Allow spans to flow further down into CFX_DIBBase.

Change-Id: I621f30f2e7f39334613a0c83376ef8c65f50a6c1
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/100991
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index bd8c149..d401286 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -56,6 +56,7 @@
 #include "core/fxcrt/fx_memory.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/span_util.h"
 #include "core/fxcrt/unowned_ptr.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
 #include "core/fxge/cfx_fillrenderoptions.h"
@@ -1444,9 +1445,9 @@
   if (!pMask->Create(width, height, FXDIB_Format::k8bppMask))
     return nullptr;
 
-  uint8_t* dest_buf = pMask->GetBuffer().data();
+  pdfium::span<uint8_t> dest_buf = pMask->GetBuffer();
+  pdfium::span<const uint8_t> src_buf = bitmap->GetBuffer();
   int dest_pitch = pMask->GetPitch();
-  uint8_t* src_buf = bitmap->GetBuffer().data();
   int src_pitch = bitmap->GetPitch();
   DataVector<uint8_t> transfers(256);
   if (pFunc) {
@@ -1463,8 +1464,8 @@
   if (bLuminosity) {
     int Bpp = bitmap->GetBPP() / 8;
     for (int row = 0; row < height; row++) {
-      uint8_t* dest_pos = dest_buf + row * dest_pitch;
-      uint8_t* src_pos = src_buf + row * src_pitch;
+      uint8_t* dest_pos = dest_buf.subspan(row * dest_pitch).data();
+      const uint8_t* src_pos = src_buf.subspan(row * src_pitch).data();
       for (int col = 0; col < width; col++) {
         *dest_pos++ = transfers[FXRGB2GRAY(src_pos[2], src_pos[1], *src_pos)];
         src_pos += Bpp;
@@ -1476,7 +1477,7 @@
       dest_buf[i] = transfers[src_buf[i]];
     }
   } else {
-    memcpy(dest_buf, src_buf, dest_pitch * height);
+    fxcrt::spancpy(dest_buf, src_buf.first(dest_pitch * height));
   }
   return pMask;
 }
diff --git a/core/fxcodec/jpeg/jpegmodule.cpp b/core/fxcodec/jpeg/jpegmodule.cpp
index 9258510..5b10854 100644
--- a/core/fxcodec/jpeg/jpegmodule.cpp
+++ b/core/fxcodec/jpeg/jpegmodule.cpp
@@ -468,23 +468,25 @@
   JSAMPROW row_pointer[1];
   JDIMENSION row;
   while (cinfo.next_scanline < cinfo.image_height) {
-    const uint8_t* src_scan = pSource->GetScanline(cinfo.next_scanline).data();
+    pdfium::span<const uint8_t> src_scan =
+        pSource->GetScanline(cinfo.next_scanline);
     if (nComponents > 1) {
       uint8_t* dest_scan = line_buf;
       if (nComponents == 3) {
         for (uint32_t i = 0; i < width; i++) {
-          ReverseCopy3Bytes(dest_scan, src_scan);
+          ReverseCopy3Bytes(dest_scan, src_scan.data());
           dest_scan += 3;
-          src_scan += Bpp;
+          src_scan = src_scan.subspan(Bpp);
         }
       } else {
         for (uint32_t i = 0; i < pitch; i++) {
-          *dest_scan++ = ~*src_scan++;
+          *dest_scan++ = ~src_scan.front();
+          src_scan = src_scan.subspan(1);
         }
       }
       row_pointer[0] = line_buf;
     } else {
-      row_pointer[0] = const_cast<uint8_t*>(src_scan);
+      row_pointer[0] = const_cast<uint8_t*>(src_scan.data());
     }
     row = cinfo.next_scanline;
     jpeg_write_scanlines(&cinfo, row_pointer, 1);
diff --git a/core/fxcodec/progressive_decoder.cpp b/core/fxcodec/progressive_decoder.cpp
index bfb2187..c39ac77 100644
--- a/core/fxcodec/progressive_decoder.cpp
+++ b/core/fxcodec/progressive_decoder.cpp
@@ -1933,14 +1933,13 @@
   if (dest_row_1 < dest_top) {
     int dest_bottom = dest_top + m_sizeY;
     if (dest_row + (int)scale_y >= dest_bottom - 1) {
-      const uint8_t* scan_src =
-          pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset).data();
