Merge pull request #154 from webmaster128/bounds-fixes

Remainings fixes before Botan runs fine in debug mode

23 files changed, 133 insertions, 98 deletions

diff --git a/src/lib/alloc/secmem.h b/src/lib/alloc/secmem.h
index b583aa812..98707ad4e 100644
--- a/src/lib/alloc/secmem.h
+++ b/src/lib/alloc/secmem.h
@@ -108,7 +108,10 @@ size_t buffer_insert(std::vector<T, Alloc>& buf,
                      size_t input_length)
    {
    const size_t to_copy = std::min(input_length, buf.size() - buf_offset);
-   copy_mem(&buf[buf_offset], input, to_copy);
+   if (to_copy > 0)
+      {
+      copy_mem(&buf[buf_offset], input, to_copy);
+      }
    return to_copy;
    }
 
@@ -118,7 +121,10 @@ size_t buffer_insert(std::vector<T, Alloc>& buf,
                      const std::vector<T, Alloc2>& input)
    {
    const size_t to_copy = std::min(input.size(), buf.size() - buf_offset);
-   copy_mem(&buf[buf_offset], input.data(), to_copy);
+   if (to_copy > 0)
+      {
+      copy_mem(&buf[buf_offset], input.data(), to_copy);
+      }
    return to_copy;
    }
 
@@ -129,7 +135,10 @@ operator+=(std::vector<T, Alloc>& out,
    {
    const size_t copy_offset = out.size();
    out.resize(out.size() + in.size());
-   copy_mem(&out[copy_offset], in.data(), in.size());
+   if (in.size() > 0)
+      {
+      copy_mem(&out[copy_offset], in.data(), in.size());
+      }
    return out;
    }
 
@@ -146,7 +155,10 @@ std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out,
    {
    const size_t copy_offset = out.size();
    out.resize(out.size() + in.second);
-   copy_mem(&out[copy_offset], in.first, in.second);
+   if (in.second > 0)
+      {
+      copy_mem(&out[copy_offset], in.first, in.second);
+      }
    return out;
    }
 
@@ -156,7 +168,10 @@ std::vector<T, Alloc>& operator+=(std::vector<T, Alloc>& out,
    {
    const size_t copy_offset = out.size();
    out.resize(out.size() + in.second);
-   copy_mem(&out[copy_offset], in.first, in.second);
+   if (in.second > 0)
+      {
+      copy_mem(&out[copy_offset], in.first, in.second);
+      }
    return out;
    }
 
diff --git a/src/lib/asn1/ber_dec.cpp b/src/lib/asn1/ber_dec.cpp
index e9133d50f..06543d9e7 100644
--- a/src/lib/asn1/ber_dec.cpp
+++ b/src/lib/asn1/ber_dec.cpp
@@ -220,7 +220,7 @@ BER_Object BER_Decoder::get_next_object()
 
    size_t length = decode_length(source);
    next.value.resize(length);
-   if(source->read(&next.value[0], length) != length)
+   if(source->read(next.value.data(), length) != length)
       throw BER_Decoding_Error("Value truncated");
 
    if(next.type_tag == EOC && next.class_tag == UNIVERSAL)
@@ -254,7 +254,7 @@ BER_Decoder BER_Decoder::start_cons(ASN1_Tag type_tag,
    BER_Object obj = get_next_object();
    obj.assert_is_a(type_tag, ASN1_Tag(class_tag | CONSTRUCTED));
 
-   BER_Decoder result(&obj.value[0], obj.value.size());
+   BER_Decoder result(obj.value.data(), obj.value.size());
    result.parent = this;
    return result;
    }
diff --git a/src/lib/block/serpent/serpent.cpp b/src/lib/block/serpent/serpent.cpp
index 0fd76ce8f..b809e602c 100644
--- a/src/lib/block/serpent/serpent.cpp
+++ b/src/lib/block/serpent/serpent.cpp
@@ -195,7 +195,7 @@ void Serpent::key_schedule(const byte key[], size_t length)
    SBoxE6(W[128],W[129],W[130],W[131]); SBoxE5(W[132],W[133],W[134],W[135]);
    SBoxE4(W[136],W[137],W[138],W[139]);
 
