diff --git a/core/fxcodec/bmp/cfx_bmpdecompressor.cpp b/core/fxcodec/bmp/cfx_bmpdecompressor.cpp
index 90e087e..1931774 100644
--- a/core/fxcodec/bmp/cfx_bmpdecompressor.cpp
+++ b/core/fxcodec/bmp/cfx_bmpdecompressor.cpp
@@ -87,10 +87,8 @@
 
 BmpDecoder::Status CFX_BmpDecompressor::ReadBmpHeader() {
   BmpFileHeader bmp_header;
-  if (!ReadData(reinterpret_cast<uint8_t*>(&bmp_header),
-                sizeof(BmpFileHeader))) {
+  if (!ReadData(pdfium::as_writable_bytes(pdfium::make_span(&bmp_header, 1))))
     return BmpDecoder::Status::kContinue;
-  }
 
   bmp_header.bfType =
       FXSYS_UINT16_GET_LSBFIRST(reinterpret_cast<uint8_t*>(&bmp_header.bfType));
@@ -102,8 +100,8 @@
     return BmpDecoder::Status::kFail;
 
   size_t pos = input_buffer_->GetPosition();
-  if (!ReadData(reinterpret_cast<uint8_t*>(&img_ifh_size_),
-                sizeof(img_ifh_size_))) {
+  if (!ReadData(
+          pdfium::as_writable_bytes(pdfium::make_span(&img_ifh_size_, 1)))) {
     return BmpDecoder::Status::kContinue;
   }
   if (!input_buffer_->Seek(pos))
@@ -123,8 +121,8 @@
   if (img_ifh_size_ == kBmpCoreHeaderSize) {
     pal_type_ = 1;
     BmpCoreHeader bmp_core_header;
-    if (!ReadData(reinterpret_cast<uint8_t*>(&bmp_core_header),
-                  sizeof(BmpCoreHeader))) {
+    if (!ReadData(pdfium::as_writable_bytes(
+            pdfium::make_span(&bmp_core_header, 1)))) {
       return BmpDecoder::Status::kContinue;
     }
 
@@ -141,8 +139,8 @@
 
   if (img_ifh_size_ == kBmpInfoHeaderSize) {
     BmpInfoHeader bmp_info_header;
-    if (!ReadData(reinterpret_cast<uint8_t*>(&bmp_info_header),
-                  sizeof(BmpInfoHeader))) {
+    if (!ReadData(pdfium::as_writable_bytes(
+            pdfium::make_span(&bmp_info_header, 1)))) {
       return BmpDecoder::Status::kContinue;
     }
 
@@ -170,8 +168,8 @@
 
   FX_SAFE_SIZE_T new_pos = input_buffer_->GetPosition();
   BmpInfoHeader bmp_info_header;
-  if (!ReadData(reinterpret_cast<uint8_t*>(&bmp_info_header),
-                sizeof(bmp_info_header))) {
+  if (!ReadData(
+          pdfium::as_writable_bytes(pdfium::make_span(&bmp_info_header, 1)))) {
     return BmpDecoder::Status::kContinue;
   }
 
@@ -270,7 +268,7 @@
     return BmpDecoder::Status::kFail;
 
   uint32_t masks[3];
-  if (!ReadData(reinterpret_cast<uint8_t*>(masks), sizeof(masks)))
+  if (!ReadData(pdfium::as_writable_bytes(pdfium::make_span(masks))))
     return BmpDecoder::Status::kContinue;
 
   mask_red_ = FXSYS_UINT32_GET_LSBFIRST(reinterpret_cast<uint8_t*>(&masks[0]));
@@ -297,10 +295,10 @@
     pal_num_ = 1 << bit_counts_;
     if (color_used_ != 0)
       pal_num_ = color_used_;
-    uint32_t src_pal_size = pal_num_ * (pal_type_ ? 3 : 4);
+    size_t src_pal_size = pal_num_ * (pal_type_ ? 3 : 4);
     std::vector<uint8_t, FxAllocAllocator<uint8_t>> src_pal(src_pal_size);
     uint8_t* src_pal_data = src_pal.data();
-    if (!ReadData(src_pal_data, src_pal_size))
+    if (!ReadData(src_pal))
       return BmpDecoder::Status::kContinue;
 
     palette_.resize(pal_num_);
@@ -372,10 +370,9 @@
   std::vector<uint8_t, FxAllocAllocator<uint8_t>> dest_buf(src_row_bytes_);
   while (row_num_ < height_) {
     size_t idx = 0;
-    if (!ReadData(dest_buf.data(),
-                  pdfium::base::checked_cast<uint32_t>(src_row_bytes_))) {
+    if (!ReadData(dest_buf))
       return BmpDecoder::Status::kContinue;
-    }
+
     SaveDecodingStatus(DecodeStatus::kData);
     switch (bit_counts_) {
       case 1: {
@@ -446,12 +443,12 @@
   uint8_t first_part;
   col_num_ = 0;
   while (true) {
-    if (!ReadData(&first_part, sizeof(first_part)))
+    if (!ReadData(pdfium::make_span(&first_part, 1)))
       return BmpDecoder::Status::kContinue;
 
