[wyldfire]

std::span<> is another option. Especially when paired with libc++'s hardening mode(s). Apparently, Google has deployed them in production.

[surajrmal]

Hardened std::span just adds checks during operator[] that you would normally only happen in at(). Same for operator* and operator->. It doesn't really have any relevance for the problem the article is written about.

[loeg]

What? std::span is equivalent to just a pointer+length pair. It doesn't know anything about if the underlying object(s) are still valid.