diff --git a/include/libtorrent/broadcast_socket.hpp b/include/libtorrent/broadcast_socket.hpp
index 91201379d..27ef2e935 100644
--- a/include/libtorrent/broadcast_socket.hpp
+++ b/include/libtorrent/broadcast_socket.hpp
@@ -39,6 +39,7 @@ POSSIBILITY OF SUCH DAMAGE.
 #include "libtorrent/address.hpp"
 #include "libtorrent/error_code.hpp"
 #include "libtorrent/string_view.hpp"
+#include "libtorrent/span.hpp"
 
 #include <memory>
 #include <list>
@@ -57,7 +58,7 @@ namespace libtorrent {
 	address ensure_v6(address const& a);
 
 	typedef std::function<void(udp::endpoint const& from
-		, char const* buffer, int size)> receive_handler_t;
+		, span<char const> buffer)> receive_handler_t;
 
 	class TORRENT_EXTRA_EXPORT broadcast_socket
 	{
diff --git a/include/libtorrent/lsd.hpp b/include/libtorrent/lsd.hpp
index f128b26ec..d71081eb2 100644
--- a/include/libtorrent/lsd.hpp
+++ b/include/libtorrent/lsd.hpp
@@ -60,8 +60,7 @@ private:
 		, bool broadcast, int retry_count);
 	void resend_announce(error_code const& e, sha1_hash const& ih
 		, int listen_port, int retry_count);
-	void on_announce(udp::endpoint const& from, char const* buffer
-		, std::size_t bytes_transferred);
+	void on_announce(udp::endpoint const& from, span<char const> buffer);
 
 	aux::lsd_callback& m_callback;
 
diff --git a/include/libtorrent/upnp.hpp b/include/libtorrent/upnp.hpp
index 8a5188820..cab16a5cc 100644
--- a/include/libtorrent/upnp.hpp
+++ b/include/libtorrent/upnp.hpp
@@ -203,8 +203,7 @@ private:
 	void discover_device_impl();
 
 	void resend_request(error_code const& e);
-	void on_reply(udp::endpoint const& from, char const* buffer
-		, std::size_t bytes_transferred);
+	void on_reply(udp::endpoint const& from, span<char const> buffer);
 
 	struct rootdevice;
 	void next(rootdevice& d, port_mapping_t i);
diff --git a/src/broadcast_socket.cpp b/src/broadcast_socket.cpp
index 541663a68..57e4f30b1 100644
--- a/src/broadcast_socket.cpp
+++ b/src/broadcast_socket.cpp
@@ -318,7 +318,7 @@ namespace libtorrent {
 			maybe_abort();
 			return;
 		}
-		m_on_receive(s->remote, s->buffer, int(bytes_transferred));
+		m_on_receive(s->remote, {s->buffer, bytes_transferred});
 
 		if (maybe_abort()) return;
 		if (!s->socket) return;
diff --git a/src/lsd.cpp b/src/lsd.cpp
index e5e9b42ad..52dcde289 100644
--- a/src/lsd.cpp
+++ b/src/lsd.cpp
@@ -103,12 +103,12 @@ void lsd::debug_log(char const* fmt, ...) const
 
 void lsd::start(error_code& ec)
 {
-	m_socket.open(std::bind(&lsd::on_announce, self(), _1, _2, _3)
+	m_socket.open(std::bind(&lsd::on_announce, self(), _1, _2)
 		, m_broadcast_timer.get_io_service(), ec);
 	if (ec) return;
 
 #if TORRENT_USE_IPV6
-	m_socket6.open(std::bind(&lsd::on_announce, self(), _1, _2, _3)
+	m_socket6.open(std::bind(&lsd::on_announce, self(), _1, _2)
 		, m_broadcast_timer.get_io_service(), ec);
 #endif
 }
@@ -198,13 +198,12 @@ void lsd::resend_announce(error_code const& e, sha1_hash const& info_hash
 	announce_impl(info_hash, listen_port, false, retry_count);
 }
 
-void lsd::on_announce(udp::endpoint const& from, char const* buf
-	, std::size_t const bytes_transferred)
+void lsd::on_announce(udp::endpoint const& from, span<char const> buf)
 {
 	http_parser p;
 
 	bool error = false;
-	p.incoming({buf, bytes_transferred}, error);
+	p.incoming(buf, error);
 
 	if (!p.header_finished() || error)
 	{
diff --git a/src/upnp.cpp b/src/upnp.cpp
index 9e724b55f..069ca5284 100644
--- a/src/upnp.cpp
+++ b/src/upnp.cpp
@@ -120,7 +120,7 @@ void upnp::start()
 	TORRENT_ASSERT(is_single_thread());
 
 	error_code ec;
-	m_socket.open(std::bind(&upnp::on_reply, self(), _1, _2, _3)
+	m_socket.open(std::bind(&upnp::on_reply, self(), _1, _2)
 		, m_refresh_timer.get_io_service(), ec);
 
 	m_mappings.reserve(10);
@@ -370,8 +370,7 @@ void upnp::resend_request(error_code const& ec)
 	}
 }
 
-void upnp::on_reply(udp::endpoint const& from, char const* buffer
-	, std::size_t const bytes_transferred)
+void upnp::on_reply(udp::endpoint const& from, span<char const> buffer)
 {
 	TORRENT_ASSERT(is_single_thread());
 	std::shared_ptr<upnp> me(self());
@@ -484,7 +483,7 @@ void upnp::on_reply(udp::endpoint const& from, char const* buffer
 
 	http_parser p;
 	bool error = false;
-	p.incoming({buffer, bytes_transferred}, error);
+	p.incoming(buffer, error);
 	if (error)
 	{
 #ifndef TORRENT_DISABLE_LOGGING
diff --git a/test/test_upnp.cpp b/test/test_upnp.cpp
index 581eaaa91..5800eb672 100644
--- a/test/test_upnp.cpp
+++ b/test/test_upnp.cpp
@@ -69,12 +69,11 @@ char const* soap_delete_response[] = {
 	"<s:Body><u:DeletePortMapping xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:2\">"
 	"</u:DeletePortMapping></s:Body></s:Envelope>"};
 
-void incoming_msearch(udp::endpoint const& from, char const* buffer
-	, int size)
+void incoming_msearch(udp::endpoint const& from, span<char const> buffer)
 {
 	http_parser p;
 	bool error = false;
-	p.incoming(span<char const>(buffer, size), error);
+	p.incoming(buffer, error);
 	if (error || !p.header_finished())
 	{
 		std::cout << "*** malformed HTTP from "