Make CFX_DIBBase::GetBuffer() const-correct

Changes CFX_DIBBase::GetBuffer() to return a read-only view of the
buffer (a pdfium::span<const uint8_t>), rather than a writable view of
the buffer (a pdfium::span<uint8_t>). This prevents writing to the pixel
memory of a const CFX_DIBBase.

Callers that need a writable view of the buffer must now call
GetWritableBuffer() instead, which requires a non-const CFX_DIBBase.

Bug: pdfium:2034
Change-Id: I2f2055559c08c696c5ae0cbc920f3b7714487811
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/108350
Commit-Queue: K. Moon <kmoon@chromium.org>
Reviewed-by: Nigi <nigi@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_dib.cpp b/core/fpdfapi/page/cpdf_dib.cpp
index 4c961e0..f1c2755 100644
--- a/core/fpdfapi/page/cpdf_dib.cpp
+++ b/core/fpdfapi/page/cpdf_dib.cpp
@@ -352,7 +352,8 @@
     iDecodeStatus = Jbig2Decoder::StartDecode(
         m_pJbig2Context.get(), m_pDocument->GetOrCreateCodecContext(), m_Width,
         m_Height, pSrcSpan, nSrcKey, pGlobalSpan, nGlobalKey,
-        m_pCachedBitmap->GetBuffer(), m_pCachedBitmap->GetPitch(), pPause);
+        m_pCachedBitmap->GetWritableBuffer(), m_pCachedBitmap->GetPitch(),
+        pPause);
   } else {
     iDecodeStatus = Jbig2Decoder::ContinueDecode(m_pJbig2Context.get(), pPause);
   }
@@ -715,8 +716,8 @@
     return nullptr;
 
   result_bitmap->Clear(0xFFFFFFFF);
-  if (!decoder->Decode(result_bitmap->GetBuffer(), result_bitmap->GetPitch(),
-                       swap_rgb, m_nComponents)) {
+  if (!decoder->Decode(result_bitmap->GetWritableBuffer(),
+                       result_bitmap->GetPitch(), swap_rgb, m_nComponents)) {
     return nullptr;
   }
 
@@ -1131,9 +1132,9 @@
   return true;
 }
 
-pdfium::span<uint8_t> CPDF_DIB::GetBuffer() const {
+pdfium::span<const uint8_t> CPDF_DIB::GetBuffer() const {
   return m_pCachedBitmap ? m_pCachedBitmap->GetBuffer()
-                         : pdfium::span<uint8_t>();
+                         : pdfium::span<const uint8_t>();
 }
 
 pdfium::span<const uint8_t> CPDF_DIB::GetScanline(int line) const {
diff --git a/core/fpdfapi/page/cpdf_dib.h b/core/fpdfapi/page/cpdf_dib.h
index a24d192..3df8713 100644
--- a/core/fpdfapi/page/cpdf_dib.h
+++ b/core/fpdfapi/page/cpdf_dib.h
@@ -45,7 +45,7 @@
   CONSTRUCT_VIA_MAKE_RETAIN;
 
   // CFX_DIBBase:
-  pdfium::span<uint8_t> GetBuffer() const override;
+  pdfium::span<const uint8_t> GetBuffer() const override;
   pdfium::span<const uint8_t> GetScanline(int line) const override;
   bool SkipToScanline(int line, PauseIndicatorIface* pPause) const override;
   size_t GetEstimatedImageMemoryBurden() const override;
diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index fe58de8..8accaad 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -1375,7 +1375,7 @@
   if (!pMask->Create(width, height, FXDIB_Format::k8bppMask))
     return nullptr;
 
