Remove even more per-file suppressions from tests.

Bug: 42271175
Change-Id: I7ea91a932de84959a3cef64a042e693de53ae849
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/120233
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: Thomas Sepez <tsepez@google.com>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/fpdfsdk/fpdf_annot_embeddertest.cpp b/fpdfsdk/fpdf_annot_embeddertest.cpp
index ed3cf31..0053354 100644
--- a/fpdfsdk/fpdf_annot_embeddertest.cpp
+++ b/fpdfsdk/fpdf_annot_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "public/fpdf_annot.h"
 
 #include <limits.h>
@@ -21,6 +16,7 @@
 #include "core/fpdfapi/page/cpdf_annotcontext.h"
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/containers/contains.h"
 #include "core/fxcrt/fx_memcpy_wrappers.h"
 #include "core/fxcrt/fx_system.h"
@@ -1762,11 +1758,11 @@
     // small. The result buffer should be overwritten with an empty string.
     std::vector<FPDF_WCHAR> buf = GetFPDFWideStringBuffer(normal_length_bytes);
     // Write in the buffer to verify it's not overwritten.
-    FXSYS_memcpy(buf.data(), "abcdefgh", 8);
+    UNSAFE_TODO(FXSYS_memcpy(buf.data(), "abcdefgh", 8));
     EXPECT_EQ(kExpectNormalAPLength,
               FPDFAnnot_GetAP(annot.get(), FPDF_ANNOT_APPEARANCEMODE_NORMAL,
                               buf.data(), normal_length_bytes - 1));
-    EXPECT_EQ(0, memcmp(buf.data(), "abcdefgh", 8));
+    UNSAFE_TODO(EXPECT_EQ(0, memcmp(buf.data(), "abcdefgh", 8)));
 
     // Check that the string value of an AP is returned through a buffer that is
     // the right size.
@@ -2926,17 +2922,19 @@
     EXPECT_EQ(-1, FPDFAnnot_GetFormFieldType(nullptr, annot.get()));
   }
 
-  constexpr int kExpectedAnnotTypes[] = {-1,
-                                         FPDF_FORMFIELD_COMBOBOX,
-                                         FPDF_FORMFIELD_LISTBOX,
-                                         FPDF_FORMFIELD_TEXTFIELD,
-                                         FPDF_FORMFIELD_CHECKBOX,
-                                         FPDF_FORMFIELD_RADIOBUTTON};
-
-  for (size_t i = 0; i < std::size(kExpectedAnnotTypes); ++i) {
-    ScopedFPDFAnnotation annot(FPDFPage_GetAnnot(page, i));
+  static const struct {
+    int input;
+    int output;
+  } kTests[] = {{0, -1},
+                {1, FPDF_FORMFIELD_COMBOBOX},
+                {2, FPDF_FORMFIELD_LISTBOX},
+                {3, FPDF_FORMFIELD_TEXTFIELD},
+                {4, FPDF_FORMFIELD_CHECKBOX},
+                {5, FPDF_FORMFIELD_RADIOBUTTON}};
+  for (const auto& test : kTests) {
+    ScopedFPDFAnnotation annot(FPDFPage_GetAnnot(page, test.input));
     ASSERT_TRUE(annot);
-    EXPECT_EQ(kExpectedAnnotTypes[i],
+    EXPECT_EQ(test.output,
               FPDFAnnot_GetFormFieldType(form_handle(), annot.get()));
   }
   UnloadPage(page);
diff --git a/fpdfsdk/fpdf_dataavail_embeddertest.cpp b/fpdfsdk/fpdf_dataavail_embeddertest.cpp
index 18dcdc8..8a130d8 100644
--- a/fpdfsdk/fpdf_dataavail_embeddertest.cpp
+++ b/fpdfsdk/fpdf_dataavail_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <algorithm>
 #include <memory>
 #include <string>
@@ -14,6 +9,7 @@
 #include <vector>
 