+      pdfium::span<const uint8_t> scan_src =
+          pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset,
+                                                       m_sizeX * dest_Bpp);
       while (++dest_row < dest_bottom) {
-        uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row)
-                                .subspan(dest_ScanOffset)
-                                .data();
-        uint32_t size = m_sizeX * dest_Bpp;
-        memmove(scan_des, scan_src, size);
+        fxcrt::spanmove(pDeviceBitmap->GetWritableScanline(dest_row).subspan(
+                            dest_ScanOffset),
+                        scan_src);
       }
     }
     return;
@@ -2013,14 +2012,13 @@
   }
   int dest_bottom = dest_top + m_sizeY;
   if (dest_row + (int)scale_y >= dest_bottom - 1) {
-    const uint8_t* scan_src =
-        pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset).data();
+    pdfium::span<const uint8_t> scan_src =
+        pDeviceBitmap->GetScanline(dest_row).subspan(dest_ScanOffset,
+                                                     m_sizeX * dest_Bpp);
     while (++dest_row < dest_bottom) {
-      uint8_t* scan_des = pDeviceBitmap->GetWritableScanline(dest_row)
-                              .subspan(dest_ScanOffset)
-                              .data();
-      uint32_t size = m_sizeX * dest_Bpp;
-      memmove(scan_des, scan_src, size);
+      fxcrt::spanmove(
+          pDeviceBitmap->GetWritableScanline(dest_row).subspan(dest_ScanOffset),
+          scan_src);
     }
   }
 }
diff --git a/core/fxge/agg/fx_agg_driver.cpp b/core/fxge/agg/fx_agg_driver.cpp
index 1346ee7..e317065 100644
--- a/core/fxge/agg/fx_agg_driver.cpp
+++ b/core/fxge/agg/fx_agg_driver.cpp
@@ -71,11 +71,11 @@
   int src_b = FXARGB_B(argb);
   int Bpp = pBitmap->GetBPP() / 8;
   int dib_argb = FXARGB_TOBGRORDERDIB(argb);
-  uint8_t* pBuffer = pBitmap->GetBuffer().data();
+  pdfium::span<uint8_t> pBuffer = pBitmap->GetBuffer();
   if (src_alpha == 255) {
     for (int row = rect.top; row < rect.bottom; row++) {
       uint8_t* dest_scan =
-          pBuffer + row * pBitmap->GetPitch() + rect.left * Bpp;
+          pBuffer.subspan(row * pBitmap->GetPitch() + rect.left * Bpp).data();
       if (Bpp == 4) {
         std::fill_n(reinterpret_cast<uint32_t*>(dest_scan), width, dib_argb);
       } else {
@@ -90,7 +90,8 @@
   }
   bool bAlpha = pBitmap->IsAlphaFormat();
   for (int row = rect.top; row < rect.bottom; row++) {
-    uint8_t* dest_scan = pBuffer + row * pBitmap->GetPitch() + rect.left * Bpp;
+    uint8_t* dest_scan =
+        pBuffer.subspan(row * pBitmap->GetPitch() + rect.left * Bpp).data();
     if (bAlpha) {
       for (int col = 0; col < width; col++) {
         uint8_t back_alpha = dest_scan[3];
diff --git a/core/fxge/dib/cfx_dibbase.cpp b/core/fxge/dib/cfx_dibbase.cpp
index 3842307..d303314 100644
--- a/core/fxge/dib/cfx_dibbase.cpp
+++ b/core/fxge/dib/cfx_dibbase.cpp
@@ -78,9 +78,9 @@
   int width = pBitmap->GetWidth();
   int height = pBitmap->GetHeight();
   for (int row = 0; row < height; ++row) {
-    const uint8_t* scan_line = pBitmap->GetScanline(row).data();
+    pdfium::span<const uint8_t> scan_line = pBitmap->GetScanline(row);
     for (int col = 0; col < width; ++col) {
-      const uint8_t* src_port = scan_line + col * bpp;
+      const uint8_t* src_port = scan_line.subspan(col * bpp).data();
       uint32_t b = src_port[0] & 0xf0;
       uint32_t g = src_port[1] & 0xf0;
       uint32_t r = src_port[2] & 0xf0;
@@ -106,7 +106,7 @@
 
