Convert non-conforming UNSAFE_BUFFERS() usage to UNSAFE_TODO().

Per the updated unsafe_buffers.md, UNSAFE_BUFFERS() should only be used for cases where subsequent spanification is not possible, and that other cases should use the UNSAFE_TODO() macro. Then update existing usage to conform to this convention. Code lacking safety comments is converted to UNSAFE_TODO() as well. Document some functions that should propagate unsafety to their callers via UNSAFE_BUFFER_USAGE but do not enforce this. Change-Id: Ieb6472102a2e245d040b4d4ad50317c2358d9783 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5786346 Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Commit-Queue: Daniel Cheng <dcheng@chromium.org> Owners-Override: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/main@{#1342098}
JAJAJAwe · Aug 15, 2024 · 5faa765 · 5faa765
1 parent 2a60dce
commit 5faa765
Show file tree

Hide file tree

Showing 62 changed files with 113 additions and 111 deletions.
diff --git a/base/memory/ref_counted_memory.h b/base/memory/ref_counted_memory.h
@@ -82,7 +82,7 @@ class BASE_EXPORT RefCountedStaticMemory : public RefCountedMemory {
 
   // TODO(crbug.com/40284755): Remove this overload, use the span ctor instead.
   RefCountedStaticMemory(const void* data, size_t length)
-      : UNSAFE_BUFFERS(bytes_(static_cast<const uint8_t*>(data), length)) {}
+      : UNSAFE_TODO(bytes_(static_cast<const uint8_t*>(data), length)) {}
 
   RefCountedStaticMemory(const RefCountedStaticMemory&) = delete;
   RefCountedStaticMemory& operator=(const RefCountedStaticMemory&) = delete;

diff --git a/base/metrics/field_trial.cc b/base/metrics/field_trial.cc
@@ -228,7 +228,7 @@ PickleIterator FieldTrial::FieldTrialEntry::GetPickleIterator() const {
   Pickle pickle = Pickle::WithUnownedBuffer(
       // TODO(crbug.com/40284755): FieldTrialEntry should be constructed with a
       // span over the pickle memory.
-      UNSAFE_BUFFERS(
+      UNSAFE_TODO(
           span(GetPickledDataPtr(), checked_cast<size_t>(pickle_size))));
   return PickleIterator(pickle);
 }

diff --git a/base/strings/string_number_conversions.cc b/base/strings/string_number_conversions.cc
@@ -123,7 +123,7 @@ std::string HexEncode(const void* bytes, size_t size) {
   return HexEncode(
       // TODO(crbug.com/40284755): The pointer-based overload of HexEncode
       // should be removed.
-      UNSAFE_BUFFERS(span(static_cast<const uint8_t*>(bytes), size)));
+      UNSAFE_TODO(span(static_cast<const uint8_t*>(bytes), size)));
 }
 
 std::string HexEncode(span<const uint8_t> bytes) {

diff --git a/chrome/test/chromedriver/net/websocket.cc b/chrome/test/chromedriver/net/websocket.cc
@@ -317,7 +317,7 @@ void WebSocket::OnReadDuringOpen(const char* data, int len) {
           // TODO(crbug.com/354307328): It's not possible to construct this span
           // soundedly here. OnReadDuringOpen() should receive a span instead of
           // a pointer and length.
-          UNSAFE_BUFFERS(base::span(data, base::checked_cast<size_t>(len)))),
+          UNSAFE_TODO(base::span(data, base::checked_cast<size_t>(len)))),
       &frame_chunks));
   for (size_t i = 0; i < frame_chunks.size(); ++i) {
     const auto& header = frame_chunks[i]->header;