-   round_key.assign(&W[8], &W[140]);
+   round_key.assign(W.begin() + 8, W.end());
    }
 
 void Serpent::clear()
diff --git a/src/lib/mac/poly1305/poly1305.cpp b/src/lib/mac/poly1305/poly1305.cpp
index 545a749fa..506150b0f 100644
--- a/src/lib/mac/poly1305/poly1305.cpp
+++ b/src/lib/mac/poly1305/poly1305.cpp
@@ -190,7 +190,11 @@ void Poly1305::final_result(byte out[])
    if(m_buf_pos != 0)
       {
       m_buf[m_buf_pos] = 1;
-      clear_mem(&m_buf[m_buf_pos+1], m_buf.size() - m_buf_pos - 1);
+      const auto len = m_buf.size() - m_buf_pos - 1;
+      if (len > 0)
+         {
+         clear_mem(&m_buf[m_buf_pos+1], len);
+         }
       poly1305_blocks(m_poly, m_buf.data(), 1, true);
       }
 
diff --git a/src/lib/math/bigint/bigint.h b/src/lib/math/bigint/bigint.h
index 3f329c451..fed986882 100644
--- a/src/lib/math/bigint/bigint.h
+++ b/src/lib/math/bigint/bigint.h
@@ -278,7 +278,11 @@ class BOTAN_DLL BigInt
 
         if(top_word < size())
            {
-           clear_mem(&m_reg[top_word+1], size() - (top_word + 1));
+           const auto len = size() - (top_word + 1);
+           if (len > 0)
+              {
+              clear_mem(&m_reg[top_word+1], len);
+              }
            m_reg[top_word] &= mask;
            }
         }
diff --git a/src/lib/modes/cfb/cfb.cpp b/src/lib/modes/cfb/cfb.cpp
index 7e4048a2b..e98d10cb3 100644
--- a/src/lib/modes/cfb/cfb.cpp
+++ b/src/lib/modes/cfb/cfb.cpp
@@ -100,7 +100,10 @@ void CFB_Encryption::update(secure_vector<byte>& buffer, size_t offset)
       xor_buf(buf, &keystream_buf()[0], took);
 
       // Assumes feedback-sized block except for last input
-      copy_mem(state.data(), &state[shift], BS - shift);
+      if (BS - shift > 0)
+         {
+         copy_mem(state.data(), &state[shift], BS - shift);
+         }
       copy_mem(&state[BS-shift], buf, took);
       cipher().encrypt(state, keystream_buf());
 
@@ -130,7 +133,10 @@ void CFB_Decryption::update(secure_vector<byte>& buffer, size_t offset)
       const size_t took = std::min(shift, sz);
 
       // first update shift register with ciphertext
-      copy_mem(state.data(), &state[shift], BS - shift);
+      if (BS - shift > 0)
+         {
+         copy_mem(state.data(), &state[shift], BS - shift);
+         }
       copy_mem(&state[BS-shift], buf, took);
 
       // then decrypt
diff --git a/src/lib/pubkey/mceies/mceies.cpp b/src/lib/pubkey/mceies/mceies.cpp
index 6b013c250..9e9ae1cb8 100644
--- a/src/lib/pubkey/mceies/mceies.cpp
+++ b/src/lib/pubkey/mceies/mceies.cpp
@@ -58,8 +58,8 @@ mceies_encrypt(const McEliece_PublicKey& pubkey,
 
    secure_vector<byte> msg(mce_ciphertext.size() + nonce.size() + pt.size());
    copy_mem(msg.data(), mce_ciphertext.data(), mce_ciphertext.size());
-   copy_mem(&msg[mce_ciphertext.size()], nonce.data(), nonce.size());
-   copy_mem(&msg[mce_ciphertext.size() + nonce.size()], pt.data(), pt.size());
+   copy_mem(msg.data() + mce_ciphertext.size(), nonce.data(), nonce.size());
+   copy_mem(msg.data() + mce_ciphertext.size() + nonce.size(), pt.data(), pt.size());
 
    aead->start(nonce);
    aead->finish(msg, mce_ciphertext.size() + nonce.size());
@@ -91,7 +91,7 @@ mceies_decrypt(const McEliece_PrivateKey& privkey,
       aead->set_key(aead_key(mce_key, *aead));
       aead->set_associated_data(ad, ad_len);
 
-      secure_vector<byte> pt(&ct[mce_code_bytes + nonce_len], &ct[ct.size()]);
+      secure_vector<byte> pt(ct.begin() + mce_code_bytes + nonce_len, ct.end());
 
       aead->start(&ct[mce_code_bytes], nonce_len);
       aead->finish(pt, 0);
diff --git a/src/lib/tls/msg_certificate.cpp b/src/lib/tls/msg_certificate.cpp
index 99722c306..f0ccc5328 100644
--- a/src/lib/tls/msg_certificate.cpp
+++ b/src/lib/tls/msg_certificate.cpp
@@ -41,9 +41,9 @@ Certificate::Certificate(const std::vector<byte>& buf)
    if(total_size != buf.size() - 3)
       throw Decoding_Error("Certificate: Message malformed");
 