 CFX_Palette::~CFX_Palette() = default;
 
-void ConvertBuffer_1bppMask2Gray(uint8_t* dest_buf,
+void ConvertBuffer_1bppMask2Gray(pdfium::span<uint8_t> dest_buf,
                                  int dest_pitch,
                                  int width,
                                  int height,
@@ -116,9 +116,12 @@
   static constexpr uint8_t kSetGray = 0xff;
   static constexpr uint8_t kResetGray = 0x00;
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
-    memset(dest_scan, kResetGray, width);
-    const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
+    pdfium::span<uint8_t> dest_span = dest_buf.subspan(row * dest_pitch);
+    pdfium::span<const uint8_t> src_span =
+        pSrcBitmap->GetScanline(src_top + row);
+    fxcrt::spanset(dest_span.first(width), kResetGray);
+    uint8_t* dest_scan = dest_span.data();
+    const uint8_t* src_scan = src_span.data();
     for (int col = src_left; col < src_left + width; ++col) {
       if (src_scan[col / 8] & (1 << (7 - col % 8)))
         *dest_scan = kSetGray;
@@ -127,7 +130,7 @@
   }
 }
 
-void ConvertBuffer_8bppMask2Gray(uint8_t* dest_buf,
+void ConvertBuffer_8bppMask2Gray(pdfium::span<uint8_t> dest_buf,
                                  int dest_pitch,
                                  int width,
                                  int height,
@@ -135,14 +138,13 @@
                                  int src_left,
                                  int src_top) {
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
-    const uint8_t* src_scan =
-        pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
-    memcpy(dest_scan, src_scan, width);
+    fxcrt::spancpy(
+        dest_buf.subspan(row * dest_pitch),
+        pSrcBitmap->GetScanline(src_top + row).subspan(src_left, width));
   }
 }
 
-void ConvertBuffer_1bppPlt2Gray(uint8_t* dest_buf,
+void ConvertBuffer_1bppPlt2Gray(pdfium::span<uint8_t> dest_buf,
                                 int dest_pitch,
                                 int width,
                                 int height,
@@ -150,29 +152,29 @@
                                 int src_left,
                                 int src_top) {
   pdfium::span<const uint32_t> src_palette = pSrcBitmap->GetPaletteSpan();
-  uint8_t reset_r = FXARGB_R(src_palette[0]);
-  uint8_t reset_g = FXARGB_G(src_palette[0]);
-  uint8_t reset_b = FXARGB_B(src_palette[0]);
-  uint8_t set_r = FXARGB_R(src_palette[1]);
-  uint8_t set_g = FXARGB_G(src_palette[1]);
-  uint8_t set_b = FXARGB_B(src_palette[1]);
-  uint8_t gray[2];
-  gray[0] = FXRGB2GRAY(reset_r, reset_g, reset_b);
-  gray[1] = FXRGB2GRAY(set_r, set_g, set_b);
+  const uint8_t reset_r = FXARGB_R(src_palette[0]);
+  const uint8_t reset_g = FXARGB_G(src_palette[0]);
+  const uint8_t reset_b = FXARGB_B(src_palette[0]);
+  const uint8_t set_r = FXARGB_R(src_palette[1]);
+  const uint8_t set_g = FXARGB_G(src_palette[1]);
+  const uint8_t set_b = FXARGB_B(src_palette[1]);
+  const uint8_t gray0 = FXRGB2GRAY(reset_r, reset_g, reset_b);
+  const uint8_t gray1 = FXRGB2GRAY(set_r, set_g, set_b);
 
