diff --git a/xfa/fgas/font/cfgas_fontmgr.cpp b/xfa/fgas/font/cfgas_fontmgr.cpp
index ddfe438..b126030 100644
--- a/xfa/fgas/font/cfgas_fontmgr.cpp
+++ b/xfa/fgas/font/cfgas_fontmgr.cpp
@@ -334,11 +334,9 @@
   return x ? x->wBitField : 999;
 }
 
-inline uint8_t GetUInt8(const uint8_t* p) {
-  return p[0];
-}
-
-inline uint16_t GetUInt16(const uint8_t* p) {
+uint16_t ReadUInt16FromSpanAtOffset(pdfium::span<const uint8_t> data,
+                                    size_t offset) {
+  const uint8_t* p = &data[offset];
   return FXSYS_UINT16_GET_MSBFIRST(p);
 }
 
@@ -368,31 +366,31 @@
   if (name_table.empty())
     return results;
 
-  const uint8_t* pTable = name_table.data();
-  WideString wsFamily;
-  const uint8_t* sp = pTable + 2;
-  const uint8_t* pNameRecord = pTable + 6;
-  uint16_t nNameCount = GetUInt16(sp);
-  const uint8_t* pStr = pTable + GetUInt16(sp + 2);
-  for (uint16_t j = 0; j < nNameCount; j++) {
-    uint16_t nNameID = GetUInt16(pNameRecord + j * 12 + 6);
+  uint16_t nNameCount = ReadUInt16FromSpanAtOffset(name_table, 2);
+  pdfium::span<const uint8_t> str =
+      name_table.subspan(ReadUInt16FromSpanAtOffset(name_table, 4));
+  pdfium::span<const uint8_t> name_record = name_table.subspan(6);
+  for (uint16_t i = 0; i < nNameCount; ++i) {
+    uint16_t nNameID = ReadUInt16FromSpanAtOffset(name_table, i * 12 + 6);
     if (nNameID != 1)
       continue;
 
-    uint16_t nPlatformID = GetUInt16(pNameRecord + j * 12 + 0);
-    uint16_t nNameLength = GetUInt16(pNameRecord + j * 12 + 8);
-    uint16_t nNameOffset = GetUInt16(pNameRecord + j * 12 + 10);
-    wsFamily.clear();
+    uint16_t nPlatformID = ReadUInt16FromSpanAtOffset(name_record, i * 12);
+    uint16_t nNameLength = ReadUInt16FromSpanAtOffset(name_record, i * 12 + 8);
+    uint16_t nNameOffset = ReadUInt16FromSpanAtOffset(name_record, i * 12 + 10);
     if (nPlatformID != 1) {
-      for (uint16_t k = 0; k < nNameLength / 2; k++) {
-        wchar_t wcTemp = GetUInt16(pStr + nNameOffset + k * 2);
+      WideString wsFamily;
+      for (uint16_t j = 0; j < nNameLength / 2; ++j) {
+        wchar_t wcTemp = ReadUInt16FromSpanAtOffset(str, nNameOffset + j * 2);
         wsFamily += wcTemp;
       }
       results.push_back(wsFamily);
       continue;
     }
-    for (uint16_t k = 0; k < nNameLength; k++) {
-      wchar_t wcTemp = GetUInt8(pStr + nNameOffset + k);
+
+    WideString wsFamily;
+    for (uint16_t j = 0; j < nNameLength; ++j) {
+      wchar_t wcTemp = str[nNameOffset + j];
       wsFamily += wcTemp;
     }
     results.push_back(wsFamily);