Merge pull request #134 from webmaster128/bounds-check2

Bounds check round 2

28 files changed, 82 insertions, 83 deletions

diff --git a/src/lib/rng/hmac_drbg/hmac_drbg.cpp b/src/lib/rng/hmac_drbg/hmac_drbg.cpp
index dc0d18afe..af0565120 100644
--- a/src/lib/rng/hmac_drbg/hmac_drbg.cpp
+++ b/src/lib/rng/hmac_drbg/hmac_drbg.cpp
@@ -32,7 +32,7 @@ void HMAC_DRBG::randomize(byte out[], size_t length)
       {
       const size_t to_copy = std::min(length, m_V.size());
       m_V = m_mac->process(m_V);
-      copy_mem(&out[0], &m_V[0], to_copy);
+      copy_mem(out, m_V.data(), to_copy);
 
       length -= to_copy;
       out += to_copy;
@@ -75,7 +75,7 @@ void HMAC_DRBG::reseed(size_t poll_bits)
       if(m_prng->is_seeded())
          {
          secure_vector<byte> input = m_prng->random_vec(m_mac->output_length());
-         update(&input[0], input.size());
+         update(input.data(), input.size());
          m_reseed_counter = 1;
          }
       }
diff --git a/src/lib/rng/hmac_rng/hmac_rng.cpp b/src/lib/rng/hmac_rng/hmac_rng.cpp
index 873a83ae9..36003385a 100644
--- a/src/lib/rng/hmac_rng/hmac_rng.cpp
+++ b/src/lib/rng/hmac_rng/hmac_rng.cpp
@@ -55,7 +55,7 @@ void HMAC_RNG::clear()
    sets m_seeded to true.
    */
    std::vector<byte> prf_zero_key(m_extractor->output_length());
-   m_prf->set_key(&prf_zero_key[0], prf_zero_key.size());
+   m_prf->set_key(prf_zero_key.data(), prf_zero_key.size());
 
    /*
    Use PRF("Botan HMAC_RNG XTS") as the intitial XTS key.
@@ -77,7 +77,7 @@ void HMAC_RNG::new_K_value(byte label)
    m_prf->update_be(clock::now().time_since_epoch().count());
    m_prf->update_be(m_counter++);
    m_prf->update(label);
-   m_prf->final(&m_K[0]);
+   m_prf->final(m_K.data());
    }
 
 /*
@@ -108,7 +108,7 @@ void HMAC_RNG::randomize(byte out[], size_t length)
 
       const size_t copied = std::min<size_t>(length, max_per_prf_iter);
 
-      copy_mem(out, &m_K[0], copied);
+      copy_mem(out, m_K.data(), copied);
       out += copied;
       length -= copied;
       }
diff --git a/src/lib/rng/rng.h b/src/lib/rng/rng.h
index 836eb1006..2abd11532 100644
--- a/src/lib/rng/rng.h
+++ b/src/lib/rng/rng.h
@@ -42,7 +42,7 @@ class BOTAN_DLL RandomNumberGenerator
       virtual secure_vector<byte> random_vec(size_t bytes)
          {
          secure_vector<byte> output(bytes);
-         randomize(&output[0], output.size());
+         randomize(output.data(), output.size());
          return output;
          }
 
diff --git a/src/lib/rng/x931_rng/x931_rng.cpp b/src/lib/rng/x931_rng/x931_rng.cpp
index 3793f546e..976e324c3 100644
--- a/src/lib/rng/x931_rng/x931_rng.cpp
+++ b/src/lib/rng/x931_rng/x931_rng.cpp
@@ -45,10 +45,10 @@ void ANSI_X931_RNG::update_buffer()
    secure_vector<byte> DT = m_prng->random_vec(BLOCK_SIZE);
    m_cipher->encrypt(DT);
 
-   xor_buf(&m_R[0], &m_V[0], &DT[0], BLOCK_SIZE);
+   xor_buf(m_R.data(), m_V.data(), DT.data(), BLOCK_SIZE);
    m_cipher->encrypt(m_R);
 
-   xor_buf(&m_V[0], &m_R[0], &DT[0], BLOCK_SIZE);
+   xor_buf(m_V.data(), m_R.data(), DT.data(), BLOCK_SIZE);
    m_cipher->encrypt(m_V);
 
    m_R_pos = 0;
@@ -67,7 +67,7 @@ void ANSI_X931_RNG::rekey()
 
       if(m_V.size() != BLOCK_SIZE)
          m_V.resize(BLOCK_SIZE);
-      m_prng->randomize(&m_V[0], m_V.size());
+      m_prng->randomize(m_V.data(), m_V.size());
 
       update_buffer();
       }
diff --git a/src/lib/stream/chacha/chacha.cpp b/src/lib/stream/chacha/chacha.cpp
index d0c534083..9841f99a2 100644
--- a/src/lib/stream/chacha/chacha.cpp
+++ b/src/lib/stream/chacha/chacha.cpp
@@ -71,7 +71,7 @@ void ChaCha::cipher(const byte in[], byte out[], size_t length)
       length -= (m_buffer.size() - m_position);
       in += (m_buffer.size() - m_position);
       out += (m_buffer.size() - m_position);
-      chacha(&m_buffer[0], &m_state[0]);
+      chacha(m_buffer.data(), m_state.data());
 