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
-    memset(dest_scan, gray[0], width);
+    pdfium::span<uint8_t> dest_span = dest_buf.subspan(row * dest_pitch);
+    fxcrt::spanset(dest_span.first(width), gray0);
+    uint8_t* dest_scan = dest_span.data();
     const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
     for (int col = src_left; col < src_left + width; ++col) {
       if (src_scan[col / 8] & (1 << (7 - col % 8)))
-        *dest_scan = gray[1];
+        *dest_scan = gray1;
       ++dest_scan;
     }
   }
 }
 
-void ConvertBuffer_8bppPlt2Gray(uint8_t* dest_buf,
+void ConvertBuffer_8bppPlt2Gray(pdfium::span<uint8_t> dest_buf,
                                 int dest_pitch,
                                 int width,
                                 int height,
@@ -187,7 +189,7 @@
   }
 
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
     for (int col = 0; col < width; ++col)
@@ -195,7 +197,7 @@
   }
 }
 
-void ConvertBuffer_Rgb2Gray(uint8_t* dest_buf,
+void ConvertBuffer_Rgb2Gray(pdfium::span<uint8_t> dest_buf,
                             int dest_pitch,
                             int width,
                             int height,
@@ -204,7 +206,7 @@
                             int src_top) {
   int Bpp = pSrcBitmap->GetBPP() / 8;
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left * Bpp).data();
     for (int col = 0; col < width; ++col) {
@@ -214,7 +216,7 @@
   }
 }
 
-void ConvertBuffer_IndexCopy(uint8_t* dest_buf,
+void ConvertBuffer_IndexCopy(pdfium::span<uint8_t> dest_buf,
                              int dest_pitch,
                              int width,
                              int height,
@@ -223,9 +225,10 @@
                              int src_top) {
   if (pSrcBitmap->GetBPP() == 1) {
     for (int row = 0; row < height; ++row) {
-      uint8_t* dest_scan = dest_buf + row * dest_pitch;
+      pdfium::span<uint8_t> dest_span = dest_buf.subspan(row * dest_pitch);
       // Set all destination pixels to be white initially.
-      memset(dest_scan, 255, width);
+      fxcrt::spanset(dest_span.first(width), 255);
+      uint8_t* dest_scan = dest_span.data();
       const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
       for (int col = src_left; col < src_left + width; ++col) {
         // If the source bit is set, then set the destination pixel to be black.
@@ -237,15 +240,14 @@
     }
   } else {
     for (int row = 0; row < height; ++row) {
-      uint8_t* dest_scan = dest_buf + row * dest_pitch;
-      const uint8_t* src_scan =
-          pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
-      memcpy(dest_scan, src_scan, width);
+      fxcrt::spancpy(
+          dest_buf.subspan(row * dest_pitch),
+          pSrcBitmap->GetScanline(src_top + row).subspan(src_left, width));
     }
   }
 }
 
-void ConvertBuffer_Plt2PltRgb8(uint8_t* dest_buf,
+void ConvertBuffer_Plt2PltRgb8(pdfium::span<uint8_t> dest_buf,
                                int dest_pitch,
                                int width,
                                int height,
@@ -264,7 +266,7 @@
     dst_plt[i] = src_plt[i];
 }
 
-void ConvertBuffer_Rgb2PltRgb8(uint8_t* dest_buf,
+void ConvertBuffer_Rgb2PltRgb8(pdfium::span<uint8_t> dest_buf,
                                int dest_pitch,
                                int width,
                                int height,
@@ -306,7 +308,7 @@
   for (int row = 0; row < height; ++row) {
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     for (int col = 0; col < width; ++col) {
       const uint8_t* src_port = src_scan + col * bpp;
       int r = src_port[2] & 0xf0;
@@ -325,7 +327,7 @@
 }
 
 void ConvertBuffer_1bppMask2Rgb(FXDIB_Format dest_format,
-                                uint8_t* dest_buf,
+                                pdfium::span<uint8_t> dest_buf,
                                 int dest_pitch,
                                 int width,
                                 int height,
@@ -336,7 +338,7 @@
   static constexpr uint8_t kSetGray = 0xff;
   static constexpr uint8_t kResetGray = 0x00;
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
     for (int col = src_left; col < src_left + width; ++col) {
       uint8_t value =
@@ -348,7 +350,7 @@
 }
 
