void* hFont,
                        uint32_t table,
-                       uint8_t* buffer,
-                       uint32_t size) override {
+                       pdfium::span<uint8_t> buffer) override {
     if (!m_pInfo->GetFontData)
       return 0;
-    return m_pInfo->GetFontData(m_pInfo, hFont, table, buffer, size);
+    return m_pInfo->GetFontData(m_pInfo, hFont, table, buffer.data(),
+                                buffer.size());
   }
 
   bool GetFaceName(void* hFont, ByteString* name) override {
@@ -163,7 +163,7 @@
                                         unsigned char* buffer,
                                         unsigned long buf_size) {
   auto* pDefault = static_cast<FPDF_SYSFONTINFO_DEFAULT*>(pThis);
-  return pDefault->m_pFontInfo->GetFontData(hFont, table, buffer, buf_size);
+  return pDefault->m_pFontInfo->GetFontData(hFont, table, {buffer, buf_size});
 }
 
 static unsigned long DefaultGetFaceName(struct _FPDF_SYSFONTINFO* pThis,
diff --git a/xfa/fgas/font/cfgas_fontmgr.cpp b/xfa/fgas/font/cfgas_fontmgr.cpp
index 401db99..bdd5ddc 100644
--- a/xfa/fgas/font/cfgas_fontmgr.cpp
+++ b/xfa/fgas/font/cfgas_fontmgr.cpp
@@ -453,14 +453,14 @@
   if (!hFont)
     return nullptr;
 
-  uint32_t dwFileSize = pSystemFontInfo->GetFontData(hFont, 0, nullptr, 0);
+  uint32_t dwFileSize = pSystemFontInfo->GetFontData(hFont, 0, {});
   if (dwFileSize == 0)
     return nullptr;
 
   std::unique_ptr<uint8_t, FxFreeDeleter> pBuffer(
       FX_Alloc(uint8_t, dwFileSize + 1));
   dwFileSize =
-      pSystemFontInfo->GetFontData(hFont, 0, pBuffer.get(), dwFileSize);
+      pSystemFontInfo->GetFontData(hFont, 0, {pBuffer.get(), dwFileSize});
   return pdfium::MakeRetain<CFX_MemoryStream>(std::move(pBuffer), dwFileSize);
 }