       ++m_state[12];
       m_state[13] += (m_state[12] == 0);
@@ -144,7 +144,7 @@ void ChaCha::set_iv(const byte iv[], size_t length)
       m_state[15] = load_le<u32bit>(iv, 2);
       }
 
-   chacha(&m_buffer[0], &m_state[0]);
+   chacha(m_buffer.data(), m_state.data());
    ++m_state[12];
    m_state[13] += (m_state[12] == 0);
 
diff --git a/src/lib/stream/ctr/ctr.cpp b/src/lib/stream/ctr/ctr.cpp
index 3b2e75f72..f1cdc7c42 100644
--- a/src/lib/stream/ctr/ctr.cpp
+++ b/src/lib/stream/ctr/ctr.cpp
@@ -87,7 +87,7 @@ void CTR_BE::set_iv(const byte iv[], size_t iv_len)
             break;
       }
 
-   m_cipher->encrypt_n(&m_counter[0], &m_pad[0], n_wide);
+   m_cipher->encrypt_n(m_counter.data(), m_pad.data(), n_wide);
    m_pad_pos = 0;
    }
 
@@ -111,7 +111,7 @@ void CTR_BE::increment_counter()
          }
       }
 
-   m_cipher->encrypt_n(&m_counter[0], &m_pad[0], n_wide);
+   m_cipher->encrypt_n(m_counter.data(), m_pad.data(), n_wide);
    m_pad_pos = 0;
    }
 
diff --git a/src/lib/stream/salsa20/salsa20.cpp b/src/lib/stream/salsa20/salsa20.cpp
index 7ab7b4f76..daf01dd0a 100644
--- a/src/lib/stream/salsa20/salsa20.cpp
+++ b/src/lib/stream/salsa20/salsa20.cpp
@@ -111,7 +111,7 @@ void Salsa20::cipher(const byte in[], byte out[], size_t length)
       length -= (m_buffer.size() - m_position);
       in += (m_buffer.size() - m_position);
       out += (m_buffer.size() - m_position);
-      salsa20(&m_buffer[0], &m_state[0]);
+      salsa20(m_buffer.data(), m_state.data());
 
       ++m_state[8];
       m_state[9] += (m_state[8] == 0);
@@ -187,7 +187,7 @@ void Salsa20::set_iv(const byte iv[], size_t length)
       m_state[9] = load_le<u32bit>(iv, 3);
 
       secure_vector<u32bit> hsalsa(8);
-      hsalsa20(&hsalsa[0], &m_state[0]);
+      hsalsa20(hsalsa.data(), m_state.data());
 
       m_state[ 1] = hsalsa[0];
       m_state[ 2] = hsalsa[1];
@@ -204,7 +204,7 @@ void Salsa20::set_iv(const byte iv[], size_t length)
    m_state[8] = 0;
    m_state[9] = 0;
 
-   salsa20(&m_buffer[0], &m_state[0]);
+   salsa20(m_buffer.data(), m_state.data());
    ++m_state[8];
    m_state[9] += (m_state[8] == 0);
 
diff --git a/src/lib/stream/stream_cipher.h b/src/lib/stream/stream_cipher.h
index 9768aea70..bfdd152a7 100644
--- a/src/lib/stream/stream_cipher.h
+++ b/src/lib/stream/stream_cipher.h
@@ -38,15 +38,15 @@ class BOTAN_DLL StreamCipher : public SymmetricAlgorithm
 
       template<typename Alloc>
          void encipher(std::vector<byte, Alloc>& inout)
-         { cipher(&inout[0], &inout[0], inout.size()); }
+         { cipher(inout.data(), inout.data(), inout.size()); }
 
       template<typename Alloc>
          void encrypt(std::vector<byte, Alloc>& inout)
-         { cipher(&inout[0], &inout[0], inout.size()); }
+         { cipher(inout.data(), inout.data(), inout.size()); }
 
       template<typename Alloc>
          void decrypt(std::vector<byte, Alloc>& inout)
-         { cipher(&inout[0], &inout[0], inout.size()); }
+         { cipher(inout.data(), inout.data(), inout.size()); }
 