-   const byte* certs = &buf[3];
+   const byte* certs = buf.data() + 3;
 
-   while(size_t remaining_bytes = &buf[buf.size()] - certs)
+   while(size_t remaining_bytes = buf.data() + buf.size() - certs)
       {
       if(remaining_bytes < 3)
          throw Decoding_Error("Certificate: Message malformed");
diff --git a/src/lib/tls/tls_handshake_io.cpp b/src/lib/tls/tls_handshake_io.cpp
index d4633becd..6286eab08 100644
--- a/src/lib/tls/tls_handshake_io.cpp
+++ b/src/lib/tls/tls_handshake_io.cpp
@@ -95,7 +95,10 @@ Stream_Handshake_IO::format(const std::vector<byte>& msg,
 
    store_be24(&send_buf[1], buf_size);
 
-   copy_mem(&send_buf[4], msg.data(), msg.size());
+   if (msg.size() > 0)
+      {
+      copy_mem(&send_buf[4], msg.data(), msg.size());
+      }
 
    return send_buf;
    }
@@ -350,7 +353,10 @@ Datagram_Handshake_IO::format_fragment(const byte fragment[],
    store_be24(&send_buf[6], frag_offset);
    store_be24(&send_buf[9], frag_len);
 
-   copy_mem(&send_buf[12], fragment, frag_len);
+   if (frag_len > 0)
+      {
+      copy_mem(&send_buf[12], fragment, frag_len);
+      }
 
    return send_buf;
    }
diff --git a/src/lib/tls/tls_record.cpp b/src/lib/tls/tls_record.cpp
index c384611e9..3ba02f039 100644
--- a/src/lib/tls/tls_record.cpp
+++ b/src/lib/tls/tls_record.cpp
@@ -491,7 +491,7 @@ size_t read_tls_record(secure_vector<byte>& readbuf,
 
    if(epoch == 0) // Unencrypted initial handshake
       {
-      record.assign(&readbuf[TLS_HEADER_SIZE], &readbuf[TLS_HEADER_SIZE + record_len]);
+      record.assign(readbuf.begin() + TLS_HEADER_SIZE, readbuf.begin() + TLS_HEADER_SIZE + record_len);
       readbuf.clear();
       return 0; // got a full record
       }
@@ -578,7 +578,7 @@ size_t read_dtls_record(secure_vector<byte>& readbuf,
 
    if(epoch == 0) // Unencrypted initial handshake
       {
-      record.assign(&readbuf[DTLS_HEADER_SIZE], &readbuf[DTLS_HEADER_SIZE + record_len]);
+      record.assign(readbuf.begin() + DTLS_HEADER_SIZE, readbuf.begin() + DTLS_HEADER_SIZE + record_len);
       readbuf.clear();
       return 0; // got a full record
       }
diff --git a/src/tests/test_c25519.cpp b/src/tests/test_c25519.cpp
index f8dfd3b85..46d9c1bea 100644
--- a/src/tests/test_c25519.cpp
+++ b/src/tests/test_c25519.cpp
@@ -29,7 +29,7 @@ size_t curve25519_scalar_kat(const std::string& secret_h,
    const std::vector<byte> out = hex_decode(out_h);
 
    std::vector<byte> got(32);
-   curve25519_donna(&got[0], &secret[0], &basepoint[0]);
+   curve25519_donna(got.data(), secret.data(), basepoint.data());
 
    if(got != out)
       {
diff --git a/src/tests/test_cryptobox.cpp b/src/tests/test_cryptobox.cpp
index 74686a298..773360952 100644
--- a/src/tests/test_cryptobox.cpp
+++ b/src/tests/test_cryptobox.cpp
@@ -32,7 +32,7 @@ size_t test_cryptobox()
                                                  "secret password");
 
       if(plaintext.size() != sizeof(msg) ||
-         !same_mem(reinterpret_cast<const byte*>(&plaintext[0]), msg, sizeof(msg)))
+         !same_mem(reinterpret_cast<const byte*>(plaintext.data()), msg, sizeof(msg)))
          ++fails;
 