 #include "core/fxcrt/bytestring.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/numerics/safe_conversions.h"
 #include "core/fxcrt/span_util.h"
 #include "public/fpdf_doc.h"
@@ -119,7 +115,7 @@
     if (end <= pos)
       return 0;
     const unsigned long bytes_to_copy = end - pos;
-    fxcrt::spancpy(pdfium::make_span(pBuf, size),
+    fxcrt::spancpy(UNSAFE_TODO(pdfium::make_span(pBuf, size)),
                    file_contents().subspan(pos, bytes_to_copy));
     SetDataAvailable(pos, bytes_to_copy);
     return static_cast<int>(bytes_to_copy);
diff --git a/fpdfsdk/fpdf_doc_embeddertest.cpp b/fpdfsdk/fpdf_doc_embeddertest.cpp
index 8cd85cc..34b6b40 100644
--- a/fpdfsdk/fpdf_doc_embeddertest.cpp
+++ b/fpdfsdk/fpdf_doc_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <set>
 #include <string>
 #include <vector>
@@ -15,6 +10,7 @@
 #include "core/fpdfapi/parser/cpdf_document.h"
 #include "core/fpdfapi/parser/cpdf_reference.h"
 #include "core/fxcrt/bytestring.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
@@ -696,7 +692,7 @@
     FPDF_PAGE page = LoadPage(i);
     ASSERT_TRUE(page);
     ScopedFPDFBitmap bitmap = RenderLoadedPage(page);
-    const PageData& expected = expected_page_data[i];
+    const PageData& expected = UNSAFE_TODO(expected_page_data[i]);
     CompareBitmap(bitmap.get(), expected.width, expected.height,
                   expected.checksum);
     UnloadPage(page);
@@ -709,7 +705,7 @@
     FPDF_PAGE page = LoadPage(i);
     ASSERT_TRUE(page);
     ScopedFPDFBitmap bitmap = RenderLoadedPage(page);
-    const PageData& expected = expected_page_data[i + 1];
+    const PageData& expected = UNSAFE_TODO(expected_page_data[i + 1]);
     CompareBitmap(bitmap.get(), expected.width, expected.height,
                   expected.checksum);
     UnloadPage(page);
@@ -722,7 +718,7 @@
     FPDF_PAGE page = LoadPage(i);
     ASSERT_TRUE(page);
     ScopedFPDFBitmap bitmap = RenderLoadedPage(page);
-    const PageData& expected = expected_page_data[i + 1];
+    const PageData& expected = UNSAFE_TODO(expected_page_data[i + 1]);
     CompareBitmap(bitmap.get(), expected.width, expected.height,
                   expected.checksum);
     UnloadPage(page);
@@ -736,7 +732,7 @@
     ASSERT_TRUE(page);
     ScopedFPDFBitmap bitmap = RenderLoadedPage(page);
     int adjusted_index = i == 0 ? 1 : 3;
-    const PageData& expected = expected_page_data[adjusted_index];
+    const PageData& expected = UNSAFE_TODO(expected_page_data[adjusted_index]);
     CompareBitmap(bitmap.get(), expected.width, expected.height,
                   expected.checksum);
     UnloadPage(page);
diff --git a/fpdfsdk/fpdf_editpage_embeddertest.cpp b/fpdfsdk/fpdf_editpage_embeddertest.cpp
index eae5932..6fe17e3 100644
--- a/fpdfsdk/fpdf_editpage_embeddertest.cpp
+++ b/fpdfsdk/fpdf_editpage_embeddertest.cpp
@@ -2,11 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
 #include "public/fpdf_edit.h"
@@ -177,7 +173,7 @@
     float get_array[] = {-1.0f, -1.0f, -1.0f};
     EXPECT_FALSE(FPDFPageObj_GetDashArray(nullptr, get_array, 3));
     for (int i = 0; i < 3; i++)
-      EXPECT_FLOAT_EQ(-1.0f, get_array[i]);
+      EXPECT_FLOAT_EQ(-1.0f, UNSAFE_TODO(get_array[i]));
 