diff --git a/chromecast/media/audio/capture_service/message_parsing_utils.cc b/chromecast/media/audio/capture_service/message_parsing_utils.cc
@@ -178,7 +178,7 @@ char* PopulatePcmAudioHeader(char* data_ptr,
   auto data = base::as_writable_bytes(
       // TODO(crbug.com/328018028): PopulatePcmAudioHeader() should
       // get a span, not a pointer and length.
-      UNSAFE_BUFFERS(base::span(data_ptr, size)));
+      UNSAFE_TODO(base::span(data_ptr, size)));
   auto header_as_bytes =
       base::byte_span_from_ref(header).subspan(sizeof(header.size));
   auto after = FillBuffer(data, header_as_bytes);
@@ -201,7 +201,7 @@ void PopulateHandshakeMessage(char* data_ptr,
   auto data = base::as_writable_bytes(
       // TODO(crbug.com/328018028): PopulateHandshakeMessage() should
       // get a span, not a pointer and length.
-      UNSAFE_BUFFERS(base::span(data_ptr, size)));
+      UNSAFE_TODO(base::span(data_ptr, size)));
   auto packet_as_bytes =
       base::byte_span_from_ref(packet).subspan(sizeof(packet.size));
   FillBuffer(data, packet_as_bytes);

diff --git a/chromecast/media/audio/mixer_service/receiver/cma_backend_shim.cc b/chromecast/media/audio/mixer_service/receiver/cma_backend_shim.cc
@@ -154,7 +154,7 @@ void CmaBackendShim::AddData(char* data, int size) {
   } else {
     // TODO(crbug.com/40284755): These functions should use span and size_t.
     buffer = ::media::DecoderBuffer::CopyFrom(base::as_bytes(
-        UNSAFE_BUFFERS(base::span(data, base::checked_cast<size_t>(size)))));
+        UNSAFE_TODO(base::span(data, base::checked_cast<size_t>(size)))));
     buffer->set_timestamp(::media::kNoTimestamp);
   }
   POST_MEDIA_TASK(&CmaBackendShim::AddDataOnMediaThread, std::move(buffer));

diff --git a/chromecast/media/audio/net/audio_socket.cc b/chromecast/media/audio/net/audio_socket.cc
@@ -48,7 +48,7 @@ bool GetMetaDataPaddingBytes(const char* data,
               // TODO(crbug.com/402847551): This span construction is unsound as
               // we can't know that the size is right, the function should be
               // receiving a span.
-              UNSAFE_BUFFERS(base::span(data, size)))
+              UNSAFE_TODO(base::span(data, size)))
               .first<sizeof(padding_bytes)>()));
   size -= sizeof(padding_bytes);
 

diff --git a/chromecast/media/cma/test/frame_segmenter_for_test.cc b/chromecast/media/cma/test/frame_segmenter_for_test.cc
@@ -92,7 +92,7 @@ AudioFrameHeader FindNextMp3Header(const uint8_t* data, size_t data_size) {
 
 BufferList Mp3SegmenterForTest(const uint8_t* data_ptr, size_t data_size) {
   // TODO(crbug.com/40284755): These functions should be based on span.
-  auto data = UNSAFE_BUFFERS(base::span(data_ptr, data_size));
+  auto data = UNSAFE_TODO(base::span(data_ptr, data_size));
   BufferList audio_frames;
   base::TimeDelta timestamp;
 
@@ -135,7 +135,7 @@ H264AccessUnit::H264AccessUnit()
 
 BufferList H264SegmenterForTest(const uint8_t* data_ptr, size_t data_size) {
   // TODO(crbug.com/40284755): These functions should be based on span.
-  auto data = UNSAFE_BUFFERS(base::span(data_ptr, data_size));
+  auto data = UNSAFE_TODO(base::span(data_ptr, data_size));
   BufferList video_frames;
   std::list<H264AccessUnit> access_unit_list;
   H264AccessUnit access_unit;