       /**
       * Resync the cipher using the IV
diff --git a/src/lib/tls/msg_cert_req.cpp b/src/lib/tls/msg_cert_req.cpp
index eacdcacac..aaaf754c8 100644
--- a/src/lib/tls/msg_cert_req.cpp
+++ b/src/lib/tls/msg_cert_req.cpp
@@ -119,7 +119,7 @@ Certificate_Req::Certificate_Req(const std::vector<byte>& buf,
       {
       std::vector<byte> name_bits = reader.get_range_vector<byte>(2, 0, 65535);
 
-      BER_Decoder decoder(&name_bits[0], name_bits.size());
+      BER_Decoder decoder(name_bits.data(), name_bits.size());
       X509_DN name;
       decoder.decode(name);
       m_names.push_back(name);
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp
index 8b75e93d6..82ba6f4f6 100644
--- a/src/lib/tls/msg_client_hello.cpp
+++ b/src/lib/tls/msg_client_hello.cpp
@@ -25,14 +25,14 @@ std::vector<byte> make_hello_random(RandomNumberGenerator& rng,
                                     const Policy& policy)
    {
    std::vector<byte> buf(32);
-   rng.randomize(&buf[0], buf.size());
+   rng.randomize(buf.data(), buf.size());
 
    if(policy.include_time_in_hello_random())
       {
       const u32bit time32 = static_cast<u32bit>(
          std::chrono::system_clock::to_time_t(std::chrono::system_clock::now()));
 
-      store_be(time32, &buf[0]);
+      store_be(time32, buf.data());
       }
 
    return buf;
diff --git a/src/lib/tls/msg_session_ticket.cpp b/src/lib/tls/msg_session_ticket.cpp
index 26dc250c3..3fe6e64cf 100644
--- a/src/lib/tls/msg_session_ticket.cpp
+++ b/src/lib/tls/msg_session_ticket.cpp
@@ -45,7 +45,7 @@ New_Session_Ticket::New_Session_Ticket(const std::vector<byte>& buf)
 std::vector<byte> New_Session_Ticket::serialize() const
    {
    std::vector<byte> buf(4);
-   store_be(m_ticket_lifetime_hint, &buf[0]);
+   store_be(m_ticket_lifetime_hint, buf.data());
    append_tls_length_value(buf, m_ticket, 2);
    return buf;
    }
diff --git a/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp b/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
index c67dc7997..508f8ff2f 100644
--- a/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
+++ b/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
@@ -102,7 +102,7 @@ Session_Manager_SQL::Session_Manager_SQL(std::shared_ptr<SQL_Database> db,
       const size_t iterations = 256 * 1024;
       size_t check_val = 0;
 
-      m_session_key = derive_key(passphrase, &salt[0], salt.size(),
+      m_session_key = derive_key(passphrase, salt.data(), salt.size(),
                                  iterations, check_val);
 
       auto stmt = m_db->new_statement("insert into tls_sessions_metadata values(?1, ?2, ?3)");
diff --git a/src/lib/tls/tls_blocking.cpp b/src/lib/tls/tls_blocking.cpp
index b46961f9d..f88b7896c 100644
--- a/src/lib/tls/tls_blocking.cpp
+++ b/src/lib/tls/tls_blocking.cpp
@@ -58,8 +58,8 @@ void Blocking_Client::do_handshake()
 
    while(!m_channel.is_closed() && !m_channel.is_active())
       {
-      const size_t from_socket = m_read(&readbuf[0], readbuf.size());
-      m_channel.received_data(&readbuf[0], from_socket);
+      const size_t from_socket = m_read(readbuf.data(), readbuf.size());
+      m_channel.received_data(readbuf.data(), from_socket);
       }
    }
 
@@ -69,8 +69,8 @@ size_t Blocking_Client::read(byte buf[], size_t buf_len)
 
    while(m_plaintext.empty() && !m_channel.is_closed())
       {
-      const size_t from_socket = m_read(&readbuf[0], readbuf.size());
-      m_channel.received_data(&readbuf[0], from_socket);
+      const size_t from_socket = m_read(readbuf.data(), readbuf.size());
+      m_channel.received_data(readbuf.data(), from_socket);
       }
 
    const size_t returned = std::min(buf_len, m_plaintext.size());
diff --git a/src/lib/tls/tls_channel.cpp b/src/lib/tls/tls_channel.cpp
index e784566cd..e2b1aad9d 100644
--- a/src/lib/tls/tls_channel.cpp
+++ b/src/lib/tls/tls_channel.cpp
@@ -285,7 +285,7 @@ bool Channel::heartbeat_sending_allowed() const
 
 size_t Channel::received_data(const std::vector<byte>& buf)
    {
-   return this->received_data(&buf[0], buf.size());
+   return this->received_data(buf.data(), buf.size());
    }
 