     EXPECT_FALSE(FPDFPageObj_SetDashPhase(nullptr, 5.0f));
     EXPECT_FALSE(FPDFPageObj_SetDashArray(nullptr, nullptr, 3, 5.0f));
@@ -210,7 +206,7 @@
     float get_array[] = {-1.0f, -1.0f, -1.0f};
     EXPECT_TRUE(FPDFPageObj_GetDashArray(path, get_array, 3));
     for (int i = 0; i < 3; i++)
-      EXPECT_FLOAT_EQ(-1.0f, get_array[i]);
+      EXPECT_FLOAT_EQ(-1.0f, UNSAFE_TODO(get_array[i]));
   }
 
   {
@@ -227,12 +223,12 @@
     ASSERT_TRUE(FPDFPageObj_GetDashArray(path, dash_array, 6));
 
     for (int i = 0; i < 6; i++)
-      EXPECT_LT(0.0f, dash_array[i]);
+      EXPECT_LT(0.0f, UNSAFE_TODO(dash_array[i]));
 
     // the array is decreasing in value.
-    for (int i = 0; i < 5; i++)
-      EXPECT_GT(dash_array[i], dash_array[i + 1]);
-
+    for (int i = 0; i < 5; i++) {
+      UNSAFE_TODO({ EXPECT_GT(dash_array[i], dash_array[i + 1]); });
+    }
     // modify phase
     EXPECT_TRUE(FPDFPageObj_SetDashPhase(path, 1.0f));
 
@@ -264,7 +260,7 @@
     float get_array[] = {-1.0f, -1.0f, -1.0f, -1.0f};
     EXPECT_TRUE(FPDFPageObj_GetDashArray(path, get_array, 4));
     for (int i = 0; i < 4; i++)
-      EXPECT_FLOAT_EQ(-1.0f, get_array[i]);
+      EXPECT_FLOAT_EQ(-1.0f, UNSAFE_TODO(get_array[i]));
 
     // modify dash_array and phase
     const float set_array[] = {1.0f, 2.0f, 3.0f};
@@ -278,13 +274,13 @@
     // Pretend `get_array` has too few members.
     EXPECT_FALSE(FPDFPageObj_GetDashArray(path, get_array, 2));
     for (int i = 0; i < 4; i++)
-      EXPECT_FLOAT_EQ(-1.0f, get_array[i]);
+      EXPECT_FLOAT_EQ(-1.0f, UNSAFE_TODO(get_array[i]));
 
     ASSERT_TRUE(FPDFPageObj_GetDashArray(path, get_array, 4));
 
     // `get_array` should be modified only up to dash_count
     for (int i = 0; i < 3; i++)
-      EXPECT_FLOAT_EQ(static_cast<float>(i + 1), get_array[i]);
+      EXPECT_FLOAT_EQ(static_cast<float>(i + 1), UNSAFE_TODO(get_array[i]));
 
     EXPECT_FLOAT_EQ(-1.0f, get_array[3]);
 
diff --git a/fpdfsdk/fpdf_formfill_embeddertest.cpp b/fpdfsdk/fpdf_formfill_embeddertest.cpp
index c752095..66921a2 100644
--- a/fpdfsdk/fpdf_formfill_embeddertest.cpp
+++ b/fpdfsdk/fpdf_formfill_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <vector>
 
 #include "build/build_config.h"
@@ -834,16 +829,15 @@
   FPDF_PAGE page = LoadPage(0);
   ASSERT_TRUE(page);
 
