Spatial safety: prove the entire access fits

Model an allocation as N accessible bytes indexed from zero through N−1. A nonempty access starting at offset o and using w bytes fits only if o is nonnegative, o is no greater than N, and w is no greater than N−o. For example, a four-byte access starting at byte 14 of a sixteen-byte buffer exceeds its end even though byte 14 itself exists. The check must cover the entire range. Real pointer APIs also specify which operations may form or use an end pointer without dereferencing it.

An index in elements and an offset in bytes are different quantities. A packed array of n elements of size s has an ideal payload of n times s, but constructing that product can overflow a finite integer type. Checked multiplication must establish that the requested size is representable before allocation. Similarly, computing o+w before checking an upper bound can wrap and make an invalid range appear small. A subtraction-based condition avoids that particular addition overflow only after establishing o≤N; it is not permission to ignore all other arithmetic.

Typed access can require alignment, initialized contents, and a representation valid for the type. A live byte buffer containing arbitrary network data is not automatically a valid in-memory instance of a structured language type. Endianness and padding can differ from the wire format, while a boolean or enum may forbid some bit patterns. Prefer explicit decoding with length checks and format validation. Copying bytes into an aligned location may solve alignment while leaving invalid values and incorrect interpretation untouched.

The permitted access region can also be smaller than the surrounding allocation. A slice exposes a particular logical length; spare container capacity is not automatically initialized data available through that slice. Two neighboring allocations do not become one legal array merely because their numerical addresses happen to be contiguous. Pointer provenance and the target API's rules matter. Distinguish a successful hardware load from a justified language-level access, and distinguish that access from the application-level fact that the bytes belong to the right user's record.

A sound parser should validate a region once and pass a constrained view to the next operation, rather than repeatedly reconstructing raw addresses from unchecked counts. Check every external length before a narrowing conversion, enforce resource limits separately from arithmetic representability, and validate nested records against their own boundaries. A declared one-gigabyte payload might fit the integer representation while exceeding the service's allowed request budget. Safe indexing usually gives a defined error or panic when bounds fail, but the surrounding code must still handle that outcome appropriately.

Use the vector lab only as a geometric interval exercise. At angle zero, magnitude two has x projection two; rotating to 180 degrees makes that projection negative. Interpret x as a normalized offset into a hypothetical three-unit buffer and give the access width one unit. Offset two fits exactly through the end, while a negative offset does not. Increasing magnitude to three produces an in-range starting endpoint but no room for a nonempty access. The diagram never constructs or validates pointers. It helps distinguish a boundary point from an entire permitted interval.