Use safe arithmentic in CFX_BinaryBuf::ExpandBuf.

core/src/fxcodec/codec/fx_codec_fax.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fxcodec/fx_codec.h"
 #include "core/src/fxcodec/codec/codec_int.h"
 
 namespace {
@@ skipping 781 matching lines @@
     m_pLineBuf[0] = last_byte;
     FaxEncode2DLine(m_pLineBuf, dest_bitpos, scan_line, m_pRefLine, m_Cols);
     m_DestBuf.AppendBlock(m_pLineBuf, dest_bitpos / 8);
     last_byte = m_pLineBuf[dest_bitpos / 8];
     dest_bitpos %= 8;
     FXSYS_memcpy(m_pRefLine, scan_line, m_Pitch);
   }
   if (dest_bitpos) {
     m_DestBuf.AppendByte(last_byte);
   }
-  dest_buf = m_DestBuf.GetBuffer();
   dest_size = m_DestBuf.GetSize();
-  m_DestBuf.DetachBuffer();
+  dest_buf = m_DestBuf.DetachBuffer();
 }
 FX_BOOL CCodec_FaxModule::Encode(const uint8_t* src_buf,
                                  int width,
                                  int height,
                                  int pitch,
                                  uint8_t*& dest_buf,
                                  FX_DWORD& dest_size) {
   CCodec_FaxEncoder encoder(src_buf, width, height, pitch);
   encoder.Encode(dest_buf, dest_size);
   return TRUE;
 }
 ICodec_ScanlineDecoder* CCodec_FaxModule::CreateDecoder(
     const uint8_t* src_buf,
     FX_DWORD src_size,
     int width,
     int height,
     int K,
     FX_BOOL EndOfLine,
     FX_BOOL EncodedByteAlign,
     FX_BOOL BlackIs1,
     int Columns,
     int Rows) {
   CCodec_FaxDecoder* pDecoder = new CCodec_FaxDecoder;
   pDecoder->Create(src_buf, src_size, width, height, K, EndOfLine,
                    EncodedByteAlign, BlackIs1, Columns, Rows);
   return pDecoder;
 }