       }
diff --git a/src/tests/test_cvc.cpp b/src/tests/test_cvc.cpp
index a2e398c37..9b11dea7c 100644
--- a/src/tests/test_cvc.cpp
+++ b/src/tests/test_cvc.cpp
@@ -45,7 +45,7 @@ void helper_write_file(EAC_Signed_Object const& to_write, std::string const& fil
    {
    std::vector<byte> sv = to_write.BER_encode();
    std::ofstream cert_file(file_path, std::ios::binary);
-   cert_file.write((char*)&sv[0], sv.size());
+   cert_file.write((char*)sv.data(), sv.size());
    cert_file.close();
    }
 
@@ -99,7 +99,7 @@ void test_enc_gen_selfsigned(RandomNumberGenerator& rng)
    std::ofstream cert_file;
    cert_file.open(CVC_TEST_DATA_DIR "/my_cv_cert.ber", std::ios::binary);
    //cert_file << der; // this is bad !!!
-   cert_file.write((char*)&der[0], der.size());
+   cert_file.write((char*)der.data(), der.size());
    cert_file.close();
 
    EAC1_1_CVC cert_in(CVC_TEST_DATA_DIR "/my_cv_cert.ber");
@@ -107,7 +107,7 @@ void test_enc_gen_selfsigned(RandomNumberGenerator& rng)
    // encoding it again while it has no dp
    std::vector<byte> der2(cert_in.BER_encode());
    std::ofstream cert_file2(CVC_TEST_DATA_DIR "/my_cv_cert2.ber", std::ios::binary);
-   cert_file2.write((char*)&der2[0], der2.size());
+   cert_file2.write((char*)der2.data(), der2.size());
    cert_file2.close();
    // read both and compare them
    std::ifstream cert_1_in(CVC_TEST_DATA_DIR "/my_cv_cert.ber");
@@ -204,7 +204,7 @@ void test_enc_gen_req(RandomNumberGenerator& rng)
    EAC1_1_Req req = CVC_EAC::create_cvc_req(key, opts.chr, opts.hash_alg, rng);
    std::vector<byte> der(req.BER_encode());
    std::ofstream req_file(CVC_TEST_DATA_DIR "/my_cv_req.ber", std::ios::binary);
-   req_file.write((char*)&der[0], der.size());
+   req_file.write((char*)der.data(), der.size());
    req_file.close();
 
    // read and check signature...
@@ -255,7 +255,7 @@ void test_cvc_ado_creation(RandomNumberGenerator& rng)
    EAC1_1_Req req = CVC_EAC::create_cvc_req(req_key, opts.chr, opts.hash_alg, rng);
    std::vector<byte> der(req.BER_encode());
    std::ofstream req_file(CVC_TEST_DATA_DIR "/my_cv_req.ber", std::ios::binary);
-   req_file.write((char*)&der[0], der.size());
+   req_file.write((char*)der.data(), der.size());
    req_file.close();
 
    // create an ado with that req
@@ -270,7 +270,7 @@ void test_cvc_ado_creation(RandomNumberGenerator& rng)
 
    std::ofstream ado_file(CVC_TEST_DATA_DIR "/ado", std::ios::binary);
    std::vector<byte> ado_der(ado.BER_encode());
-   ado_file.write((char*)&ado_der[0], ado_der.size());
+   ado_file.write((char*)ado_der.data(), ado_der.size());
    ado_file.close();
    // read it again and check the signature
    EAC1_1_ADO ado2(CVC_TEST_DATA_DIR "/ado");
@@ -324,7 +324,7 @@ void test_cvc_ado_comparison(RandomNumberGenerator& rng)
    CHECK_MESSAGE(ado != ado2, "ado's found to be equal where they are not");
    //     std::ofstream ado_file(CVC_TEST_DATA_DIR "/ado");
    //     std::vector<byte> ado_der(ado.BER_encode());
-   //     ado_file.write((char*)&ado_der[0], ado_der.size());
+   //     ado_file.write((char*)ado_der.data(), ado_der.size());
    //     ado_file.close();
    // read it again and check the signature
 
@@ -470,7 +470,7 @@ void test_cvc_chain(RandomNumberGenerator& rng)
    EAC1_1_CVC cvca_cert = DE_EAC::create_cvca(cvca_privk, hash, car, true, true, 12, rng);
    std::ofstream cvca_file(CVC_TEST_DATA_DIR "/cvc_chain_cvca.cer", std::ios::binary);
    std::vector<byte> cvca_sv = cvca_cert.BER_encode();
-   cvca_file.write((char*)&cvca_sv[0], cvca_sv.size());
+   cvca_file.write((char*)cvca_sv.data(), cvca_sv.size());
    cvca_file.close();
 