diff --git a/chromecast/net/small_message_socket.cc b/chromecast/net/small_message_socket.cc
@@ -350,7 +350,7 @@ bool SmallMessageSocket::ReadSize(char* ptr,
   // incorrect for some callers. ReadSize() should receive a span instead of the
   // unbounded pointer `ptr`. We use up to bytes from the pointer below, so we
   // unsoundly claim that the span has 6 bytes here.
-  auto span = UNSAFE_BUFFERS(base::as_bytes(base::span(ptr, 6u)));
+  auto span = UNSAFE_TODO(base::as_bytes(base::span(ptr, 6u)));
 
   uint16_t first_size = base::numerics::U16FromBigEndian(span.first<2u>());
   span = span.subspan(sizeof(uint16_t));

diff --git a/chromecast/net/small_message_socket_unittest.cc b/chromecast/net/small_message_socket_unittest.cc
@@ -100,7 +100,7 @@ class TestSocket : public SmallMessageSocket::Delegate {
     message_history_.push_back(size);
     CheckData(
         // TODO(crbug.com/40284755): OnMessage() should receive a span.
-        UNSAFE_BUFFERS(base::span(data, size)));
+        UNSAFE_TODO(base::span(data, size)));
     if (swap_pool_use_) {
       UseBufferPool();
     }
@@ -194,7 +194,7 @@ TEST_F(SmallMessageSocketTest, PrepareSendAndReceive) {
       static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize)));
   socket_2_->ReceiveMessages();
   socket_1_->Send();
   task_environment_.RunUntilIdle();
@@ -206,22 +206,22 @@ TEST_F(SmallMessageSocketTest, MultipleMessages) {
 
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kLargeMessageSize)));
+      UNSAFE_TODO(base::span(buffer, kLargeMessageSize)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer =
       static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize * 2 + 1));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize * 2 + 1)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize * 2 + 1)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer = static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize - 5));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize - 5)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize - 5)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
@@ -251,7 +251,7 @@ TEST_F(SmallMessageSocketTest, SendLargerThanPoolBufferSize) {
   char* buffer = static_cast<char*>(socket_1_->PrepareSend(kLargeMessageSize));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kLargeMessageSize)));
+      UNSAFE_TODO(base::span(buffer, kLargeMessageSize)));
   socket_2_->ReceiveMessages();
   socket_1_->Send();
   task_environment_.RunUntilIdle();
@@ -265,28 +265,28 @@ TEST_F(SmallMessageSocketTest, BufferMultipleMessages) {
       static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize - 1));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize - 1)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize - 1)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer = static_cast<char*>(socket_1_->PrepareSend(kLargeMessageSize));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kLargeMessageSize)));
+      UNSAFE_TODO(base::span(buffer, kLargeMessageSize)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer = static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize - 5));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize - 5)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize - 5)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer = static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
@@ -306,21 +306,21 @@ TEST_F(SmallMessageSocketTest, SwapPoolUse) {
       static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize * 2 + 1));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize * 2 + 1)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize * 2 + 1)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer = static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize - 5));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize - 5)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize - 5)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 
   buffer = static_cast<char*>(socket_1_->PrepareSend(kDefaultMessageSize));
   SetData(
       // TODO(crbug.com/40284755): PrepareSend() should return a span.
-      UNSAFE_BUFFERS(base::span(buffer, kDefaultMessageSize)));
+      UNSAFE_TODO(base::span(buffer, kDefaultMessageSize)));
   socket_1_->Send();
   task_environment_.RunUntilIdle();
 

diff --git a/components/autofill/core/browser/geo/address_rewriter.cc b/components/autofill/core/browser/geo/address_rewriter.cc
@@ -38,11 +38,10 @@ static bool ExtractRegionRulesData(const std::string& region,
   for (size_t i = 0; i < kAutofillAddressRewriterResourcesSize; ++i) {
     // TODO: crbug.com/347651465: GRIT should define std::arrays instead of
     // c-style arrays.
-    UNSAFE_BUFFERS(
-        if (kAutofillAddressRewriterResources[i].path == resource_key) {
-          resource_id = kAutofillAddressRewriterResources[i].id;
-          break;
-        })
+    UNSAFE_TODO(if (kAutofillAddressRewriterResources[i].path == resource_key) {
+      resource_id = kAutofillAddressRewriterResources[i].id;
+      break;
+    })
   }
 