 size_t Channel::received_data(const byte input[], size_t input_size)
@@ -407,14 +407,14 @@ size_t Channel::received_data(const byte input[], size_t input_size)
                   {
                   const std::vector<byte> padding = unlock(rng().random_vec(16));
                   Heartbeat_Message response(Heartbeat_Message::RESPONSE,
-                                             &payload[0], payload.size(), padding);
+                                             payload.data(), payload.size(), padding);
 
                   send_record(HEARTBEAT, response.contents());
                   }
                }
             else
                {
-               m_alert_cb(Alert(Alert::HEARTBEAT_PAYLOAD), &payload[0], payload.size());
+               m_alert_cb(Alert(Alert::HEARTBEAT_PAYLOAD), payload.data(), payload.size());
                }
             }
          else if(record_type == APPLICATION_DATA)
@@ -428,7 +428,7 @@ size_t Channel::received_data(const byte input[], size_t input_size)
             * following record. Avoid spurious callbacks.
             */
             if(record.size() > 0)
-               m_data_cb(&record[0], record.size());
+               m_data_cb(record.data(), record.size());
             }
          else if(record_type == ALERT)
             {
@@ -513,7 +513,7 @@ void Channel::write_record(Connection_Cipher_State* cipher_state, u16bit epoch,
                      cipher_state,
                      m_rng);
 
-   m_output_fn(&m_writebuf[0], m_writebuf.size());
+   m_output_fn(m_writebuf.data(), m_writebuf.size());
    }
 
 void Channel::send_record_array(u16bit epoch, byte type, const byte input[], size_t length)
@@ -537,7 +537,7 @@ void Channel::send_record_array(u16bit epoch, byte type, const byte input[], siz
 
    if(type == APPLICATION_DATA && cipher_state->cbc_without_explicit_iv())
       {
-      write_record(cipher_state.get(), epoch, type, &input[0], 1);
+      write_record(cipher_state.get(), epoch, type, input, 1);
       input += 1;
       length -= 1;
       }
@@ -547,7 +547,7 @@ void Channel::send_record_array(u16bit epoch, byte type, const byte input[], siz
    while(length)
       {
       const size_t sending = std::min(length, max_fragment_size);
-      write_record(cipher_state.get(), epoch, type, &input[0], sending);
+      write_record(cipher_state.get(), epoch, type, input, sending);
 
       input += sending;
       length -= sending;
@@ -557,13 +557,13 @@ void Channel::send_record_array(u16bit epoch, byte type, const byte input[], siz
 void Channel::send_record(byte record_type, const std::vector<byte>& record)
    {
    send_record_array(sequence_numbers().current_write_epoch(),
-                     record_type, &record[0], record.size());
+                     record_type, record.data(), record.size());
    }
 
 void Channel::send_record_under_epoch(u16bit epoch, byte record_type,
                                       const std::vector<byte>& record)
    {
-   send_record_array(epoch, record_type, &record[0], record.size());
+   send_record_array(epoch, record_type, record.data(), record.size());
    }
 
 void Channel::send(const byte buf[], size_t buf_size)
diff --git a/src/lib/tls/tls_channel.h b/src/lib/tls/tls_channel.h
index 713d4c1b9..4e6874a16 100644
--- a/src/lib/tls/tls_channel.h
+++ b/src/lib/tls/tls_channel.h
@@ -84,7 +84,7 @@ class BOTAN_DLL Channel
       template<typename Alloc>
          void send(const std::vector<unsigned char, Alloc>& val)
          {
-         send(&val[0], val.size());
+         send(val.data(), val.size());
          }
 
       /**
diff --git a/src/lib/tls/tls_handshake_io.cpp b/src/lib/tls/tls_handshake_io.cpp
index ef766679f..d4633becd 100644
--- a/src/lib/tls/tls_handshake_io.cpp
+++ b/src/lib/tls/tls_handshake_io.cpp
@@ -95,7 +95,7 @@ Stream_Handshake_IO::format(const std::vector<byte>& msg,
 
    store_be24(&send_buf[1], buf_size);
 
-   copy_mem(&send_buf[4], &msg[0], msg.size());
+   copy_mem(&send_buf[4], msg.data(), msg.size());
 
    return send_buf;
    }
@@ -194,7 +194,7 @@ void Datagram_Handshake_IO::add_record(const std::vector<byte>& record,
 
    const size_t DTLS_HANDSHAKE_HEADER_LEN = 12;
 
-   const byte* record_bits = &record[0];
+   const byte* record_bits = record.data();
    size_t record_size = record.size();
 
    while(record_size)
@@ -350,7 +350,7 @@ Datagram_Handshake_IO::format_fragment(const byte fragment[],
    store_be24(&send_buf[6], frag_offset);
    store_be24(&send_buf[9], frag_len);
 