    ECDSA_PrivateKey cvca_privk2(rng, dom_pars);
@@ -479,7 +479,7 @@ void test_cvc_chain(RandomNumberGenerator& rng)
    EAC1_1_CVC link12 = DE_EAC::link_cvca(cvca_cert, cvca_privk, cvca_cert2, rng);
    std::vector<byte> link12_sv = link12.BER_encode();
    std::ofstream link12_file(CVC_TEST_DATA_DIR "/cvc_chain_link12.cer", std::ios::binary);
-   link12_file.write((char*)&link12_sv[0], link12_sv.size());
+   link12_file.write((char*)link12_sv.data(), link12_sv.size());
    link12_file.close();
 
    // verify the link
@@ -494,7 +494,7 @@ void test_cvc_chain(RandomNumberGenerator& rng)
    EAC1_1_Req dvca_req = DE_EAC::create_cvc_req(dvca_priv_key, ASN1_Chr("DEDVCAEPASS"), hash, rng);
    std::ofstream dvca_file(CVC_TEST_DATA_DIR "/cvc_chain_dvca_req.cer", std::ios::binary);
    std::vector<byte> dvca_sv = dvca_req.BER_encode();
-   dvca_file.write((char*)&dvca_sv[0], dvca_sv.size());
+   dvca_file.write((char*)dvca_sv.data(), dvca_sv.size());
    dvca_file.close();
 
    // sign the dvca_request
@@ -508,7 +508,7 @@ void test_cvc_chain(RandomNumberGenerator& rng)
    EAC1_1_Req dvca_req2 = DE_EAC::create_cvc_req(dvca_priv_key2, ASN1_Chr("DEDVCAEPASS"), hash, rng);
    std::ofstream dvca_file2(CVC_TEST_DATA_DIR "/cvc_chain_dvca_req2.cer", std::ios::binary);
    std::vector<byte> dvca_sv2 = dvca_req2.BER_encode();
-   dvca_file2.write((char*)&dvca_sv2[0], dvca_sv2.size());
+   dvca_file2.write((char*)dvca_sv2.data(), dvca_sv2.size());
    dvca_file2.close();
    EAC1_1_ADO dvca_ado2 = CVC_EAC::create_ado_req(dvca_priv_key, dvca_req2,
                                                   ASN1_Car(dvca_cert1.get_chr().iso_8859()), rng);
diff --git a/src/tests/test_mceliece.cpp b/src/tests/test_mceliece.cpp
index f55492e95..8f1d3b6a3 100644
--- a/src/tests/test_mceliece.cpp
+++ b/src/tests/test_mceliece.cpp
@@ -36,13 +36,13 @@ size_t test_mceliece_message_parts(RandomNumberGenerator& rng, size_t code_lengt
    {
    secure_vector<gf2m> err_pos1 = create_random_error_positions(code_length, error_weight, rng);
    secure_vector<byte> message1((code_length+7)/8);
-   rng.randomize(&message1[0], message1.size() - 1);
+   rng.randomize(message1.data(), message1.size() - 1);
    mceliece_message_parts parts1(err_pos1, message1, code_length);
    secure_vector<byte> err_vec1 = parts1.get_error_vector();
 
    secure_vector<byte> concat1 = parts1.get_concat();
 
-   mceliece_message_parts parts2( &concat1[0], concat1.size(), code_length);
+   mceliece_message_parts parts2( concat1.data(), concat1.size(), code_length);
 
    secure_vector<byte> err_vec2 = parts2.get_error_vector();
    if(err_vec1 != err_vec2)
@@ -76,7 +76,7 @@ size_t test_mceliece_kem(const McEliece_PrivateKey& sk,
       const secure_vector<byte>& ciphertext = ciphertext__sym_key.first;
       const secure_vector<byte>& sym_key_encr = ciphertext__sym_key.second;
 
-      const secure_vector<byte> sym_key_decr = priv_op.decrypt(&ciphertext[0], ciphertext.size());
+      const secure_vector<byte> sym_key_decr = priv_op.decrypt(ciphertext.data(), ciphertext.size());
 
       if(sym_key_encr != sym_key_decr)
          {
@@ -95,7 +95,7 @@ size_t test_mceliece_kem(const McEliece_PrivateKey& sk,
             wrong_ct[byte_pos] ^= 1 << bit_pos;
             try
                {
-               secure_vector<byte> decrypted = priv_op.decrypt(&wrong_ct[0], wrong_ct.size());
+               secure_vector<byte> decrypted = priv_op.decrypt(wrong_ct.data(), wrong_ct.size());
                }
             catch(const Integrity_Failure)
                {
@@ -123,22 +123,22 @@ size_t test_mceliece_raw(const McEliece_PrivateKey& sk,
    for(size_t i = 0; i != MCE_RUNS; i++)
       {
       secure_vector<byte> plaintext((pk.get_message_word_bit_length()+7)/8);
-      rng.randomize(&plaintext[0], plaintext.size() - 1);
+      rng.randomize(plaintext.data(), plaintext.size() - 1);
       secure_vector<gf2m> err_pos = create_random_error_positions(code_length, pk.get_t(), rng);
 