   if (!resource_id) {

diff --git a/components/policy/core/common/registry_dict.cc b/components/policy/core/common/registry_dict.cc
@@ -276,7 +276,7 @@ void RegistryDict::ReadRegistry(HKEY hive, const std::wstring& root) {
               // ValueSize() here is the number of non-NUL *bytes* in the
               // Value() string, so we cast the Value() to bytes which is what
               // we want in the end anyway.
-              UNSAFE_BUFFERS(
+              UNSAFE_TODO(
                   base::span(reinterpret_cast<const uint8_t*>(it.Value()),
                              it.ValueSize()))
                   .first<sizeof(DWORD)>();

diff --git a/content/browser/renderer_host/pepper/pepper_gamepad_host_unittest.cc b/content/browser/renderer_host/pepper/pepper_gamepad_host_unittest.cc
@@ -112,10 +112,10 @@ TEST_F(PepperGamepadHostTest, WaitForReply) {
     // temporary first.
     // TODO(crbug.com/342213636): Rewrite to remove the need for UNSAFE_BUFFERS
     // annotation.
-    UNSAFE_BUFFERS(EXPECT_EQ(double{button_down_data.items[0].buttons[i].value},
-                             double{buffer->data.items[0].buttons[i].value});
-                   EXPECT_EQ(button_down_data.items[0].buttons[i].pressed,
-                             buffer->data.items[0].buttons[i].pressed););
+    UNSAFE_TODO(EXPECT_EQ(double{button_down_data.items[0].buttons[i].value},
+                          double{buffer->data.items[0].buttons[i].value});
+                EXPECT_EQ(button_down_data.items[0].buttons[i].pressed,
+                          buffer->data.items[0].buttons[i].pressed););
   }
 
   // Duplicate requests should be denied.

diff --git a/content/browser/renderer_host/pepper/pepper_vpn_provider_message_filter_chromeos.cc b/content/browser/renderer_host/pepper/pepper_vpn_provider_message_filter_chromeos.cc
@@ -183,7 +183,7 @@ int32_t PepperVpnProviderMessageFilter::OnSendPacket(
       // TODO(crbug.com/342213636): `VpnProviderSharedBuffer` needs to return a
       // span over its buffer for us to use the first `packet_size` bytes from
       // it safely.
-      UNSAFE_BUFFERS(base::span(packet_pointer, packet_size)));
+      UNSAFE_TODO(base::span(packet_pointer, packet_size)));
 
   return DoSendPacket(
       packet,

diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
@@ -724,7 +724,7 @@ TEST_F(RenderViewImplTest, OnNavigationHttpPost) {
     flat_data.subspan(segment_offset)
         .copy_prefix_from(
             // TODO(crbug.com/40284755): ForEachSegment should be given a span.
-            UNSAFE_BUFFERS(base::span(segment, segment_size)));
+            UNSAFE_TODO(base::span(segment, segment_size)));
     return true;
   });
   EXPECT_EQ(base::span_with_nul_from_cstring(raw_data), flat_data.as_span());

diff --git a/media/base/bit_reader_core.cc b/media/base/bit_reader_core.cc
@@ -156,7 +156,7 @@ bool BitReaderCore::Refill(int min_nbits) {
       byte_stream_provider_->GetBytes(max_nbytes, &byte_stream_window_ptr));
   auto byte_stream_window =
       // TODO(crbug.com/40284755): GetBytes() should return a span.
-      UNSAFE_BUFFERS(base::span(byte_stream_window_ptr, window_size));
+      UNSAFE_TODO(base::span(byte_stream_window_ptr, window_size));
   if (byte_stream_window.empty()) {
     return false;
   }