     switch (first_part) {
       case kRleMarker: {
-        if (!ReadData(&first_part, sizeof(first_part)))
+        if (!ReadData(pdfium::make_span(&first_part, 1)))
           return BmpDecoder::Status::kContinue;
 
         switch (first_part) {
@@ -475,7 +472,7 @@
           }
           case kRleDelta: {
             uint8_t delta[2];
-            if (!ReadData(delta, sizeof(delta)))
+            if (!ReadData(delta))
               return BmpDecoder::Status::kContinue;
 
             col_num_ += delta[0];
@@ -500,9 +497,7 @@
             std::vector<uint8_t, FxAllocAllocator<uint8_t>> second_part(
                 second_part_size);
             uint8_t* second_part_data = second_part.data();
-            if (!ReadData(
-                    second_part_data,
-                    pdfium::base::checked_cast<uint32_t>(second_part_size)))
+            if (!ReadData(second_part))
               return BmpDecoder::Status::kContinue;
 
             std::copy(second_part_data, second_part_data + first_part,
@@ -523,7 +518,7 @@
           return BmpDecoder::Status::kFail;
 
         uint8_t second_part;
-        if (!ReadData(&second_part, sizeof(second_part)))
+        if (!ReadData(pdfium::make_span(&second_part, 1)))
           return BmpDecoder::Status::kContinue;
 
         std::fill(out_row_buffer_.begin() + col_num_,
@@ -540,12 +535,12 @@
   uint8_t first_part;
   col_num_ = 0;
   while (true) {
-    if (!ReadData(&first_part, sizeof(first_part)))
+    if (!ReadData(pdfium::make_span(&first_part, 1)))
       return BmpDecoder::Status::kContinue;
 
     switch (first_part) {
       case kRleMarker: {
-        if (!ReadData(&first_part, sizeof(first_part)))
+        if (!ReadData(pdfium::make_span(&first_part, 1)))
           return BmpDecoder::Status::kContinue;
 
         switch (first_part) {
@@ -569,7 +564,7 @@
           }
           case kRleDelta: {
             uint8_t delta[2];
-            if (!ReadData(delta, sizeof(delta)))
+            if (!ReadData(delta))
               return BmpDecoder::Status::kContinue;
 
             col_num_ += delta[0];
@@ -599,11 +594,9 @@
             std::vector<uint8_t, FxAllocAllocator<uint8_t>> second_part(
                 second_part_size);
             uint8_t* second_part_data = second_part.data();
-            if (!ReadData(
-                    second_part_data,
-                    pdfium::base::checked_cast<uint32_t>(second_part_size))) {
+            if (!ReadData(second_part))
               return BmpDecoder::Status::kContinue;
-            }
+
             for (uint8_t i = 0; i < first_part; i++) {
               uint8_t color = (i & 0x01) ? (*second_part_data++ & 0x0F)
                                          : (*second_part_data & 0xF0) >> 4;
@@ -630,7 +623,7 @@
           first_part = avail_size - 1;
         }
         uint8_t second_part;
-        if (!ReadData(&second_part, sizeof(second_part)))
+        if (!ReadData(pdfium::make_span(&second_part, 1)))
           return BmpDecoder::Status::kContinue;
 
         for (uint8_t i = 0; i < first_part; i++) {
@@ -647,8 +640,9 @@
   }
 }
 
-bool CFX_BmpDecompressor::ReadData(uint8_t* destination, uint32_t size) {
-  return input_buffer_ && input_buffer_->ReadBlock(destination, size) == size;
+bool CFX_BmpDecompressor::ReadData(pdfium::span<uint8_t> buf) {
+  return input_buffer_ &&
+         input_buffer_->ReadBlock(buf.data(), buf.size()) == buf.size();
 }
 
 void CFX_BmpDecompressor::SaveDecodingStatus(DecodeStatus status) {
diff --git a/core/fxcodec/bmp/cfx_bmpdecompressor.h b/core/fxcodec/bmp/cfx_bmpdecompressor.h
index 7e39d33..9151f40 100644
--- a/core/fxcodec/bmp/cfx_bmpdecompressor.h
+++ b/core/fxcodec/bmp/cfx_bmpdecompressor.h
@@ -14,6 +14,7 @@
 #include "core/fxcrt/fx_memory_wrappers.h"
 #include "core/fxcrt/retain_ptr.h"
 #include "core/fxcrt/unowned_ptr.h"
+#include "third_party/base/span.h"
 
 class CFX_CodecMemory;
 
@@ -59,7 +60,7 @@
   BmpDecoder::Status DecodeRGB();
   BmpDecoder::Status DecodeRLE8();
   BmpDecoder::Status DecodeRLE4();
-  bool ReadData(uint8_t* destination, uint32_t size);
+  bool ReadData(pdfium::span<uint8_t> buf);
   void SaveDecodingStatus(DecodeStatus status);
   bool ValidateColorIndex(uint8_t val) const;
   bool ValidateFlag() const;