-  static constexpr int kExpectedAnnotIndex[] = {1, 2, 3, 0};
   // Tabs should iterate focus over annotations.
-  for (size_t i = 0; i < std::size(kExpectedAnnotIndex); ++i) {
+  for (int expected : {1, 2, 3, 0}) {
     ASSERT_TRUE(FORM_OnKeyDown(form_handle(), page, FWL_VKEY_Tab, 0));
     int page_index = -2;
     FPDF_ANNOTATION annot = nullptr;
     EXPECT_TRUE(FORM_GetFocusedAnnot(form_handle(), &page_index, &annot));
     EXPECT_EQ(0, page_index);
     ASSERT_TRUE(annot);
-    EXPECT_EQ(kExpectedAnnotIndex[i], FPDFPage_GetAnnotIndex(page, annot));
+    EXPECT_EQ(expected, FPDFPage_GetAnnotIndex(page, annot));
     FPDFPage_CloseAnnot(annot);
   }
 
@@ -858,9 +852,8 @@
   FPDF_PAGE page = LoadPage(0);
   ASSERT_TRUE(page);
 
-  static constexpr int kExpectedAnnotIndex[] = {0, 3, 2, 1};
   // Shift-tabs should iterate focus over annotations.
-  for (size_t i = 0; i < std::size(kExpectedAnnotIndex); ++i) {
+  for (int expected : {0, 3, 2, 1}) {
     ASSERT_TRUE(FORM_OnKeyDown(form_handle(), page, FWL_VKEY_Tab,
                                FWL_EVENTFLAG_ShiftKey));
     int page_index = -2;
@@ -868,7 +861,7 @@
     EXPECT_TRUE(FORM_GetFocusedAnnot(form_handle(), &page_index, &annot));
     EXPECT_EQ(0, page_index);
     ASSERT_TRUE(annot);
-    EXPECT_EQ(kExpectedAnnotIndex[i], FPDFPage_GetAnnotIndex(page, annot));
+    EXPECT_EQ(expected, FPDFPage_GetAnnotIndex(page, annot));
     FPDFPage_CloseAnnot(annot);
   }
 
diff --git a/fpdfsdk/fpdf_ppo_embeddertest.cpp b/fpdfsdk/fpdf_ppo_embeddertest.cpp
index f8535a1..dee2d20 100644
--- a/fpdfsdk/fpdf_ppo_embeddertest.cpp
+++ b/fpdfsdk/fpdf_ppo_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <iterator>
 #include <memory>
 #include <string>
@@ -21,6 +16,7 @@
 #include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/cpdf_string.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
 #include "fpdfsdk/cpdfsdk_helpers.h"
 #include "public/cpp/fpdf_scopers.h"
@@ -50,11 +46,11 @@
   if (CFX_DefaultRenderDevice::UseSkiaRenderer()) {
     static constexpr const char* kChecksums[kRectanglesMultiPagesPageCount] = {
         "07606a12487bd0c28a88f23fa00fc313", "94ea6e1eef220833a3ec14d6a1c612b0"};
-    return kChecksums[page_index];
+    return UNSAFE_TODO(kChecksums[page_index]);
   }
   static constexpr const char* kChecksums[kRectanglesMultiPagesPageCount] = {
       "72d0d7a19a2f40e010ca6a1133b33e1e", "fb18142190d770cfbc329d2b071aee4d"};
-  return kChecksums[page_index];
+  return UNSAFE_TODO(kChecksums[page_index]);
 }
 
 const char* Bug750568PageHash(int page_index) {
@@ -63,12 +59,12 @@
     static constexpr const char* kChecksums[kBug750568PageCount] = {
         "eaa139e944eafb43d31e8742a0e158de", "226485e9d4fa6a67dfe0a88723f12060",
         "c5601a3492ae5dcc5dd25140fc463bfe", "1f60055b54de4fac8a59c65e90da156e"};
-    return kChecksums[page_index];
+    return UNSAFE_TODO(kChecksums[page_index]);
   }
   static constexpr const char* kChecksums[kBug750568PageCount] = {
       "64ad08132a1c5a166768298c8a578f57", "83b83e2f6bc80707d0a917c7634140b9",
       "913cd3723a451e4e46fbc2c05702d1ee", "81fb7cfd4860f855eb468f73dfeb6d60"};
-  return kChecksums[page_index];
+  return UNSAFE_TODO(kChecksums[page_index]);
 }
 