-  pdfium::span<uint8_t> dest_buf = pMask->GetBuffer();
+  pdfium::span<uint8_t> dest_buf = pMask->GetWritableBuffer();
   pdfium::span<const uint8_t> src_buf = bitmap->GetBuffer();
   int dest_pitch = pMask->GetPitch();
   int src_pitch = bitmap->GetPitch();
diff --git a/core/fxge/agg/fx_agg_driver.cpp b/core/fxge/agg/fx_agg_driver.cpp
index ce52f9c..a2d6e03 100644
--- a/core/fxge/agg/fx_agg_driver.cpp
+++ b/core/fxge/agg/fx_agg_driver.cpp
@@ -75,7 +75,7 @@
   int src_b = FXARGB_B(argb);
   int Bpp = pBitmap->GetBPP() / 8;
   int dib_argb = FXARGB_TOBGRORDERDIB(argb);
-  pdfium::span<uint8_t> pBuffer = pBitmap->GetBuffer();
+  pdfium::span<uint8_t> pBuffer = pBitmap->GetWritableBuffer();
   if (src_alpha == 255) {
     for (int row = rect.top; row < rect.bottom; row++) {
       uint8_t* dest_scan =
@@ -152,8 +152,9 @@
   const size_t dest_x_offset = Fx2DSizeOrDie(dest_left, Bpp);
   const size_t dest_y_offset = Fx2DSizeOrDie(dest_top, dest_pitch);
 
-  pdfium::span<uint8_t> dest_span =
-      pBitmap->GetBuffer().subspan(dest_y_offset).subspan(dest_x_offset);
+  pdfium::span<uint8_t> dest_span = pBitmap->GetWritableBuffer()
+                                        .subspan(dest_y_offset)
+                                        .subspan(dest_x_offset);
   if (dest_format == src_format) {
     const size_t src_x_offset = Fx2DSizeOrDie(src_left, Bpp);
     for (int row = 0; row < height; row++) {
@@ -341,55 +342,61 @@
   void render(const Scanline& sl);
 
  private:
-  using CompositeSpanFunc = void (
-      CFX_Renderer::*)(uint8_t*, int, int, int, uint8_t*, int, int, uint8_t*);
+  using CompositeSpanFunc = void (CFX_Renderer::*)(uint8_t*,
+                                                   int,
+                                                   int,
+                                                   int,
+                                                   const uint8_t*,
+                                                   int,
+                                                   int,
+                                                   const uint8_t*);
 
   void CompositeSpan(uint8_t* dest_scan,
-                     uint8_t* backdrop_scan,
+                     const uint8_t* backdrop_scan,
                      int Bpp,
                      bool bDestAlpha,
                      int span_left,
                      int span_len,
-                     uint8_t* cover_scan,
+                     const uint8_t* cover_scan,
                      int clip_left,
                      int clip_right,
-                     uint8_t* clip_scan);
+                     const uint8_t* clip_scan);
 
   void CompositeSpan1bpp(uint8_t* dest_scan,
                          int Bpp,
                          int span_left,
                          int span_len,
-                         uint8_t* cover_scan,
+                         const uint8_t* cover_scan,
                          int clip_left,
                          int clip_right,
-                         uint8_t* clip_scan);
+                         const uint8_t* clip_scan);
 
   void CompositeSpanGray(uint8_t* dest_scan,
                          int Bpp,
                          int span_left,
                          int span_len,
-                         uint8_t* cover_scan,
+                         const uint8_t* cover_scan,
                          int clip_left,
                          int clip_right,
-                         uint8_t* clip_scan);
+                         const uint8_t* clip_scan);
 
   void CompositeSpanARGB(uint8_t* dest_scan,
                          int Bpp,
                          int span_left,
                          int span_len,
-                         uint8_t* cover_scan,
+                         const uint8_t* cover_scan,
                          int clip_left,
                          int clip_right,
-                         uint8_t* clip_scan);
+                         const uint8_t* clip_scan);
 
   void CompositeSpanRGB(uint8_t* dest_scan,
                         int Bpp,
                         int span_left,
                         int span_len,
-                        uint8_t* cover_scan,
+                        const uint8_t* cover_scan,
                         int clip_left,
                         int clip_right,
-                        uint8_t* clip_scan);
+                        const uint8_t* clip_scan);
 
   void CompositeSpan1bppHelper(uint8_t* dest_scan,
                                int col_start,
@@ -446,15 +453,15 @@
 };
 