-   copy_mem(&send_buf[12], &fragment[0], frag_len);
+   copy_mem(&send_buf[12], fragment, frag_len);
 
    return send_buf;
    }
@@ -360,7 +360,7 @@ Datagram_Handshake_IO::format_w_seq(const std::vector<byte>& msg,
                                     Handshake_Type type,
                                     u16bit msg_sequence) const
    {
-   return format_fragment(&msg[0], msg.size(), 0, msg.size(), type, msg_sequence);
+   return format_fragment(msg.data(), msg.size(), 0, msg.size(), type, msg_sequence);
    }
 
 std::vector<byte>
diff --git a/src/lib/tls/tls_reader.h b/src/lib/tls/tls_reader.h
index f24543edb..c2aef3163 100644
--- a/src/lib/tls/tls_reader.h
+++ b/src/lib/tls/tls_reader.h
@@ -118,7 +118,7 @@ class TLS_Data_Reader
          std::vector<byte> v =
             get_range_vector<byte>(len_bytes, min_bytes, max_bytes);
 
-         return std::string(reinterpret_cast<char*>(&v[0]), v.size());
+         return std::string(reinterpret_cast<char*>(v.data()), v.size());
          }
 
       template<typename T>
@@ -209,7 +209,7 @@ void append_tls_length_value(std::vector<byte, Alloc>& buf,
                              const std::vector<T, Alloc2>& vals,
                              size_t tag_size)
    {
-   append_tls_length_value(buf, &vals[0], vals.size(), tag_size);
+   append_tls_length_value(buf, vals.data(), vals.size(), tag_size);
    }
 
 template<typename Alloc>
@@ -218,7 +218,7 @@ void append_tls_length_value(std::vector<byte, Alloc>& buf,
                              size_t tag_size)
    {
    append_tls_length_value(buf,
-                           reinterpret_cast<const byte*>(&str[0]),
+                           reinterpret_cast<const byte*>(str.data()),
                            str.size(),
                            tag_size);
    }
diff --git a/src/lib/tls/tls_record.cpp b/src/lib/tls/tls_record.cpp
index fb8079bdc..c384611e9 100644
--- a/src/lib/tls/tls_record.cpp
+++ b/src/lib/tls/tls_record.cpp
@@ -151,7 +151,7 @@ void write_record(secure_vector<byte>& output,
       output.push_back(get_byte<u16bit>(0, msg_length));
       output.push_back(get_byte<u16bit>(1, msg_length));
 
-      output.insert(output.end(), &msg[0], &msg[msg_length]);
+      output.insert(output.end(), msg, msg + msg_length);
 
       return;
       }
@@ -175,7 +175,7 @@ void write_record(secure_vector<byte>& output,
       BOTAN_ASSERT(aead->start(nonce).empty(), "AEAD doesn't return anything from start");
 
       const size_t offset = output.size();
-      output += std::make_pair(&msg[0], msg_length);
+      output += std::make_pair(msg, msg_length);
       aead->finish(output, offset);
 
       BOTAN_ASSERT(output.size() == offset + ctext_size, "Expected size");
@@ -211,7 +211,7 @@ void write_record(secure_vector<byte>& output,
       rng.randomize(&output[output.size() - iv_size], iv_size);
       }
 
-   output.insert(output.end(), &msg[0], &msg[msg_length]);
+   output.insert(output.end(), msg, msg + msg_length);
 
    output.resize(output.size() + mac_size);
    cs->mac()->final(&output[output.size() - mac_size]);
@@ -242,8 +242,8 @@ void write_record(secure_vector<byte>& output,
 
       const size_t blocks = buf_size / block_size;
 
-      xor_buf(&buf[0], &cbc_state[0], block_size);
-      bc->encrypt(&buf[0]);
+      xor_buf(buf, cbc_state.data(), block_size);
+      bc->encrypt(buf);
 
       for(size_t i = 1; i < blocks; ++i)
          {
@@ -271,7 +271,7 @@ size_t fill_buffer_to(secure_vector<byte>& readbuf,
 
    const size_t taken = std::min(input_size, desired - readbuf.size());
 
-   readbuf.insert(readbuf.end(), &input[0], &input[taken]);
+   readbuf.insert(readbuf.end(), input, input + taken);
    input_consumed += taken;
    input_size -= taken;
    input += taken;
@@ -332,10 +332,10 @@ void cbc_decrypt_record(byte record_contents[], size_t record_len,
    byte* buf = record_contents;
 
    secure_vector<byte> last_ciphertext(block_size);
-   copy_mem(&last_ciphertext[0], &buf[0], block_size);
+   copy_mem(last_ciphertext.data(), buf, block_size);
 