diff --git a/media/base/decoder_buffer.h b/media/base/decoder_buffer.h
@@ -186,7 +186,7 @@ class MEDIA_EXPORT DecoderBuffer
   base::span<uint8_t> writable_span() const {
     // TODO(crbug.com/40284755): `data_` should be converted to HeapArray, then
     // it can give out a span safely.
-    return UNSAFE_BUFFERS(base::span(writable_data(), size()));
+    return UNSAFE_TODO(base::span(writable_data(), size()));
   }
 
   inline bool empty() const { return size() == 0u; }

diff --git a/media/base/stream_parser_buffer.cc b/media/base/stream_parser_buffer.cc
@@ -29,8 +29,8 @@ scoped_refptr<StreamParserBuffer> StreamParserBuffer::CopyFrom(
     TrackId track_id) {
   if (auto* media_client = GetMediaClient()) {
     if (auto* alloc = media_client->GetMediaAllocator()) {
-      auto data_span = UNSAFE_BUFFERS(
-          base::span(data, base::checked_cast<size_t>(data_size)));
+      auto data_span =
+          UNSAFE_TODO(base::span(data, base::checked_cast<size_t>(data_size)));
       return StreamParserBuffer::FromExternalMemory(
           alloc->CopyFrom(data_span), is_key_frame, type, track_id);
     }
@@ -98,8 +98,7 @@ StreamParserBuffer::StreamParserBuffer(const uint8_t* data,
     : DecoderBuffer(
           // TODO(crbug.com/40284755): Convert `StreamBufferParser` to
           // `size_t` and `base::span`.
-          UNSAFE_BUFFERS(
-              base::span(data, base::checked_cast<size_t>(data_size)))),
+          UNSAFE_TODO(base::span(data, base::checked_cast<size_t>(data_size)))),
       decode_timestamp_(kNoDecodeTimestamp),
       config_id_(kInvalidConfigId),
       type_(type),

diff --git a/media/cast/test/utility/video_utility.cc b/media/cast/test/utility/video_utility.cc
@@ -138,16 +138,15 @@ void PopulateVideoFrameWithNoise(VideoFrame* frame) {
       // coded_size().
       // TODO(crbug.com/338570700): Make VideoFrame return a span instead of an
       // unbounded pointer.
-      UNSAFE_BUFFERS(
-          base::span(frame->writable_data(VideoFrame::Plane::kY),
-                     height * base::checked_cast<size_t>(
-                                  frame->stride(VideoFrame::Plane::kY))));
+      UNSAFE_TODO(base::span(frame->writable_data(VideoFrame::Plane::kY),
+                             height * base::checked_cast<size_t>(frame->stride(
+                                          VideoFrame::Plane::kY))));
   base::span<uint8_t> u_plane =
       // SAFETY: The U plane has a width specified by stride() and a height that
       // is half of coded_size(), rounding up.
       // TODO(crbug.com/338570700): Make VideoFrame return a span instead of an
       // unbounded pointer.
-      UNSAFE_BUFFERS(
+      UNSAFE_TODO(
           base::span(frame->writable_data(VideoFrame::Plane::kU),
                      half_height * base::checked_cast<size_t>(
                                        frame->stride(VideoFrame::Plane::kU))));
@@ -156,7 +155,7 @@ void PopulateVideoFrameWithNoise(VideoFrame* frame) {
       // is half of coded_size(), rounding up.
       // TODO(crbug.com/338570700): Make VideoFrame return a span instead of an
       // unbounded pointer.
-      UNSAFE_BUFFERS(
+      UNSAFE_TODO(
           base::span(frame->writable_data(VideoFrame::Plane::kV),
                      half_height * base::checked_cast<size_t>(
                                        frame->stride(VideoFrame::Plane::kV))));