 void ConvertBuffer_8bppMask2Rgb(FXDIB_Format dest_format,
-                                uint8_t* dest_buf,
+                                pdfium::span<uint8_t> dest_buf,
                                 int dest_pitch,
                                 int width,
                                 int height,
@@ -357,7 +359,7 @@
                                 int src_top) {
   int comps = GetCompsFromFormat(dest_format);
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
     for (int col = 0; col < width; ++col) {
@@ -369,7 +371,7 @@
 }
 
 void ConvertBuffer_1bppPlt2Rgb(FXDIB_Format dest_format,
-                               uint8_t* dest_buf,
+                               pdfium::span<uint8_t> dest_buf,
                                int dest_pitch,
                                int width,
                                int height,
@@ -388,7 +390,7 @@
   bgr_ptr[5] = FXARGB_R(src_palette[1]);
 
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan = pSrcBitmap->GetScanline(src_top + row).data();
     for (int col = src_left; col < src_left + width; ++col) {
       size_t offset = (src_scan[col / 8] & (1 << (7 - col % 8))) ? 3 : 0;
@@ -399,7 +401,7 @@
 }
 
 void ConvertBuffer_8bppPlt2Rgb(FXDIB_Format dest_format,
-                               uint8_t* dest_buf,
+                               pdfium::span<uint8_t> dest_buf,
                                int dest_pitch,
                                int width,
                                int height,
@@ -418,7 +420,7 @@
   bgr_ptr = reinterpret_cast<uint8_t*>(plt);
 
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left).data();
     for (int col = 0; col < width; ++col) {
@@ -430,7 +432,7 @@
 }
 
 void ConvertBuffer_24bppRgb2Rgb24(
-    uint8_t* dest_buf,
+    pdfium::span<uint8_t> dest_buf,
     int dest_pitch,
     int width,
     int height,
@@ -438,15 +440,14 @@
     int src_left,
     int src_top) {
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
-    const uint8_t* src_scan =
-        pSrcBitmap->GetScanline(src_top + row).subspan(src_left * 3).data();
-    memcpy(dest_scan, src_scan, width * 3);
+    fxcrt::spancpy(dest_buf.subspan(row * dest_pitch),
+                   pSrcBitmap->GetScanline(src_top + row)
+                       .subspan(src_left * 3, width * 3));
   }
 }
 
 void ConvertBuffer_32bppRgb2Rgb24(
-    uint8_t* dest_buf,
+    pdfium::span<uint8_t> dest_buf,
     int dest_pitch,
     int width,
     int height,
@@ -454,7 +455,7 @@
     int src_left,
     int src_top) {
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left * 4).data();
     for (int col = 0; col < width; ++col) {
@@ -465,7 +466,7 @@
   }
 }
 
-void ConvertBuffer_Rgb2Rgb32(uint8_t* dest_buf,
+void ConvertBuffer_Rgb2Rgb32(pdfium::span<uint8_t> dest_buf,
                              int dest_pitch,
                              int width,
                              int height,
@@ -474,7 +475,7 @@
                              int src_top) {
   int comps = pSrcBitmap->GetBPP() / 8;
   for (int row = 0; row < height; ++row) {
-    uint8_t* dest_scan = dest_buf + row * dest_pitch;
+    uint8_t* dest_scan = dest_buf.subspan(row * dest_pitch).data();
     const uint8_t* src_scan =
         pSrcBitmap->GetScanline(src_top + row).subspan(src_left * comps).data();
     for (int col = 0; col < width; ++col) {
@@ -486,7 +487,7 @@
 }
 
 bool ConvertBuffer_8bppMask(int bpp,
-                            uint8_t* dest_buf,
+                            pdfium::span<uint8_t> dest_buf,
                             int dest_pitch,
                             int width,
                             int height,
@@ -524,7 +525,7 @@
 
 bool ConvertBuffer_Rgb(int bpp,
                        FXDIB_Format dest_format,
-                       uint8_t* dest_buf,
+                       pdfium::span<uint8_t> dest_buf,
                        int dest_pitch,
                        int width,
                        int height,
@@ -565,7 +566,7 @@
 
 bool ConvertBuffer_Argb(int bpp,
                         FXDIB_Format dest_format,
-                        uint8_t* dest_buf,
+                        pdfium::span<uint8_t> dest_buf,
                         int dest_pitch,
                         int width,
                         int height,
@@ -1037,9 +1038,8 @@
 