 void CFX_Renderer::CompositeSpan(uint8_t* dest_scan,
-                                 uint8_t* backdrop_scan,
+                                 const uint8_t* backdrop_scan,
                                  int Bpp,
                                  bool bDestAlpha,
                                  int span_left,
                                  int span_len,
-                                 uint8_t* cover_scan,
+                                 const uint8_t* cover_scan,
                                  int clip_left,
                                  int clip_right,
-                                 uint8_t* clip_scan) {
+                                 const uint8_t* clip_scan) {
   int col_start = GetColStart(span_left, clip_left);
   int col_end = GetColEnd(span_left, span_len, clip_right);
   if (Bpp) {
@@ -593,10 +600,10 @@
                                      int Bpp,
                                      int span_left,
                                      int span_len,
-                                     uint8_t* cover_scan,
+                                     const uint8_t* cover_scan,
                                      int clip_left,
                                      int clip_right,
-                                     uint8_t* clip_scan) {
+                                     const uint8_t* clip_scan) {
   DCHECK(!m_bRgbByteOrder);
   int col_start = GetColStart(span_left, clip_left);
   int col_end = GetColEnd(span_left, span_len, clip_right);
@@ -609,10 +616,10 @@
                                      int Bpp,
                                      int span_left,
                                      int span_len,
-                                     uint8_t* cover_scan,
+                                     const uint8_t* cover_scan,
                                      int clip_left,
                                      int clip_right,
-                                     uint8_t* clip_scan) {
+                                     const uint8_t* clip_scan) {
   DCHECK(!m_bRgbByteOrder);
   int col_start = GetColStart(span_left, clip_left);
   int col_end = GetColEnd(span_left, span_len, clip_right);
@@ -633,10 +640,10 @@
                                      int Bpp,
                                      int span_left,
                                      int span_len,
-                                     uint8_t* cover_scan,
+                                     const uint8_t* cover_scan,
                                      int clip_left,
                                      int clip_right,
-                                     uint8_t* clip_scan) {
+                                     const uint8_t* clip_scan) {
   int col_start = GetColStart(span_left, clip_left);
   int col_end = GetColEnd(span_left, span_len, clip_right);
   dest_scan += col_start * Bpp;
@@ -701,10 +708,10 @@
                                     int Bpp,
                                     int span_left,
                                     int span_len,
-                                    uint8_t* cover_scan,
+                                    const uint8_t* cover_scan,
                                     int clip_left,
                                     int clip_right,
-                                    uint8_t* clip_scan) {
+                                    const uint8_t* clip_scan) {
   int col_start = GetColStart(span_left, clip_left);
   int col_end = GetColEnd(span_left, span_len, clip_right);
   dest_scan += col_start * Bpp;
@@ -797,8 +804,8 @@
     return;
 
   uint8_t* dest_scan =
-      m_pDevice->GetBuffer().subspan(m_pDevice->GetPitch() * y).data();
-  uint8_t* backdrop_scan = nullptr;
+      m_pDevice->GetWritableBuffer().subspan(m_pDevice->GetPitch() * y).data();
+  const uint8_t* backdrop_scan = nullptr;
   if (m_pBackdropDevice) {
     backdrop_scan = m_pBackdropDevice->GetBuffer()
                         .subspan(m_pBackdropDevice->GetPitch() * y)
@@ -814,7 +821,7 @@
 