diff --git a/media/filters/source_buffer_stream_unittest.cc b/media/filters/source_buffer_stream_unittest.cc
@@ -267,15 +267,15 @@ class SourceBufferStreamTest : public testing::Test {
                             int ending_position,
                             const uint8_t* data) {
     CheckExpectedBuffers(starting_position, ending_position, false,
-                         UNSAFE_BUFFERS(base::span(data, kDataSize)));
+                         UNSAFE_TODO(base::span(data, kDataSize)));
   }
 
   void CheckExpectedBuffers(int starting_position,
                             int ending_position,
                             const uint8_t* data,
                             bool expect_keyframe) {
     CheckExpectedBuffers(starting_position, ending_position, expect_keyframe,
-                         UNSAFE_BUFFERS(base::span(data, kDataSize)));
+                         UNSAFE_TODO(base::span(data, kDataSize)));
   }
 
   void CheckExpectedBuffers(

diff --git a/media/filters/win/media_foundation_audio_decoder.cc b/media/filters/win/media_foundation_audio_decoder.cc
@@ -562,8 +562,8 @@ MediaFoundationAudioDecoder::PumpOutput(PumpState pump_state) {
     auto channel_data = base::SpanWriter<uint8_t>(
         // TODO(crbug.com/40284755): channel_data() should be an array of spans,
         // not unbounded pointers. This span is constructed unsoundly.
-        UNSAFE_BUFFERS(base::span(audio_buffer->channel_data()[0u],
-                                  frames * channel_count_ * 4u)));
+        UNSAFE_TODO(base::span(audio_buffer->channel_data()[0u],
+                               frames * channel_count_ * 4u)));
     for (uint64_t i = 0; i < frames; i++) {
       for (uint64_t ch = 0; ch < channel_count_; ch++) {
         auto a = static_cast<int8_t>(destination[0u]);

diff --git a/media/formats/mp4/box_reader.cc b/media/formats/mp4/box_reader.cc
@@ -27,7 +27,7 @@ BufferReader::BufferReader(const uint8_t* buf, const size_t buf_size)
     :  // TODO(crbug.com/40284755): BufferReader should be receiving a span,
        // the construction of the span here is unsound as there's no way to
        // tell the size is correct from here.
-      UNSAFE_BUFFERS(buf_(buf, buf_size)) {}
+      UNSAFE_TODO(buf_(buf, buf_size)) {}
 
 BufferReader::~BufferReader() = default;
 

diff --git a/media/formats/mp4/h264_annex_b_to_avc_bitstream_converter.cc b/media/formats/mp4/h264_annex_b_to_avc_bitstream_converter.cc
@@ -170,8 +170,8 @@ MP4Status H264AnnexBToAvcBitstreamConverter::ConvertChunk(
             //
             // TODO(crbug.com/40284755): The `unit` should hold a span instead
             // of a pointer.
-            UNSAFE_BUFFERS(base::span(unit.data.get(),
-                                      base::checked_cast<size_t>(unit.size))));
+            UNSAFE_TODO(base::span(unit.data.get(),
+                                   base::checked_cast<size_t>(unit.size))));
     if (!written_ok) {
       return MP4Status::Codes::kBufferTooSmall;
     }

diff --git a/media/formats/mp4/h265_annex_b_to_hevc_bitstream_converter.cc b/media/formats/mp4/h265_annex_b_to_hevc_bitstream_converter.cc
@@ -207,8 +207,8 @@ MP4Status H265AnnexBToHevcBitstreamConverter::ConvertChunk(
             //
             // TODO(crbug.com/40284755): The `unit` should hold a span instead
             // of a pointer.
-            UNSAFE_BUFFERS(base::span(unit.data.get(),
-                                      base::checked_cast<size_t>(unit.size))));
+            UNSAFE_TODO(base::span(unit.data.get(),
+                                   base::checked_cast<size_t>(unit.size))));
     if (!written_ok) {
       return MP4Status::Codes::kBufferTooSmall;
     }