 
       mceliece_message_parts parts(err_pos, plaintext, code_length);
       secure_vector<byte> message_and_error_input = parts.get_concat();
-      secure_vector<byte> ciphertext = pub_op.encrypt(&message_and_error_input[0], message_and_error_input.size(), rng);
+      secure_vector<byte> ciphertext = pub_op.encrypt(message_and_error_input.data(), message_and_error_input.size(), rng);
       //std::cout << "ciphertext byte length = " << ciphertext.size() << std::endl;
-      secure_vector<byte> message_and_error_output = priv_op.decrypt(&ciphertext[0], ciphertext.size() );
+      secure_vector<byte> message_and_error_output = priv_op.decrypt(ciphertext.data(), ciphertext.size() );
       if(message_and_error_input != message_and_error_output)
          {
-         mceliece_message_parts combined(&message_and_error_input[0], message_and_error_input.size(), code_length);
+         mceliece_message_parts combined(message_and_error_input.data(), message_and_error_input.size(), code_length);
          secure_vector<byte> orig_pt = combined.get_message_word();
          secure_vector<byte> orig_ev = combined.get_error_vector();
 
-         mceliece_message_parts decr_combined(&message_and_error_output[0], message_and_error_output.size(), code_length);
+         mceliece_message_parts decr_combined(message_and_error_output.data(), message_and_error_output.size(), code_length);
          secure_vector<byte> decr_pt = decr_combined.get_message_word();
          secure_vector<byte> decr_ev = decr_combined.get_error_vector();
          std::cout << "ciphertext = " << hex_encode(ciphertext) << std::endl;
diff --git a/src/tests/test_ocb.cpp b/src/tests/test_ocb.cpp
index c27753214..513b34dc2 100644
--- a/src/tests/test_ocb.cpp
+++ b/src/tests/test_ocb.cpp
@@ -25,9 +25,9 @@ std::vector<byte> ocb_encrypt(OCB_Encryption& enc,
                               const std::vector<byte>& pt,
                               const std::vector<byte>& ad)
    {
-   enc.set_associated_data(&ad[0], ad.size());
+   enc.set_associated_data(ad.data(), ad.size());
 
-   enc.start(&nonce[0], nonce.size());
+   enc.start(nonce.data(), nonce.size());
 
    secure_vector<byte> buf(pt.begin(), pt.end());
    enc.finish(buf, 0);
@@ -36,9 +36,9 @@ std::vector<byte> ocb_encrypt(OCB_Encryption& enc,
       {
       secure_vector<byte> ct = buf;
 
-      dec.set_associated_data(&ad[0], ad.size());
+      dec.set_associated_data(ad.data(), ad.size());
 
-      dec.start(&nonce[0], nonce.size());
+      dec.start(nonce.data(), nonce.size());
 
       dec.finish(ct, 0);
 
diff --git a/src/tests/test_pbkdf.cpp b/src/tests/test_pbkdf.cpp
index 39340e8a7..703a7bc80 100644
--- a/src/tests/test_pbkdf.cpp
+++ b/src/tests/test_pbkdf.cpp
@@ -29,7 +29,7 @@ size_t test_pbkdf()
              const std::string pass = vec["Passphrase"];
 
              const auto key = pbkdf->derive_key(outlen, pass,
-                                                &salt[0], salt.size(),
+                                                salt.data(), salt.size(),
                                                 iterations).bits_of();
              return hex_encode(key);
              });
diff --git a/src/tests/test_pubkey.cpp b/src/tests/test_pubkey.cpp
index bde32c687..00ece8559 100644
--- a/src/tests/test_pubkey.cpp
+++ b/src/tests/test_pubkey.cpp
@@ -254,7 +254,7 @@ size_t validate_signature(PK_Verifier& v, PK_Signer& s, const std::string& algo,
 
    PK_TEST(v.verify_message(message, sig), "Correct signature is valid");
 
-   zero_mem(&sig[0], sig.size());
+   zero_mem(sig.data(), sig.size());
 