-   bc.decrypt(&buf[0]);
-   xor_buf(&buf[0], &cs.cbc_state()[0], block_size);
+   bc.decrypt(buf);
+   xor_buf(buf, &cs.cbc_state()[0], block_size);
 
    secure_vector<byte> last_ciphertext2;
 
@@ -343,7 +343,7 @@ void cbc_decrypt_record(byte record_contents[], size_t record_len,
       {
       last_ciphertext2.assign(&buf[block_size*i], &buf[block_size*(i+1)]);
       bc.decrypt(&buf[block_size*i]);
-      xor_buf(&buf[block_size*i], &last_ciphertext[0], block_size);
+      xor_buf(&buf[block_size*i], last_ciphertext.data(), block_size);
       std::swap(last_ciphertext, last_ciphertext2);
       }
 
@@ -372,7 +372,7 @@ void decrypt_record(secure_vector<byte>& output,
       output += aead->start(nonce);
 
       const size_t offset = output.size();
-      output += std::make_pair(&msg[0], msg_length);
+      output += std::make_pair(msg, msg_length);
       aead->finish(output, offset);
 
       BOTAN_ASSERT(output.size() == ptext_size + offset, "Produced expected size");
@@ -415,11 +415,11 @@ void decrypt_record(secure_vector<byte>& output,
       cs.mac()->update(plaintext_block, plaintext_length);
 
       std::vector<byte> mac_buf(mac_size);
-      cs.mac()->final(&mac_buf[0]);
+      cs.mac()->final(mac_buf.data());
 
       const size_t mac_offset = record_len - (mac_size + pad_size);
 
-      const bool mac_bad = !same_mem(&record_contents[mac_offset], &mac_buf[0], mac_size);
+      const bool mac_bad = !same_mem(&record_contents[mac_offset], mac_buf.data(), mac_size);
 
       if(mac_bad || padding_bad)
          throw TLS_Exception(Alert::BAD_RECORD_MAC, "Message authentication failure");
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index 28cb8b420..8cb1a2aa7 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -50,7 +50,7 @@ Session::Session(const std::string& pem)
    {
    secure_vector<byte> der = PEM_Code::decode_check_label(pem, "TLS SESSION");
 
-   *this = Session(&der[0], der.size());
+   *this = Session(der.data(), der.size());
    }
 
 Session::Session(const byte ber[], size_t ber_len)
@@ -105,7 +105,7 @@ Session::Session(const byte ber[], size_t ber_len)
 
    if(!peer_cert_bits.empty())
       {
-      DataSource_Memory certs(&peer_cert_bits[0], peer_cert_bits.size());
+      DataSource_Memory certs(peer_cert_bits.data(), peer_cert_bits.size());
 
       while(!certs.end_of_data())
          m_peer_certs.push_back(X509_Certificate(certs));
@@ -169,7 +169,7 @@ Session::encrypt(const SymmetricKey& key, RandomNumberGenerator& rng) const
 
    secure_vector<byte> buf = nonce;
    buf += bits;
-   aead->start(&buf[0], nonce_len);
+   aead->start(buf.data(), nonce_len);
    aead->finish(buf, nonce_len);
    return unlock(buf);
    }
@@ -194,7 +194,7 @@ Session Session::decrypt(const byte in[], size_t in_len, const SymmetricKey& key
       secure_vector<byte> buf(in + nonce_len, in + in_len);
       aead->finish(buf, 0);
 
-      return Session(&buf[0], buf.size());
+      return Session(buf.data(), buf.size());
       }
    catch(std::exception& e)
       {
diff --git a/src/lib/tls/tls_session.h b/src/lib/tls/tls_session.h
index d7dcc90cb..81c662507 100644
--- a/src/lib/tls/tls_session.h
+++ b/src/lib/tls/tls_session.h
@@ -99,7 +99,7 @@ class BOTAN_DLL Session
       static inline Session decrypt(const std::vector<byte>& ctext,
                                     const SymmetricKey& key)
          {
-         return Session::decrypt(&ctext[0], ctext.size(), key);
+         return Session::decrypt(ctext.data(), ctext.size(), key);
          }
 
       /**
diff --git a/src/lib/utils/datastor/datastor.cpp b/src/lib/utils/datastor/datastor.cpp
index 344c03f7c..69c1bf453 100644
--- a/src/lib/utils/datastor/datastor.cpp
+++ b/src/lib/utils/datastor/datastor.cpp
@@ -141,12 +141,12 @@ void Data_Store::add(const std::string& key, u32bit val)
 */
 void Data_Store::add(const std::string& key, const secure_vector<byte>& val)
    {
-   add(key, hex_encode(&val[0], val.size()));
+   add(key, hex_encode(val.data(), val.size()));
    }
 
 void Data_Store::add(const std::string& key, const std::vector<byte>& val)
    {
-   add(key, hex_encode(&val[0], val.size()));
+   add(key, hex_encode(val.data(), val.size()));
    }
 