 }  // namespace
@@ -233,48 +229,50 @@
 
   FPDF_PAGE saved_pages[kExpectedPageCount];
   FPDF_PAGEOBJECT xobjects[kExpectedPageCount];
-  for (int i = 0; i < kExpectedPageCount; ++i) {
-    saved_pages[i] = LoadSavedPage(i);
-    ASSERT_TRUE(saved_pages[i]);
+  UNSAFE_TODO({
+    for (int i = 0; i < kExpectedPageCount; ++i) {
+      saved_pages[i] = LoadSavedPage(i);
+      ASSERT_TRUE(saved_pages[i]);
 
-    EXPECT_EQ(1, FPDFPage_CountObjects(saved_pages[i]));
-    xobjects[i] = FPDFPage_GetObject(saved_pages[i], 0);
-    ASSERT_TRUE(xobjects[i]);
-    ASSERT_EQ(FPDF_PAGEOBJ_FORM, FPDFPageObj_GetType(xobjects[i]));
-    EXPECT_EQ(8, FPDFFormObj_CountObjects(xobjects[i]));
+      EXPECT_EQ(1, FPDFPage_CountObjects(saved_pages[i]));
+      xobjects[i] = FPDFPage_GetObject(saved_pages[i], 0);
+      ASSERT_TRUE(xobjects[i]);
+      ASSERT_EQ(FPDF_PAGEOBJ_FORM, FPDFPageObj_GetType(xobjects[i]));
+      EXPECT_EQ(8, FPDFFormObj_CountObjects(xobjects[i]));
 
-    {
-      ScopedFPDFBitmap page_bitmap = RenderPage(saved_pages[i]);
-      CompareBitmap(page_bitmap.get(), 612, 792, checksum);
+      {
+        ScopedFPDFBitmap page_bitmap = RenderPage(saved_pages[i]);
+        CompareBitmap(page_bitmap.get(), 612, 792, checksum);
+      }
     }
-  }
 
-  for (int i = 0; i < kExpectedPageCount; ++i) {
-    float left;
-    float bottom;
-    float right;
-    float top;
-    ASSERT_TRUE(
-        FPDFPageObj_GetBounds(xobjects[i], &left, &bottom, &right, &top));
-    EXPECT_FLOAT_EQ(-1.0f, left);
-    EXPECT_FLOAT_EQ(-1.0f, bottom);
-    EXPECT_FLOAT_EQ(201.0f, right);
-    EXPECT_FLOAT_EQ(301.0f, top);
-  }
+    for (int i = 0; i < kExpectedPageCount; ++i) {
+      float left;
+      float bottom;
+      float right;
+      float top;
+      ASSERT_TRUE(
+          FPDFPageObj_GetBounds(xobjects[i], &left, &bottom, &right, &top));
+      EXPECT_FLOAT_EQ(-1.0f, left);
+      EXPECT_FLOAT_EQ(-1.0f, bottom);
+      EXPECT_FLOAT_EQ(201.0f, right);
+      EXPECT_FLOAT_EQ(301.0f, top);
+    }
 