    PK_TEST(!v.verify_message(message, sig), "All-zero signature is invalid");
 
diff --git a/src/tests/test_rng.cpp b/src/tests/test_rng.cpp
index f0efb36c3..81a539f1e 100644
--- a/src/tests/test_rng.cpp
+++ b/src/tests/test_rng.cpp
@@ -34,7 +34,7 @@ RandomNumberGenerator* get_rng(const std::string& algo_str, const std::string& i
          Botan::secure_vector<byte> random_vec(size_t)
             {
             Botan::secure_vector<byte> vec(this->remaining());
-            this->randomize(&vec[0], vec.size());
+            this->randomize(vec.data(), vec.size());
             return vec;
             }
       };
@@ -93,7 +93,7 @@ size_t hmac_drbg_test(std::map<std::string, std::string> m)
 
    // now reseed
    const auto reseed_input = hex_decode(m["EntropyInputReseed"]);
-   rng->add_entropy(&reseed_input[0], reseed_input.size());
+   rng->add_entropy(reseed_input.data(), reseed_input.size());
 
    const std::string out = m["Out"];
 
diff --git a/src/tests/test_stream.cpp b/src/tests/test_stream.cpp
index 6f14c7183..0e9f67c9f 100644
--- a/src/tests/test_stream.cpp
+++ b/src/tests/test_stream.cpp
@@ -50,7 +50,7 @@ size_t stream_test(const std::string& algo,
       cipher->set_key(key);
 
       if(nonce.size())
-         cipher->set_iv(&nonce[0], nonce.size());
+         cipher->set_iv(nonce.data(), nonce.size());
 
       secure_vector<byte> buf = pt;
 
diff --git a/src/tests/test_tss.cpp b/src/tests/test_tss.cpp
index fad85f93c..23ea89b19 100644
--- a/src/tests/test_tss.cpp
+++ b/src/tests/test_tss.cpp
@@ -28,7 +28,7 @@ size_t test_tss()
    const secure_vector<byte> S = hex_decode_locked("7465737400");
 
    std::vector<RTSS_Share> shares =
-      RTSS_Share::split(2, 4, &S[0], S.size(), id, rng);
+      RTSS_Share::split(2, 4, S.data(), S.size(), id, rng);
 
    auto back = RTSS_Share::reconstruct(shares);
 
diff --git a/src/tests/unit_ecc.cpp b/src/tests/unit_ecc.cpp
index 2bae63936..4c35caa48 100644
--- a/src/tests/unit_ecc.cpp
+++ b/src/tests/unit_ecc.cpp
@@ -75,9 +75,9 @@ size_t test_point_turn_on_sp_red_mul()
    std::vector<byte> sv_a_secp = hex_decode(a_secp);
    std::vector<byte> sv_b_secp = hex_decode(b_secp);
    std::vector<byte> sv_G_secp_comp = hex_decode(G_secp_comp);
-   BigInt bi_p_secp = BigInt::decode(&sv_p_secp[0], sv_p_secp.size());
-   BigInt bi_a_secp = BigInt::decode(&sv_a_secp[0], sv_a_secp.size());
-   BigInt bi_b_secp = BigInt::decode(&sv_b_secp[0], sv_b_secp.size());
+   BigInt bi_p_secp = BigInt::decode(sv_p_secp.data(), sv_p_secp.size());
+   BigInt bi_a_secp = BigInt::decode(sv_a_secp.data(), sv_a_secp.size());
+   BigInt bi_b_secp = BigInt::decode(sv_b_secp.data(), sv_b_secp.size());
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP(sv_G_secp_comp, secp160r1);
 
@@ -140,9 +140,9 @@ size_t test_coordinates()
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
 
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
    CurveGFp secp160r1 (bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
    PointGFp p0 = p_G;
@@ -218,9 +218,9 @@ size_t test_point_negative()
    std::vector<byte> sv_a_secp = hex_decode ( a_secp );
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
 
@@ -332,9 +332,9 @@ size_t test_add_point()
    std::vector<byte> sv_a_secp = hex_decode ( a_secp );
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
 
@@ -369,9 +369,9 @@ size_t test_sub_point()
    std::vector<byte> sv_a_secp = hex_decode ( a_secp );
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
 
@@ -405,9 +405,9 @@ size_t test_mult_point()
    std::vector<byte> sv_a_secp = hex_decode ( a_secp );
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
 
@@ -435,9 +435,9 @@ size_t test_basic_operations()
    std::vector<byte> sv_a_secp = hex_decode ( a_secp );
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
 
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, secp160r1 );
@@ -499,9 +499,9 @@ size_t test_enc_dec_compressed_160()
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
 