 /*
diff --git a/src/lib/utils/http_util/http_util.cpp b/src/lib/utils/http_util/http_util.cpp
index 913d4fd19..1a15d6418 100644
--- a/src/lib/utils/http_util/http_util.cpp
+++ b/src/lib/utils/http_util/http_util.cpp
@@ -123,7 +123,7 @@ Response http_sync(http_exch_fn http_transact,
    if(content_type != "")
       outbuf << "Content-Type: " << content_type << "\r\n";
    outbuf << "Connection: close\r\n\r\n";
-   outbuf.write(reinterpret_cast<const char*>(&body[0]), body.size());
+   outbuf.write(reinterpret_cast<const char*>(body.data()), body.size());
 
    std::istringstream io(http_transact(hostname, outbuf.str()));
 
@@ -171,8 +171,8 @@ Response http_sync(http_exch_fn http_transact,
    std::vector<byte> buf(4096);
    while(io.good())
       {
-      io.read(reinterpret_cast<char*>(&buf[0]), buf.size());
-      resp_body.insert(resp_body.end(), &buf[0], &buf[io.gcount()]);
+      io.read(reinterpret_cast<char*>(buf.data()), buf.size());
+      resp_body.insert(resp_body.end(), buf.data(), &buf[io.gcount()]);
       }
 
    const std::string header_size = search_map(headers, std::string("Content-Length"));
diff --git a/src/lib/utils/loadstor.h b/src/lib/utils/loadstor.h
index 4db3d07fa..d3871480c 100644
--- a/src/lib/utils/loadstor.h
+++ b/src/lib/utils/loadstor.h
@@ -641,7 +641,7 @@ void copy_out_be(byte out[], size_t out_bytes, const T in[])
 template<typename T, typename Alloc>
 void copy_out_vec_be(byte out[], size_t out_bytes, const std::vector<T, Alloc>& in)
    {
-   copy_out_be(out, out_bytes, &in[0]);
+   copy_out_be(out, out_bytes, in.data());
    }
 
 template<typename T>
@@ -662,7 +662,7 @@ void copy_out_le(byte out[], size_t out_bytes, const T in[])
 template<typename T, typename Alloc>
 void copy_out_vec_le(byte out[], size_t out_bytes, const std::vector<T, Alloc>& in)
    {
-   copy_out_le(out, out_bytes, &in[0]);
+   copy_out_le(out, out_bytes, in.data());
    }
 
 }
diff --git a/src/lib/utils/stl_util.h b/src/lib/utils/stl_util.h
index 06f09498e..76cf77ef8 100644
--- a/src/lib/utils/stl_util.h
+++ b/src/lib/utils/stl_util.h
@@ -16,8 +16,7 @@ namespace Botan {
 
 inline std::vector<byte> to_byte_vector(const std::string& s)
    {
-   return std::vector<byte>(reinterpret_cast<const byte*>(&s[0]),
-                            reinterpret_cast<const byte*>(&s[s.size()]));
+   return std::vector<byte>(s.cbegin(), s.cend());
    }
 
 /*
diff --git a/src/lib/utils/xor_buf.h b/src/lib/utils/xor_buf.h
index 967348d4c..23151f72e 100644
--- a/src/lib/utils/xor_buf.h
+++ b/src/lib/utils/xor_buf.h
@@ -107,7 +107,7 @@ void xor_buf(std::vector<byte, Alloc>& out,
              const std::vector<byte, Alloc2>& in,
              size_t n)
    {
-   xor_buf(&out[0], &in[0], n);
+   xor_buf(out.data(), in.data(), n);
    }
 
 template<typename Alloc>
@@ -115,7 +115,7 @@ void xor_buf(std::vector<byte, Alloc>& out,
              const byte* in,
              size_t n)
    {
-   xor_buf(&out[0], in, n);
+   xor_buf(out.data(), in, n);
    }
 
 template<typename Alloc, typename Alloc2>
@@ -124,7 +124,7 @@ void xor_buf(std::vector<byte, Alloc>& out,
              const std::vector<byte, Alloc2>& in2,
              size_t n)
    {
-   xor_buf(&out[0], &in[0], &in2[0], n);
+   xor_buf(out.data(), in, in2.data(), n);
    }
 
 template<typename T, typename Alloc, typename Alloc2>
@@ -135,7 +135,7 @@ operator^=(std::vector<T, Alloc>& out,
    if(out.size() < in.size())
       out.resize(in.size());
 