     int x = span->x;
     uint8_t* dest_pos = nullptr;
-    uint8_t* backdrop_pos = nullptr;
+    const uint8_t* backdrop_pos = nullptr;
     if (Bpp) {
       backdrop_pos = backdrop_scan ? backdrop_scan + x * Bpp : nullptr;
       dest_pos = dest_scan + x * Bpp;
@@ -822,7 +829,7 @@
       dest_pos = dest_scan + x / 8;
       backdrop_pos = backdrop_scan ? backdrop_scan + x / 8 : nullptr;
     }
-    uint8_t* clip_pos = nullptr;
+    const uint8_t* clip_pos = nullptr;
     if (m_pClipMask) {
       // TODO(crbug.com/1382604): use subspan arithmetic.
       clip_pos = m_pClipMask->GetBuffer().data() +
@@ -1055,7 +1062,7 @@
   auto pThisLayer = pdfium::MakeRetain<CFX_DIBitmap>();
   pThisLayer->Create(path_rect.Width(), path_rect.Height(),
                      FXDIB_Format::k8bppMask);
-  agg::rendering_buffer raw_buf(pThisLayer->GetBuffer().data(),
+  agg::rendering_buffer raw_buf(pThisLayer->GetWritableBuffer().data(),
                                 pThisLayer->GetWidth(), pThisLayer->GetHeight(),
                                 pThisLayer->GetPitch());
   agg::pixfmt_gray8 pixel_buf(raw_buf);
diff --git a/core/fxge/apple/fx_quartz_device.cpp b/core/fxge/apple/fx_quartz_device.cpp
index 9f5f13f..24e0c9c 100644
--- a/core/fxge/apple/fx_quartz_device.cpp
+++ b/core/fxge/apple/fx_quartz_device.cpp
@@ -33,8 +33,8 @@
   }
   CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
   CGContextRef context = CGBitmapContextCreate(
-      pBitmap->GetBuffer().data(), pBitmap->GetWidth(), pBitmap->GetHeight(), 8,
-      pBitmap->GetPitch(), colorSpace, bmpInfo);
+      pBitmap->GetWritableBuffer().data(), pBitmap->GetWidth(),
+      pBitmap->GetHeight(), 8, pBitmap->GetPitch(), colorSpace, bmpInfo);
   CGColorSpaceRelease(colorSpace);
   return context;
 }
diff --git a/core/fxge/cfx_glyphcache.cpp b/core/fxge/cfx_glyphcache.cpp
index 1f12d7b..ba308d4 100644
--- a/core/fxge/cfx_glyphcache.cpp
+++ b/core/fxge/cfx_glyphcache.cpp
@@ -204,7 +204,7 @@
                                         : FXDIB_Format::k8bppMask);
   int dest_pitch = pGlyphBitmap->GetBitmap()->GetPitch();
   int src_pitch = FXFT_Get_Bitmap_Pitch(FXFT_Get_Glyph_Bitmap(GetFaceRec()));
-  uint8_t* pDestBuf = pGlyphBitmap->GetBitmap()->GetBuffer().data();
+  uint8_t* pDestBuf = pGlyphBitmap->GetBitmap()->GetWritableBuffer().data();
   uint8_t* pSrcBuf = static_cast<uint8_t*>(
       FXFT_Get_Bitmap_Buffer(FXFT_Get_Glyph_Bitmap(GetFaceRec())));
   if (anti_alias != FT_RENDER_MODE_MONO &&
diff --git a/core/fxge/dib/cfx_bitmapcomposer.cpp b/core/fxge/dib/cfx_bitmapcomposer.cpp
index 009a618..e924034 100644
--- a/core/fxge/dib/cfx_bitmapcomposer.cpp
+++ b/core/fxge/dib/cfx_bitmapcomposer.cpp
@@ -131,7 +131,7 @@
   int Bpp = m_pBitmap->GetBPP() / 8;
   int dest_pitch = m_pBitmap->GetPitch();
   int dest_x = m_DestLeft + (m_bFlipX ? (m_DestWidth - line - 1) : line);
-  pdfium::span<uint8_t> dest_span = m_pBitmap->GetBuffer();
+  pdfium::span<uint8_t> dest_span = m_pBitmap->GetWritableBuffer();
   if (!dest_span.empty()) {
     const size_t dest_x_offset = Fx2DSizeOrDie(dest_x, Bpp);
     const size_t dest_y_offset = Fx2DSizeOrDie(m_DestTop, dest_pitch);
diff --git a/core/fxge/dib/cfx_dibbase.cpp b/core/fxge/dib/cfx_dibbase.cpp
index 07c7b74..4f99129 100644
--- a/core/fxge/dib/cfx_dibbase.cpp
+++ b/core/fxge/dib/cfx_dibbase.cpp
@@ -620,8 +620,8 @@
 
 CFX_DIBBase::~CFX_DIBBase() = default;
 
-pdfium::span<uint8_t> CFX_DIBBase::GetBuffer() const {
-  return pdfium::span<uint8_t>();
+pdfium::span<const uint8_t> CFX_DIBBase::GetBuffer() const {
+  return pdfium::span<const uint8_t>();
 }
 
 bool CFX_DIBBase::SkipToScanline(int line, PauseIndicatorIface* pPause) const {
@@ -956,8 +956,9 @@
 