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
 
    CurveGFp secp160r1(bi_p_secp, bi_a_secp, bi_b_secp);
 
@@ -528,9 +528,9 @@ size_t test_enc_dec_compressed_256()
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_comp = hex_decode ( G_secp_comp );
 
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
 
    CurveGFp curve(bi_p_secp, bi_a_secp, bi_b_secp);
 
@@ -559,9 +559,9 @@ size_t test_enc_dec_uncompressed_112()
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
 
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
 
    CurveGFp curve(bi_p_secp, bi_a_secp, bi_b_secp);
 
@@ -588,17 +588,17 @@ size_t test_enc_dec_uncompressed_521()
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
 
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
 
    CurveGFp curve(bi_p_secp, bi_a_secp, bi_b_secp);
 
    PointGFp p_G = OS2ECP ( sv_G_secp_uncomp, curve );
 
    std::vector<byte> sv_result = unlock(EC2OSP(p_G, PointGFp::UNCOMPRESSED));
-   std::string result = hex_encode(&sv_result[0], sv_result.size());
-   std::string exp_result = hex_encode(&sv_G_secp_uncomp[0], sv_G_secp_uncomp.size());
+   std::string result = hex_encode(sv_result.data(), sv_result.size());
+   std::string exp_result = hex_encode(sv_G_secp_uncomp.data(), sv_G_secp_uncomp.size());
 
    CHECK_MESSAGE(sv_result == sv_G_secp_uncomp, "calc. result = " << result << "\nexp. result = " << exp_result);
    return fails;
@@ -620,9 +620,9 @@ size_t test_enc_dec_uncompressed_521_prime_too_large()
    std::vector<byte> sv_b_secp = hex_decode ( b_secp );
    std::vector<byte> sv_G_secp_uncomp = hex_decode ( G_secp_uncomp );
 
-   BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
+   BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
 
    CurveGFp secp521r1 (bi_p_secp, bi_a_secp, bi_b_secp);
    std::unique_ptr<PointGFp> p_G;
diff --git a/src/tests/unit_ecdsa.cpp b/src/tests/unit_ecdsa.cpp
index 39e656636..4d4c83ce3 100644
--- a/src/tests/unit_ecdsa.cpp
+++ b/src/tests/unit_ecdsa.cpp
@@ -36,7 +36,7 @@ namespace {
 
 std::string to_hex(const std::vector<byte>& bin)
    {
-   return hex_encode(&bin[0], bin.size());
+   return hex_encode(bin.data(), bin.size());
    }
 
 /**
@@ -294,11 +294,11 @@ size_t test_create_and_verify(RandomNumberGenerator& rng)
    auto sv_G_secp_comp = hex_decode ( G_secp_comp );
    auto sv_order_g = hex_decode ( order_g );
 
-   //	BigInt bi_p_secp = BigInt::decode ( &sv_p_secp[0], sv_p_secp.size() );
+   //	BigInt bi_p_secp = BigInt::decode ( sv_p_secp.data(), sv_p_secp.size() );
    BigInt bi_p_secp("2117607112719756483104013348936480976596328609518055062007450442679169492999007105354629105748524349829824407773719892437896937279095106809");
-   BigInt bi_a_secp = BigInt::decode ( &sv_a_secp[0], sv_a_secp.size() );
-   BigInt bi_b_secp = BigInt::decode ( &sv_b_secp[0], sv_b_secp.size() );
-   BigInt bi_order_g = BigInt::decode ( &sv_order_g[0], sv_order_g.size() );
+   BigInt bi_a_secp = BigInt::decode ( sv_a_secp.data(), sv_a_secp.size() );
+   BigInt bi_b_secp = BigInt::decode ( sv_b_secp.data(), sv_b_secp.size() );
+   BigInt bi_order_g = BigInt::decode ( sv_order_g.data(), sv_order_g.size() );
    CurveGFp curve(bi_p_secp, bi_a_secp, bi_b_secp);
    PointGFp p_G = OS2ECP ( sv_G_secp_comp, curve );
 
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index edc5e913d..8eb2d1a96 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -232,7 +232,7 @@ size_t basic_test_handshake(RandomNumberGenerator& rng,
 
       try
          {
-         server.received_data(&input[0], input.size());
+         server.received_data(input.data(), input.size());
          }
       catch(std::exception& e)
          {
@@ -245,7 +245,7 @@ size_t basic_test_handshake(RandomNumberGenerator& rng,
 
       try
          {
-         client.received_data(&input[0], input.size());
+         client.received_data(input.data(), input.size());
          }
       catch(std::exception& e)
          {