-   xor_buf(&out[0], &in[0], in.size());
+   xor_buf(out.data(), in.data(), in.size());
    return out;
    }
 
diff --git a/src/lib/vendor/openssl/openssl_block.cpp b/src/lib/vendor/openssl/openssl_block.cpp
index 34f0e5607..4fd41112b 100644
--- a/src/lib/vendor/openssl/openssl_block.cpp
+++ b/src/lib/vendor/openssl/openssl_block.cpp
@@ -113,8 +113,8 @@ void OpenSSL_BlockCipher::key_schedule(const byte key[], size_t length)
          throw Invalid_Argument("OpenSSL_BlockCipher: Bad key length for " +
                                 cipher_name);
 
-   EVP_EncryptInit_ex(&encrypt, nullptr, nullptr, &full_key[0], nullptr);
-   EVP_DecryptInit_ex(&decrypt, nullptr, nullptr, &full_key[0], nullptr);
+   EVP_EncryptInit_ex(&encrypt, nullptr, nullptr, full_key.data(), nullptr);
+   EVP_DecryptInit_ex(&decrypt, nullptr, nullptr, full_key.data(), nullptr);
    }
 
 /*
diff --git a/src/lib/vendor/openssl/openssl_rsa.cpp b/src/lib/vendor/openssl/openssl_rsa.cpp
index 6055039b5..214f1667d 100644
--- a/src/lib/vendor/openssl/openssl_rsa.cpp
+++ b/src/lib/vendor/openssl/openssl_rsa.cpp
@@ -61,7 +61,7 @@ class OpenSSL_RSA_Encryption_Operation : public PK_Ops::Encryption
          m_openssl_rsa(nullptr, ::RSA_free), m_padding(pad)
          {
          const std::vector<byte> der = rsa.x509_subject_public_key();
-         const byte* der_ptr = &der[0];
+         const byte* der_ptr = der.data();
          m_openssl_rsa.reset(d2i_RSAPublicKey(nullptr, &der_ptr, der.size()));
          if(!m_openssl_rsa)
             throw OpenSSL_Error("d2i_RSAPublicKey");
@@ -76,7 +76,7 @@ class OpenSSL_RSA_Encryption_Operation : public PK_Ops::Encryption
          {
 
          secure_vector<byte> buf(::RSA_size(m_openssl_rsa.get()));
-         int rc = ::RSA_public_encrypt(msg_len, msg, &buf[0], m_openssl_rsa.get(), m_padding);
+         int rc = ::RSA_public_encrypt(msg_len, msg, buf.data(), m_openssl_rsa.get(), m_padding);
          if(rc < 0)
             throw OpenSSL_Error("RSA_public_encrypt");
          return buf;
@@ -112,7 +112,7 @@ class OpenSSL_RSA_Decryption_Operation : public PK_Ops::Decryption
          m_openssl_rsa(nullptr, ::RSA_free), m_padding(pad)
          {
          const secure_vector<byte> der = rsa.pkcs8_private_key();
-         const byte* der_ptr = &der[0];
+         const byte* der_ptr = der.data();
          m_openssl_rsa.reset(d2i_RSAPrivateKey(nullptr, &der_ptr, der.size()));
          if(!m_openssl_rsa)
             throw OpenSSL_Error("d2i_RSAPrivateKey");
@@ -125,7 +125,7 @@ class OpenSSL_RSA_Decryption_Operation : public PK_Ops::Decryption
       secure_vector<byte> decrypt(const byte msg[], size_t msg_len) override
          {
          secure_vector<byte> buf(::RSA_size(m_openssl_rsa.get()));
-         int rc = ::RSA_private_decrypt(msg_len, msg, &buf[0], m_openssl_rsa.get(), m_padding);
+         int rc = ::RSA_private_decrypt(msg_len, msg, buf.data(), m_openssl_rsa.get(), m_padding);
          if(rc < 0 || static_cast<size_t>(rc) > buf.size())
             throw OpenSSL_Error("RSA_private_decrypt");
          buf.resize(rc);
diff --git a/src/lib/vendor/sqlite3/sqlite3.cpp b/src/lib/vendor/sqlite3/sqlite3.cpp
index 61c7f15bc..be3c2b227 100644
--- a/src/lib/vendor/sqlite3/sqlite3.cpp
+++ b/src/lib/vendor/sqlite3/sqlite3.cpp
@@ -94,7 +94,7 @@ void Sqlite3_Database::Sqlite3_Statement::bind(int column, std::chrono::system_c
 
 void Sqlite3_Database::Sqlite3_Statement::bind(int column, const std::vector<byte>& val)
    {
-   int rc = ::sqlite3_bind_blob(m_stmt, column, &val[0], val.size(), SQLITE_TRANSIENT);
+   int rc = ::sqlite3_bind_blob(m_stmt, column, val.data(), val.size(), SQLITE_TRANSIENT);
    if(rc != SQLITE_OK)
       throw std::runtime_error("sqlite3_bind_text failed, code " + std::to_string(rc));
    }