   RetainPtr<const CFX_DIBBase> holder(this);
   DataVector<uint32_t> pal_8bpp;
-  if (!ConvertBuffer(dest_format, pClone->GetBuffer(), pClone->GetPitch(),
-                     m_Width, m_Height, holder, 0, 0, &pal_8bpp)) {
+  if (!ConvertBuffer(dest_format, pClone->GetWritableBuffer(),
+                     pClone->GetPitch(), m_Width, m_Height, holder, 0, 0,
+                     &pal_8bpp)) {
     return nullptr;
   }
   if (!pal_8bpp.empty())
@@ -979,8 +980,8 @@
 
   pTransBitmap->SetPalette(GetPaletteSpan());
   const int dest_pitch = pTransBitmap->GetPitch();
-  pdfium::span<uint8_t> dest_span =
-      pTransBitmap->GetBuffer().first(Fx2DSizeOrDie(dest_pitch, result_height));
+  pdfium::span<uint8_t> dest_span = pTransBitmap->GetWritableBuffer().first(
+      Fx2DSizeOrDie(dest_pitch, result_height));
   const size_t dest_last_row_offset =
       Fx2DSizeOrDie(dest_pitch, result_height - 1);
   const int row_start = bXFlip ? m_Height - dest_clip.right : dest_clip.left;
diff --git a/core/fxge/dib/cfx_dibbase.h b/core/fxge/dib/cfx_dibbase.h
index 1e507e6..589e20d 100644
--- a/core/fxge/dib/cfx_dibbase.h
+++ b/core/fxge/dib/cfx_dibbase.h
@@ -32,15 +32,21 @@
 
   static constexpr uint32_t kPaletteSize = 256;
 
-  virtual pdfium::span<uint8_t> GetBuffer() const;
-  virtual pdfium::span<const uint8_t> GetScanline(int line) const = 0;
-  virtual bool SkipToScanline(int line, PauseIndicatorIface* pPause) const;
-  virtual size_t GetEstimatedImageMemoryBurden() const;
+  virtual pdfium::span<const uint8_t> GetBuffer() const;
+  pdfium::span<uint8_t> GetWritableBuffer() {
+    pdfium::span<const uint8_t> src = GetBuffer();
+    return {const_cast<uint8_t*>(src.data()), src.size()};
+  }
 
+  virtual pdfium::span<const uint8_t> GetScanline(int line) const = 0;
   pdfium::span<uint8_t> GetWritableScanline(int line) {
     pdfium::span<const uint8_t> src = GetScanline(line);
     return {const_cast<uint8_t*>(src.data()), src.size()};
   }
+
+  virtual bool SkipToScanline(int line, PauseIndicatorIface* pPause) const;
+  virtual size_t GetEstimatedImageMemoryBurden() const;
+
   int GetWidth() const { return m_Width; }
   int GetHeight() const { return m_Height; }
   uint32_t GetPitch() const { return m_Pitch; }
diff --git a/core/fxge/dib/cfx_dibextractor.cpp b/core/fxge/dib/cfx_dibextractor.cpp
index 9dcfbec..e9fded9 100644
--- a/core/fxge/dib/cfx_dibextractor.cpp
+++ b/core/fxge/dib/cfx_dibextractor.cpp
@@ -16,7 +16,7 @@
   }
   m_pBitmap = pdfium::MakeRetain<CFX_DIBitmap>();
   if (!m_pBitmap->Create(pSrc->GetWidth(), pSrc->GetHeight(), pSrc->GetFormat(),
-                         pSrc->GetBuffer().data(),
+                         pSrc->GetWritableBuffer().data(),
                          /*pitch=*/0)) {
     m_pBitmap.Reset();
     return;
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 62881a6..0d9360e 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -85,9 +85,9 @@
 
 CFX_DIBitmap::~CFX_DIBitmap() = default;
 
-pdfium::span<uint8_t> CFX_DIBitmap::GetBuffer() const {
+pdfium::span<const uint8_t> CFX_DIBitmap::GetBuffer() const {
   if (!m_pBuffer)
-    return pdfium::span<uint8_t>();
+    return pdfium::span<const uint8_t>();
 
   return {m_pBuffer.Get(), m_Height * m_Pitch};
 }
@@ -237,7 +237,7 @@
   if (!offset.IsValid())
     return false;
 