-  // Peek at object internals to make sure the two XObjects use the same stream.
-  EXPECT_NE(xobjects[0], xobjects[1]);
-  CPDF_PageObject* obj1 = CPDFPageObjectFromFPDFPageObject(xobjects[0]);
-  ASSERT_TRUE(obj1->AsForm());
-  ASSERT_TRUE(obj1->AsForm()->form());
-  ASSERT_TRUE(obj1->AsForm()->form()->GetStream());
-  CPDF_PageObject* obj2 = CPDFPageObjectFromFPDFPageObject(xobjects[1]);
-  ASSERT_TRUE(obj2->AsForm());
-  ASSERT_TRUE(obj2->AsForm()->form());
-  ASSERT_TRUE(obj2->AsForm()->form()->GetStream());
-  EXPECT_EQ(obj1->AsForm()->form()->GetStream(),
-            obj2->AsForm()->form()->GetStream());
-
+    // Peek at object internals to make sure the two XObjects use the same
+    // stream.
+    EXPECT_NE(xobjects[0], xobjects[1]);
+    CPDF_PageObject* obj1 = CPDFPageObjectFromFPDFPageObject(xobjects[0]);
+    ASSERT_TRUE(obj1->AsForm());
+    ASSERT_TRUE(obj1->AsForm()->form());
+    ASSERT_TRUE(obj1->AsForm()->form()->GetStream());
+    CPDF_PageObject* obj2 = CPDFPageObjectFromFPDFPageObject(xobjects[1]);
+    ASSERT_TRUE(obj2->AsForm());
+    ASSERT_TRUE(obj2->AsForm()->form());
+    ASSERT_TRUE(obj2->AsForm()->form()->GetStream());
+    EXPECT_EQ(obj1->AsForm()->form()->GetStream(),
+              obj2->AsForm()->form()->GetStream());
+  });
   for (FPDF_PAGE saved_page : saved_pages)
     CloseSavedPage(saved_page);
 
diff --git a/fpdfsdk/fpdf_save_embeddertest.cpp b/fpdfsdk/fpdf_save_embeddertest.cpp
index 0cbda71..b43766b 100644
--- a/fpdfsdk/fpdf_save_embeddertest.cpp
+++ b/fpdfsdk/fpdf_save_embeddertest.cpp
@@ -2,11 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
+#include <array>
 #include <string>
 
 #include "core/fxcrt/fx_string.h"
@@ -100,7 +96,7 @@
 
 TEST_F(FPDFSaveEmbedderTest, SaveLinearizedDoc) {
   const int kPageCount = 3;
-  std::string original_md5[kPageCount];
+  std::array<std::string, kPageCount> original_md5;
 
   ASSERT_TRUE(OpenDocument("linearized.pdf"));
   for (int i = 0; i < kPageCount; ++i) {
diff --git a/fpdfsdk/fpdf_structtree_embeddertest.cpp b/fpdfsdk/fpdf_structtree_embeddertest.cpp
index 0adddab..a315bd3 100644
--- a/fpdfsdk/fpdf_structtree_embeddertest.cpp
+++ b/fpdfsdk/fpdf_structtree_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <iterator>
 #include <optional>
 