   RetainPtr<const CFX_DIBBase> holder(this);
   DataVector<uint32_t> pal_8bpp;
-  if (!ConvertBuffer(dest_format, pClone->GetBuffer().data(),
-                     pClone->GetPitch(), m_Width, m_Height, holder, 0, 0,
-                     &pal_8bpp)) {
+  if (!ConvertBuffer(dest_format, pClone->GetBuffer(), pClone->GetPitch(),
+                     m_Width, m_Height, holder, 0, 0, &pal_8bpp)) {
     return nullptr;
   }
   if (!pal_8bpp.empty())
@@ -1180,7 +1180,7 @@
 
 // static
 bool CFX_DIBBase::ConvertBuffer(FXDIB_Format dest_format,
-                                uint8_t* dest_buf,
+                                pdfium::span<uint8_t> dest_buf,
                                 int dest_pitch,
                                 int width,
                                 int height,
diff --git a/core/fxge/dib/cfx_dibbase.h b/core/fxge/dib/cfx_dibbase.h
index 780322a..8030be2 100644
--- a/core/fxge/dib/cfx_dibbase.h
+++ b/core/fxge/dib/cfx_dibbase.h
@@ -105,7 +105,7 @@
   CFX_DIBBase();
 
   static bool ConvertBuffer(FXDIB_Format dest_format,
-                            uint8_t* dest_buf,
+                            pdfium::span<uint8_t> dest_buf,
                             int dest_pitch,
                             int width,
                             int height,
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index ae82b30..74696a6 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -251,8 +251,8 @@
   if (!offset.IsValid())
     return false;
 
-  uint8_t* dest_buf =
-      m_pBuffer.Get() + dest_top * m_Pitch + offset.ValueOrDie();
+  pdfium::span<uint8_t> dest_buf = GetBuffer().subspan(
+      dest_top * m_Pitch + static_cast<uint32_t>(offset.ValueOrDie()));
   DataVector<uint32_t> d_plt;
   return ConvertBuffer(dest_format, dest_buf, m_Pitch, width, height,
                        pSrcBitmap, src_left, src_top, &d_plt);
@@ -1076,14 +1076,15 @@
   }
   int dest_bpp = GetBppFromFormat(dest_format);
   int dest_pitch = fxge::CalculatePitch32OrDie(dest_bpp, m_Width);
+  const size_t dest_buf_size = dest_pitch * m_Height + 4;
   std::unique_ptr<uint8_t, FxFreeDeleter> dest_buf(
-      FX_TryAlloc(uint8_t, dest_pitch * m_Height + 4));
+      FX_TryAlloc(uint8_t, dest_buf_size));
   if (!dest_buf)
     return false;
 
   RetainPtr<CFX_DIBitmap> pAlphaMask;
   if (dest_format == FXDIB_Format::kArgb) {
-    memset(dest_buf.get(), 0xff, dest_pitch * m_Height + 4);
+    memset(dest_buf.get(), 0xff, dest_buf_size);
     if (m_pAlphaMask) {
       for (int row = 0; row < m_Height; row++) {
         uint8_t* pDstScanline = dest_buf.get() + row * dest_pitch + 3;
@@ -1112,8 +1113,8 @@
   bool ret = false;
   RetainPtr<CFX_DIBBase> holder(this);
   DataVector<uint32_t> pal_8bpp;
-  ret = ConvertBuffer(dest_format, dest_buf.get(), dest_pitch, m_Width,
-                      m_Height, holder, 0, 0, &pal_8bpp);
+  ret = ConvertBuffer(dest_format, {dest_buf.get(), dest_buf_size}, dest_pitch,
+                      m_Width, m_Height, holder, 0, 0, &pal_8bpp);
   if (!ret)
     return false;