-  pdfium::span<uint8_t> dest_buf = GetBuffer().subspan(
+  pdfium::span<uint8_t> dest_buf = GetWritableBuffer().subspan(
       dest_top * m_Pitch + static_cast<uint32_t>(offset.ValueOrDie()));
   DataVector<uint32_t> d_plt;
   return ConvertBuffer(dest_format, dest_buf, m_Pitch, width, height,
diff --git a/core/fxge/dib/cfx_dibitmap.h b/core/fxge/dib/cfx_dibitmap.h
index 5817155..5abf34b 100644
--- a/core/fxge/dib/cfx_dibitmap.h
+++ b/core/fxge/dib/cfx_dibitmap.h
@@ -33,7 +33,7 @@
   bool Copy(const RetainPtr<CFX_DIBBase>& pSrc);
 
   // CFX_DIBBase
-  pdfium::span<uint8_t> GetBuffer() const override;
+  pdfium::span<const uint8_t> GetBuffer() const override;
   pdfium::span<const uint8_t> GetScanline(int line) const override;
   size_t GetEstimatedImageMemoryBurden() const override;
 
diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp
index c600e3f..2111d31 100644
--- a/core/fxge/skia/fx_skia_device.cpp
+++ b/core/fxge/skia/fx_skia_device.cpp
@@ -166,7 +166,7 @@
   DCHECK_EQ(1, source->GetBPP());
   int width = source->GetWidth();
   int height = source->GetHeight();
-  void* buffer = source->GetBuffer().data();
+  const void* buffer = source->GetBuffer().data();
   DCHECK(buffer);
 
   uint32_t color0 = source->GetPaletteArgb(0);
@@ -194,7 +194,7 @@
   DCHECK_EQ(8, source->GetBPP());
   int width = source->GetWidth();
   int height = source->GetHeight();
-  void* buffer = source->GetBuffer().data();
+  const void* buffer = source->GetBuffer().data();
   DCHECK(buffer);
   DataVector<uint32_t> dst32_storage(Fx2DSizeOrDie(width, height));
   pdfium::span<SkPMColor> dst32_pixels(dst32_storage);
@@ -671,7 +671,8 @@
               DataVector<uint32_t>& dst32_storage,
               SkBitmap* skBitmap,
               bool forceAlpha) {
-  void* buffer = pSource->GetBuffer().data();
+  // TODO(crbug.com/pdfium/2034): Does not need to use `GetWritableBuffer()`.
+  void* buffer = pSource->GetWritableBuffer().data();
   if (!buffer)
     return false;
   SkColorType colorType = forceAlpha || pSource->IsMaskFormat()
@@ -863,8 +864,8 @@
   SkImageInfo imageInfo =
       SkImageInfo::Make(m_pBitmap->GetWidth(), m_pBitmap->GetHeight(),
                         color_type, kPremul_SkAlphaType);
-  surface_ = SkSurfaces::WrapPixels(imageInfo, m_pBitmap->GetBuffer().data(),
-                                    m_pBitmap->GetPitch());
+  surface_ = SkSurfaces::WrapPixels(
+      imageInfo, m_pBitmap->GetWritableBuffer().data(), m_pBitmap->GetPitch());
   m_pCanvas = surface_->getCanvas();
 }
 
@@ -1510,7 +1511,8 @@
   if (!m_pBitmap)
     return true;
 
-  uint8_t* srcBuffer = m_pBitmap->GetBuffer().data();
+  // TODO(crbug.com/pdfium/2034): Does not need to use `GetWritableBuffer()`.
+  uint8_t* srcBuffer = m_pBitmap->GetWritableBuffer().data();
   if (!srcBuffer)
     return true;
 
@@ -1523,7 +1525,7 @@
   skSrcBitmap.installPixels(srcImageInfo, srcBuffer, srcRowBytes);
   skSrcBitmap.setImmutable();
 
-  uint8_t* dstBuffer = pBitmap->GetBuffer().data();
+  uint8_t* dstBuffer = pBitmap->GetWritableBuffer().data();
   DCHECK(dstBuffer);
 
   int dstWidth = pBitmap->GetWidth();
@@ -1616,7 +1618,7 @@
   if (GetBPP() != 32)
     return;
 
