diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 8219bab..e96bf8f 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -431,33 +431,32 @@
     return 0;
   }
 
-  uint8_t* pos =
-      UNSAFE_TODO(buffer_.Get() + y * GetPitch() + offset.ValueOrDie());
+  auto pos = GetScanline(y).subspan(offset.ValueOrDie());
   switch (GetFormat()) {
     case FXDIB_Format::kInvalid:
       return 0;
     case FXDIB_Format::k1bppMask: {
-      if ((*pos) & (1 << (7 - x % 8))) {
+      if ((pos[0]) & (1 << (7 - x % 8))) {
         return 0xff000000;
       }
       return 0;
     }
     case FXDIB_Format::k1bppRgb: {
-      if ((*pos) & (1 << (7 - x % 8))) {
+      if ((pos[0]) & (1 << (7 - x % 8))) {
         return HasPalette() ? GetPaletteSpan()[1] : 0xffffffff;
       }
       return HasPalette() ? GetPaletteSpan()[0] : 0xff000000;
     }
     case FXDIB_Format::k8bppMask:
-      return (*pos) << 24;
+      return (pos[0]) << 24;
     case FXDIB_Format::k8bppRgb:
-      return HasPalette() ? GetPaletteSpan()[*pos]
-                          : ArgbEncode(0xff, *pos, *pos, *pos);
+      return HasPalette() ? GetPaletteSpan()[pos[0]]
+                          : ArgbEncode(0xff, pos[0], pos[0], pos[0]);
     case FXDIB_Format::kBgr:
     case FXDIB_Format::kBgrx:
-      return UNSAFE_TODO(FXARGB_GetDIB(pos) | 0xff000000);
+      return FXARGB_GetDIB(pos.first<4u>()) | 0xff000000;
     case FXDIB_Format::kBgra:
-      return UNSAFE_TODO(FXARGB_GetDIB(pos));
+      return FXARGB_GetDIB(pos.first<4u>());
     case FXDIB_Format::kBgraPremul: {
       // TODO(crbug.com/42271020): Consider testing with
       // `FXDIB_Format::kBgraPremul`
diff --git a/core/fxge/dib/fx_dib.h b/core/fxge/dib/fx_dib.h
index f539f74..a45416d 100644
--- a/core/fxge/dib/fx_dib.h
+++ b/core/fxge/dib/fx_dib.h
@@ -212,11 +212,8 @@
   ((uint8_t)(argb >> 16) | ((uint8_t)(argb >> 8)) << 8 | \
    ((uint8_t)(argb)) << 16 | ((uint8_t)(argb >> 24) << 24))
 
-// PRECONDITIONS: Caller must ensure 4 valid bytes at `p`.
-UNSAFE_BUFFER_USAGE inline FX_ARGB FXARGB_GetDIB(const uint8_t* p) {
-  // SAFETY: required from caller, enforced by UNSAFE_BUFFER_USAGE.
-  return ArgbEncode(UNSAFE_BUFFERS(p[3]), UNSAFE_BUFFERS(p[2]),
-                    UNSAFE_BUFFERS(p[1]), UNSAFE_BUFFERS(p[0]));
+inline FX_ARGB FXARGB_GetDIB(pdfium::span<const uint8_t, 4> p) {
+  return ArgbEncode(p[3], p[2], p[1], p[0]);
 }
 
 inline void FXARGB_SetDIB(pdfium::span<uint8_t, 4> p, uint32_t argb) {