Use safe arithmentic in CFX_BinaryBuf::ExpandBuf.

xfa/src/fxfa/src/fm2js/xfa_simpleexpression.cpp

Index: xfa/src/fxfa/src/fm2js/xfa_simpleexpression.cpp
diff --git a/xfa/src/fxfa/src/fm2js/xfa_simpleexpression.cpp b/xfa/src/fxfa/src/fm2js/xfa_simpleexpression.cpp
index c67681f6baaf45cbe5b524dfb193771d4b4cf68e..7048c38d5a45c794f66702110301aa90b74ffea0 100644
--- a/xfa/src/fxfa/src/fm2js/xfa_simpleexpression.cpp
+++ b/xfa/src/fxfa/src/fm2js/xfa_simpleexpression.cpp
@@ -447,8 +447,8 @@ CXFA_FMCallExpression::~CXFA_FMCallExpression() {
   }
 }
 FX_BOOL CXFA_FMCallExpression::IsBuildInFunc(CFX_WideTextBuf& funcName) {
-  int32_t iLength = funcName.GetLength();
-  uint32_t uHash = FX_HashCode_String_GetW(funcName.GetBuffer(), iLength, TRUE);
+  uint32_t uHash =
+      FX_HashCode_String_GetW(funcName.GetBuffer(), funcName.GetLength(), TRUE);
   XFA_FMBuildInFunc buildinfunction;
   int32_t iStart = 0,
           iEnd = (sizeof(buildInFuncs) / sizeof(buildInFuncs[0])) - 1;