-  void* buffer = GetBuffer().data();
+  void* buffer = GetWritableBuffer().data();
   if (!buffer)
     return;
 
@@ -1641,7 +1643,7 @@
   if (GetBPP() != 32)
     return;
 
-  void* buffer = GetBuffer().data();
+  void* buffer = GetWritableBuffer().data();
   if (!buffer)
     return;
 
diff --git a/core/fxge/win32/cgdi_device_driver.cpp b/core/fxge/win32/cgdi_device_driver.cpp
index 048377d..efd8a10 100644
--- a/core/fxge/win32/cgdi_device_driver.cpp
+++ b/core/fxge/win32/cgdi_device_driver.cpp
@@ -393,7 +393,7 @@
     if (!pBitmap)
       return false;
 
-    LPBYTE pBuffer = pBitmap->GetBuffer().data();
+    LPBYTE pBuffer = pBitmap->GetWritableBuffer().data();
     ByteString info = GetBitmapInfo(pBitmap);
     ((BITMAPINFOHEADER*)info.c_str())->biHeight *= -1;
     FX_RECT dst_rect(0, 0, src_rect.Width(), src_rect.Height());
@@ -407,12 +407,11 @@
   }
 
   RetainPtr<CFX_DIBitmap> pBitmap = pBitmap1;
-  LPBYTE pBuffer = pBitmap->GetBuffer().data();
   ByteString info = GetBitmapInfo(pBitmap);
   ::SetDIBitsToDevice(m_hDC, left, top, src_rect.Width(), src_rect.Height(),
                       src_rect.left, pBitmap->GetHeight() - src_rect.bottom, 0,
-                      pBitmap->GetHeight(), pBuffer, (BITMAPINFO*)info.c_str(),
-                      DIB_RGB_COLORS);
+                      pBitmap->GetHeight(), pBitmap->GetBuffer().data(),
+                      (BITMAPINFO*)info.c_str(), DIB_RGB_COLORS);
   return true;
 }
 
diff --git a/core/fxge/win32/cgdi_display_driver.cpp b/core/fxge/win32/cgdi_display_driver.cpp
index 7ba2d76..cb1ac48 100644
--- a/core/fxge/win32/cgdi_display_driver.cpp
+++ b/core/fxge/win32/cgdi_display_driver.cpp
@@ -51,14 +51,15 @@
   bmi.bmiHeader.biPlanes = 1;
   bmi.bmiHeader.biWidth = width;
   if (pBitmap->GetBPP() > 8) {
-    ret = ::GetDIBits(hDCMemory, hbmp, 0, height, pBitmap->GetBuffer().data(),
-                      &bmi, DIB_RGB_COLORS) == height;
+    ret = ::GetDIBits(hDCMemory, hbmp, 0, height,
+                      pBitmap->GetWritableBuffer().data(), &bmi,
+                      DIB_RGB_COLORS) == height;
   } else {
     auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
     if (bitmap->Create(width, height, FXDIB_Format::kRgb)) {
       bmi.bmiHeader.biBitCount = 24;
-      ::GetDIBits(hDCMemory, hbmp, 0, height, bitmap->GetBuffer().data(), &bmi,
-                  DIB_RGB_COLORS);
+      ::GetDIBits(hDCMemory, hbmp, 0, height,
+                  bitmap->GetWritableBuffer().data(), &bmi, DIB_RGB_COLORS);
       ret = pBitmap->TransferBitmap(0, 0, width, height, bitmap, 0, 0);
     } else {
       ret = false;
diff --git a/core/fxge/win32/cgdi_plus_ext.cpp b/core/fxge/win32/cgdi_plus_ext.cpp
index 06571da..e4442c0 100644
--- a/core/fxge/win32/cgdi_plus_ext.cpp
+++ b/core/fxge/win32/cgdi_plus_ext.cpp
@@ -222,7 +222,7 @@
     return;
   }
   int src_pitch = pBitmap->GetPitch();
-  uint8_t* scan0 = pBitmap->GetBuffer()
+  uint8_t* scan0 = pBitmap->GetWritableBuffer()
                        .subspan(src_rect.top * src_pitch +
                                 pBitmap->GetBPP() * src_rect.left / 8)
                        .data();
diff --git a/fpdfsdk/fpdf_view.cpp b/fpdfsdk/fpdf_view.cpp
index 430b660..e5165e2 100644
--- a/fpdfsdk/fpdf_view.cpp
+++ b/fpdfsdk/fpdf_view.cpp
@@ -597,8 +597,8 @@
     if (win_dc.GetDeviceType() == DeviceType::kPrinter) {
       auto pDst = pdfium::MakeRetain<CFX_DIBitmap>();
       if (pDst->Create(size_x, size_y, FXDIB_Format::kRgb32)) {
-        fxcrt::spanset(pDst->GetBuffer().first(pBitmap->GetPitch() * size_y),
-                       -1);
+        fxcrt::spanset(
+            pDst->GetWritableBuffer().first(pBitmap->GetPitch() * size_y), -1);
         pDst->CompositeBitmap(0, 0, size_x, size_y, pBitmap, 0, 0,
                               BlendMode::kNormal, nullptr, false);
         win_dc.StretchDIBits(pDst, 0, 0, size_x, size_y);
@@ -920,7 +920,7 @@
 }
 
