C++ std::span & Modern Bounds Safety: Non-Owning Views, Subspans, and Buffer Hardening

// C-style: array → pointer (size LOST):
void process(int* data, size_t len) {
    for (size_t i = 0; i < len; i++) {
        data[i] *= 2; // What if caller passed wrong len? → buffer overflow!
    }
}

int arr[10] = {};
process(arr, 100);  // Caller says 100, array has 10 → UNDEFINED BEHAVIOR
                     // No compile error. No runtime check. Exploitable.

// Comparison to other languages:
// Python: IndexError raised at runtime
// Rust: index out of bounds panics (debug), LLVM checks (release)
// C++: undefined behavior — ANYTHING can happen

// The 2024 NSA advisory specifically cited C++ array passing as a top
// vulnerability source in systems code. std::span is the C++ answer.

#include <span>
#include <vector>
#include <array>
#include <print>

// `std::span<T>` — non-owning view of contiguous T elements
// Layout: two pointers (pointer + size) = 16 bytes on 64-bit
// Always pass by VALUE (not by reference — it's already non-owning)

// The universal function:
void process(std::span<int> data) {
    std::println("Processing {} elements", data.size());
    for (int& x : data) x *= 2;
    // data.size() is always correct — no caller error possible
}

// Works with ALL contiguous containers — same function signature:
std::vector<int>    v = {1, 2, 3, 4, 5};
std::array<int, 5>  a = {1, 2, 3, 4, 5};
int                 raw[5] = {1, 2, 3, 4, 5};

process(v);    // vector → span (automatic)
process(a);    // array → span (automatic)
process(raw);  // raw array → span (automatic and SAFE)

// const span = read-only view:
void read_only(std::span<const int> data) {
    // data[0] = 5; // COMPILE ERROR: can't modify through const span
    for (int x : data) std::print("{} ", x);
}
read_only(v);  // Works — implicitly converts span<int> to span<const int>

// Span properties:
std::span<int> s(v);
std::println("Size: {}", s.size());         // 5
std::println("Bytes: {}", s.size_bytes()); // 20 (5 * sizeof(int))
std::println("Empty: {}", s.empty());      // false
std::println("Front: {}", s.front());      // 1
std::println("Back: {}", s.back());        // 5
int* raw_ptr = s.data();                   // Underlying pointer (for C APIs)

// Dynamic extent (runtime size — default):
std::span<int>         dynamic_span(v); // Size known at runtime

// Static extent (compile-time size — N must be known):
std::span<int, 5>      static_span(v);  // Compiler knows it's 5 elements
// std::span<int, 3>   wrong_span(v);   // COMPILE ERROR: v has 5 elements

// Static extent benefits:
// - No size field stored (just one pointer — 8 bytes vs 16 bytes)
// - Compiler can optimize bounds checks, loop unrolling, vectorization
// - Size checked at compile time → catch mismatches early

// std::array naturally produces static span:
std::array<float, 8> simd_data{};
std::span<float, 8> simd_view(simd_data); // Compiler knows it's exactly 8

// Dynamic extent from runtime calculation:
void process_first_n(std::vector<int>& v, size_t n) {
    auto view = std::span<int>(v).first(n); // span of first n elements
    for (int& x : view) x++;
}

// PREFER: span for read-write contiguous access
void normalize(std::span<float> data) {
    float max = *std::ranges::max_element(data);
    for (float& x : data) x /= max;
}

// PREFER: span<const T> for read-only access
float sum(std::span<const float> data) {
    return std::reduce(data.begin(), data.end());
}

// AVOID: const std::vector<float>& (forces vector, excludes array/raw)
// AVOID: std::vector<float>& (forces vector, excludes C arrays)
// AVOID: float*, size_t (unsafe, error-prone)
// USE:   std::span or std::span<const T>

// Comparison:
void old_api(const float* data, size_t n);  // 2 params, easy to mismatch
void new_api(std::span<const float> data);  // 1 param, self-contained, safe

// Works with anything contiguous:
float stack_arr[1000];
std::vector<float> heap_vec(1000);
std::array<float, 1000> std_arr;

new_api(stack_arr);  // All three work
new_api(heap_vec);
new_api(std_arr);

std::vector<uint8_t> packet(512);
std::span<uint8_t> buffer(packet);

// first(N): first N elements
auto ethernet_header = buffer.first(14);   // bytes 0-13

// last(N): last N elements
auto payload = buffer.last(buffer.size() - 14); // bytes 14-511

// subspan(offset, count): slice from offset
auto ip_header  = buffer.subspan(14, 20);   // bytes 14-33
auto tcp_header = buffer.subspan(34, 20);   // bytes 34-53
auto data_field = buffer.subspan(54);       // bytes 54 to end (no count = all remaining)

// Static subspan (compile-time slice):
auto first5 = buffer.first<5>();   // span<uint8_t, 5> — static extent!
auto last10 = buffer.last<10>();   // span<uint8_t, 10>

#include <mdspan>  // C++23

// 2D matrix view over flat array:
std::vector<float> flat_data(4 * 4);  // 4x4 matrix flattened

std::mdspan<float, std::extents<size_t, 4, 4>> matrix(flat_data.data());

// Access via row, column:
matrix[0, 0] = 1.0f;  // C++23 multi-index syntax
matrix[1, 2] = 3.14f;

// Dynamic shape (runtime dimensions):
int rows = 4, cols = 8;
std::mdspan<float, std::dextents<size_t, 2>> dynamic_matrix(
    flat_data.data(), rows, cols);

// Works with SIMD, BLAS, GPU kernels without data movement
// Essential for scientific computing, image processing

#include <span>
#include <cstdint>
#include <cstring>

#pragma pack(push, 1)
struct EthHeader { uint8_t dst[6]; uint8_t src[6]; uint16_t type; };
struct IPv4Header { uint8_t version_ihl; uint8_t tos; uint16_t length;
                    uint16_t id; uint16_t flags_frag; uint8_t ttl;
                    uint8_t proto; uint16_t checksum; uint32_t src; uint32_t dst; };
#pragma pack(pop)

struct ParsedPacket {
    const EthHeader*  eth;
    const IPv4Header* ip;
    std::span<const uint8_t> payload;
};

std::optional<ParsedPacket> parse_ethernet(std::span<const uint8_t> raw) {
    if (raw.size() < sizeof(EthHeader)) return std::nullopt;
    
    const auto* eth = reinterpret_cast<const EthHeader*>(raw.data());
    auto after_eth  = raw.subspan(sizeof(EthHeader)); // Zero-copy slice!
    
    if (after_eth.size() < sizeof(IPv4Header)) return std::nullopt;
    
    const auto* ip   = reinterpret_cast<const IPv4Header*>(after_eth.data());
    size_t ip_len    = (ip->version_ihl & 0x0F) * 4;
    auto payload     = after_eth.subspan(ip_len); // TCP/UDP payload
    
    return ParsedPacket{eth, ip, payload};
}

// Caller:
std::vector<uint8_t> recv_buffer(/* from network */);
if (auto pkt = parse_ethernet(recv_buffer)) {
    process_payload(pkt->payload); // No copies! All views into recv_buffer
}