Replace pointer arithmetic with spans in CFX_BitmapComposer.

Trap on badly calculated values.

-- convert to spanset() in one unrelated place.

Bug: chromium:1386121
Change-Id: Ibc80bde2ec1d09f5bb008cf2e303ed1d8ad6aa16
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/101570
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

core/fxge/dib/cfx_bitmapcomposer.cpp

diff --git a/core/fxge/dib/cfx_bitmapcomposer.cpp b/core/fxge/dib/cfx_bitmapcomposer.cpp
index d083ca3..1ddd1bc 100644
--- a/core/fxge/dib/cfx_bitmapcomposer.cpp
+++ b/core/fxge/dib/cfx_bitmapcomposer.cpp
@@ -10,6 +10,7 @@
 
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_safe_types.h"
+#include "core/fxcrt/span_util.h"
 #include "core/fxge/cfx_cliprgn.h"
 #include "core/fxge/dib/cfx_dibitmap.h"
 
@@ -80,7 +81,8 @@
       for (int i = 0; i < dest_width; ++i)
         m_pAddClipScan[i] = clip_scan[i] * m_BitmapAlpha / 255;
     } else {
-      memset(m_pAddClipScan.data(), m_BitmapAlpha, dest_width);
+      fxcrt::spanset(pdfium::make_span(m_pAddClipScan).first(dest_width),
+                     m_BitmapAlpha);
     }
     clip_scan = m_pAddClipScan;
   }
@@ -141,18 +143,23 @@
   int dest_pitch = m_pBitmap->GetPitch();
   int dest_alpha_pitch = m_pBitmap->GetAlphaMaskPitch();
   int dest_x = m_DestLeft + (m_bFlipX ? (m_DestWidth - line - 1) : line);
-  uint8_t* dest_buf = m_pBitmap->GetBuffer().data();
-  if (dest_buf) {
-    dest_buf += dest_x * Bpp + m_DestTop * dest_pitch;
+  pdfium::span<uint8_t> dest_span = m_pBitmap->GetBuffer();
+  if (!dest_span.empty()) {
+    dest_span = dest_span.subspan(dest_x * Bpp + m_DestTop * dest_pitch);
     if (m_bFlipY)
-      dest_buf += dest_pitch * (m_DestHeight - 1);
+      dest_span = dest_span.subspan(dest_pitch * (m_DestHeight - 1));
   }
-  uint8_t* dest_alpha_buf = m_pBitmap->GetAlphaMaskBuffer().data();
-  if (dest_alpha_buf) {
-    dest_alpha_buf += dest_x + m_DestTop * dest_alpha_pitch;
-    if (m_bFlipY)
-      dest_alpha_buf += dest_alpha_pitch * (m_DestHeight - 1);
+  uint8_t* dest_buf = dest_span.data();
+  pdfium::span<uint8_t> dest_alpha_span = m_pBitmap->GetAlphaMaskBuffer();
+  if (!dest_alpha_span.empty()) {
+    dest_alpha_span =
+        dest_alpha_span.subspan(dest_x + m_DestTop * dest_alpha_pitch);
+    if (m_bFlipY) {
+      dest_alpha_span =
+          dest_alpha_span.subspan(dest_alpha_pitch * (m_DestHeight - 1));
+    }
   }
+  uint8_t* dest_alpha_buf = dest_alpha_span.data();
   int y_step = dest_pitch;
   int y_alpha_step = dest_alpha_pitch;
   if (m_bFlipY) {