@@ -63,9 +58,9 @@
     // Deliberately pass in a small buffer size to make sure |buffer| remains
     // untouched.
     ASSERT_EQ(24U, FPDF_StructElement_GetAltText(gchild_element, buffer, 1));
-    for (size_t i = 0; i < std::size(buffer); ++i)
-      EXPECT_EQ(0U, buffer[i]);
-
+    for (unsigned short b : buffer) {
+      EXPECT_EQ(0U, b);
+    }
     EXPECT_EQ(-1, FPDF_StructElement_GetMarkedContentID(gchild_element));
     ASSERT_EQ(24U, FPDF_StructElement_GetAltText(gchild_element, buffer,
                                                  sizeof(buffer)));
@@ -114,8 +109,9 @@
     // Deliberately pass in a small buffer size to make sure |buffer| remains
     // untouched.
     ASSERT_EQ(24U, FPDF_StructElement_GetActualText(gchild_element, buffer, 1));
-    for (size_t i = 0; i < std::size(buffer); ++i)
-      EXPECT_EQ(0U, buffer[i]);
+    for (unsigned short b : buffer) {
+      EXPECT_EQ(0U, b);
+    }
     ASSERT_EQ(24U, FPDF_StructElement_GetActualText(gchild_element, buffer,
                                                     sizeof(buffer)));
     EXPECT_EQ(L"Actual Text", GetPlatformWString(buffer));
@@ -499,9 +495,9 @@
     // Deliberately pass in a small buffer size to make sure `buffer` remains
     // untouched.
     ASSERT_EQ(22U, FPDF_StructElement_GetObjType(child, buffer, 1));
-    for (size_t i = 0; i < std::size(buffer); ++i)
-      EXPECT_EQ(0U, buffer[i]);
-
+    for (unsigned short b : buffer) {
+      EXPECT_EQ(0U, b);
+    }
     ASSERT_EQ(22U,
               FPDF_StructElement_GetObjType(child, buffer, sizeof(buffer)));
     EXPECT_EQ(L"StructElem", GetPlatformWString(buffer));
@@ -660,9 +656,9 @@
       ASSERT_TRUE(
           FPDF_StructElement_Attr_GetName(attr, 1, buffer, 1, &out_len));
       EXPECT_EQ(2U, out_len);
-      for (size_t i = 0; i < std::size(buffer); ++i)
-        EXPECT_EQ(0, buffer[i]);
-
+      for (unsigned short b : buffer) {
+        EXPECT_EQ(0U, b);
+      }
       ASSERT_TRUE(FPDF_StructElement_Attr_GetName(attr, 1, buffer,
                                                   sizeof(buffer), &out_len));
       EXPECT_EQ(2U, out_len);
diff --git a/fpdfsdk/fpdf_sysfontinfo_embeddertest.cpp b/fpdfsdk/fpdf_sysfontinfo_embeddertest.cpp
index 8895f1e..3e41a05 100644
--- a/fpdfsdk/fpdf_sysfontinfo_embeddertest.cpp
+++ b/fpdfsdk/fpdf_sysfontinfo_embeddertest.cpp
@@ -2,15 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "public/fpdf_sysfontinfo.h"
 
 #include <vector>
 
+#include "core/fxcrt/compiler_specific.h"
 #include "testing/embedder_test.h"
 #include "testing/embedder_test_environment.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -166,7 +162,8 @@
   // Stop at either end mark.
   while (cfmap->charset != -1 && cfmap->fontname) {
     charsets.push_back(cfmap->charset);
-    ++cfmap;
+    // SAFETY: requires FPDF_GetDefaultTTFMap() to provide a sentinel.
+    UNSAFE_BUFFERS(++cfmap);
   }
 
   // Confirm end marks only occur as a pair.
diff --git a/fpdfsdk/fpdf_view_embeddertest.cpp b/fpdfsdk/fpdf_view_embeddertest.cpp
index ee0bd24..852b446 100644
--- a/fpdfsdk/fpdf_view_embeddertest.cpp
+++ b/fpdfsdk/fpdf_view_embeddertest.cpp
@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include <math.h>
 
 #include <algorithm>
@@ -1281,40 +1276,42 @@
 }
 
 TEST_F(FPDFViewEmbedderTest, GetXFAArrayData) {
-  ASSERT_TRUE(OpenDocument("simple_xfa.pdf"));
-
   static constexpr struct {
+    int index;
     const char* name;
     size_t content_length;
     const char* content_checksum;
-  } kExpectedResults[]{
-      {"preamble", 124u, "71be364e53292596412242bfcdb46eab"},
-      {"config", 642u, "bcd1ca1d420ee31a561273a54a06435f"},
-      {"template", 541u, "0f48cb2fa1bb9cbf9eee802d66e81bf4"},
-      {"localeSet", 3455u, "bb1f253d3e5c719ac0da87d055bc164e"},
-      {"postamble", 11u, "6b79e25da35d86634ea27c38f64cf243"},
+  } kTestCases[]{
+      {0, "preamble", 124u, "71be364e53292596412242bfcdb46eab"},
+      {1, "config", 642u, "bcd1ca1d420ee31a561273a54a06435f"},
+      {2, "template", 541u, "0f48cb2fa1bb9cbf9eee802d66e81bf4"},
+      {3, "localeSet", 3455u, "bb1f253d3e5c719ac0da87d055bc164e"},
+      {4, "postamble", 11u, "6b79e25da35d86634ea27c38f64cf243"},
   };
 
