Fix unsafe pointer usage in CJX_HostPseudoModel
Change-Id: I0c5b4d753ee41ba5b9bf6460f7d7eafab909b81b
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/118072
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Thomas Sepez <tsepez@google.com>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/fxjs/xfa/cjx_hostpseudomodel.cpp b/fxjs/xfa/cjx_hostpseudomodel.cpp
index 50c31a8..b14d5e2 100644
--- a/fxjs/xfa/cjx_hostpseudomodel.cpp
+++ b/fxjs/xfa/cjx_hostpseudomodel.cpp
@@ -29,10 +29,10 @@
return nLength;
size_t nCount = 0;
+ pdfium::span<const wchar_t> pSrc = wsExpression.span();
{
// Span's lifetime must end before ReleaseBuffer() below.
pdfium::span<wchar_t> pBuf = wsFilter.GetBuffer(nLength - nStart);
- const wchar_t* pSrc = wsExpression.unterminated_c_str();
while (nStart < nLength) {
wchar_t wCur = pSrc[nStart++];
if (wCur == ',')