 FPDF_EXPORT void* FPDF_CALLCONV FPDFBitmap_GetBuffer(FPDF_BITMAP bitmap) {
-  return bitmap ? CFXDIBitmapFromFPDFBitmap(bitmap)->GetBuffer().data()
+  return bitmap ? CFXDIBitmapFromFPDFBitmap(bitmap)->GetWritableBuffer().data()
                 : nullptr;
 }
 
diff --git a/testing/fuzzers/pdf_codec_jbig2_fuzzer.cc b/testing/fuzzers/pdf_codec_jbig2_fuzzer.cc
index 59eda76..4c48b6f 100644
--- a/testing/fuzzers/pdf_codec_jbig2_fuzzer.cc
+++ b/testing/fuzzers/pdf_codec_jbig2_fuzzer.cc
@@ -38,7 +38,7 @@
   Jbig2Context jbig2_context;
   FXCODEC_STATUS status = Jbig2Decoder::StartDecode(
       &jbig2_context, &document_context, width, height, {data, size}, 1, {}, 0,
-      bitmap->GetBuffer(), bitmap->GetPitch(), nullptr);
+      bitmap->GetWritableBuffer(), bitmap->GetPitch(), nullptr);
 
   while (status == FXCODEC_STATUS::kDecodeToBeContinued)
     status = Jbig2Decoder::ContinueDecode(&jbig2_context, nullptr);
diff --git a/testing/fuzzers/pdf_jpx_fuzzer.cc b/testing/fuzzers/pdf_jpx_fuzzer.cc
index 3021d76..c7e7e2f 100644
--- a/testing/fuzzers/pdf_jpx_fuzzer.cc
+++ b/testing/fuzzers/pdf_jpx_fuzzer.cc
@@ -69,8 +69,8 @@
           static_cast<uint32_t>(bitmap->GetHeight()))
     return 0;
 
-  decoder->Decode(bitmap->GetBuffer(), bitmap->GetPitch(), /*swap_rgb=*/false,
-                  GetCompsFromFormat(format));
+  decoder->Decode(bitmap->GetWritableBuffer(), bitmap->GetPitch(),
+                  /*swap_rgb=*/false, GetCompsFromFormat(format));
 
   return 0;
 }
diff --git a/xfa/fgas/graphics/cfgas_gegraphics.cpp b/xfa/fgas/graphics/cfgas_gegraphics.cpp
index 7525abc..591451f 100644
--- a/xfa/fgas/graphics/cfgas_gegraphics.cpp
+++ b/xfa/fgas/graphics/cfgas_gegraphics.cpp
@@ -261,7 +261,7 @@
   auto mask = pdfium::MakeRetain<CFX_DIBitmap>();
   mask->Create(data.width, data.height, FXDIB_Format::k1bppMask);
   fxcrt::spancpy(
-      mask->GetBuffer(),
+      mask->GetWritableBuffer(),
       pdfium::make_span(data.maskBits).first(mask->GetPitch() * data.height));
   const CFX_FloatRect rectf =
       matrix.TransformRect(path.GetPath().GetBoundingBox());