-  ASSERT_EQ(static_cast<int>(std::size(kExpectedResults)),
+  ASSERT_TRUE(OpenDocument("simple_xfa.pdf"));
+  ASSERT_EQ(static_cast<int>(std::size(kTestCases)),
             FPDF_GetXFAPacketCount(document()));
-  for (size_t i = 0; i < std::size(kExpectedResults); ++i) {
+
+  for (const auto& testcase : kTestCases) {
     char name_buffer[20] = {};
-    ASSERT_EQ(strlen(kExpectedResults[i].name) + 1,
-              FPDF_GetXFAPacketName(document(), i, nullptr, 0));
-    EXPECT_EQ(
-        strlen(kExpectedResults[i].name) + 1,
-        FPDF_GetXFAPacketName(document(), i, name_buffer, sizeof(name_buffer)));
-    EXPECT_STREQ(kExpectedResults[i].name, name_buffer);
+    ASSERT_EQ(strlen(testcase.name) + 1,
+              FPDF_GetXFAPacketName(document(), testcase.index, nullptr, 0));
+    EXPECT_EQ(strlen(testcase.name) + 1,
+              FPDF_GetXFAPacketName(document(), testcase.index, name_buffer,
+                                    sizeof(name_buffer)));
+    EXPECT_STREQ(testcase.name, name_buffer);
 
     unsigned long buflen;
-    ASSERT_TRUE(FPDF_GetXFAPacketContent(document(), i, nullptr, 0, &buflen));
-    ASSERT_EQ(kExpectedResults[i].content_length, buflen);
+    ASSERT_TRUE(FPDF_GetXFAPacketContent(document(), testcase.index, nullptr, 0,
+                                         &buflen));
+    ASSERT_EQ(testcase.content_length, buflen);
     std::vector<uint8_t> data_buffer(buflen);
-    EXPECT_TRUE(FPDF_GetXFAPacketContent(document(), i, data_buffer.data(),
-                                         data_buffer.size(), &buflen));
-    EXPECT_EQ(kExpectedResults[i].content_length, buflen);
-    EXPECT_EQ(kExpectedResults[i].content_checksum,
-              GenerateMD5Base16(data_buffer));
+    EXPECT_TRUE(FPDF_GetXFAPacketContent(document(), testcase.index,
+                                         data_buffer.data(), data_buffer.size(),
+                                         &buflen));
+    EXPECT_EQ(testcase.content_length, buflen);
+    EXPECT_EQ(testcase.content_checksum, GenerateMD5Base16(data_buffer));
   }
 
   // Test bad parameters.
@@ -1322,15 +1319,15 @@
 
   EXPECT_EQ(0u, FPDF_GetXFAPacketName(nullptr, 0, nullptr, 0));
   EXPECT_EQ(0u, FPDF_GetXFAPacketName(document(), -1, nullptr, 0));
-  EXPECT_EQ(0u, FPDF_GetXFAPacketName(document(), std::size(kExpectedResults),
-                                      nullptr, 0));
+  EXPECT_EQ(
+      0u, FPDF_GetXFAPacketName(document(), std::size(kTestCases), nullptr, 0));
 
   unsigned long buflen = 123;
   EXPECT_FALSE(FPDF_GetXFAPacketContent(nullptr, 0, nullptr, 0, &buflen));
   EXPECT_EQ(123u, buflen);
   EXPECT_FALSE(FPDF_GetXFAPacketContent(document(), -1, nullptr, 0, &buflen));
   EXPECT_EQ(123u, buflen);
-  EXPECT_FALSE(FPDF_GetXFAPacketContent(document(), std::size(kExpectedResults),
+  EXPECT_FALSE(FPDF_GetXFAPacketContent(document(), std::size(kTestCases),
                                         nullptr, 0, &buflen));
   EXPECT_EQ(123u, buflen);
   EXPECT_FALSE(FPDF_GetXFAPacketContent(document(), 0, nullptr, 0, nullptr));