Fix some more NULLs by hand

These weren't caught by clang-tidy, either because they're wrapped up in
a macro, or because they're only built on non-Linux. There are also many
NULLs in comments, but I've left those alone. That will take some triage
because sometimes we refer to the ASN.1 NULL value.

Change-Id: I9489943d12975185f605d19a97f2473159be9fd4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/83149
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Lily Chen <chlily@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/bio/file.cc b/crypto/bio/file.cc
index 1c6bbab..91ca48c 100644
--- a/crypto/bio/file.cc
+++ b/crypto/bio/file.cc
@@ -56,7 +56,7 @@
 #else
 static FILE *fopen_if_available(const char *path, const char *mode) {
   errno = ENOENT;
-  return NULL;
+  return nullptr;
 }
 #endif
 
diff --git a/crypto/cpu_aarch64_apple.cc b/crypto/cpu_aarch64_apple.cc
index 8a8183e..24fe16c 100644
--- a/crypto/cpu_aarch64_apple.cc
+++ b/crypto/cpu_aarch64_apple.cc
@@ -24,7 +24,7 @@
 static int has_hw_feature(const char *name) {
   int value;
   size_t len = sizeof(value);
-  if (sysctlbyname(name, &value, &len, NULL, 0) != 0) {
+  if (sysctlbyname(name, &value, &len, nullptr, 0) != 0) {
     return 0;
   }
   if (len != sizeof(int)) {
diff --git a/crypto/cpu_aarch64_openbsd.cc b/crypto/cpu_aarch64_openbsd.cc
index 51e7058..e0b884c 100644
--- a/crypto/cpu_aarch64_openbsd.cc
+++ b/crypto/cpu_aarch64_openbsd.cc
@@ -29,7 +29,7 @@
   uint64_t cpu_id = 0;
   size_t len = sizeof(cpu_id);
 
-  if (sysctl(isar0_mib, 2, &cpu_id, &len, NULL, 0) < 0) {
+  if (sysctl(isar0_mib, 2, &cpu_id, &len, nullptr, 0) < 0) {
     return;
   }
 
diff --git a/crypto/cpu_arm_linux.cc b/crypto/cpu_arm_linux.cc
index 90489f7..7733d18 100644
--- a/crypto/cpu_arm_linux.cc
+++ b/crypto/cpu_arm_linux.cc
@@ -55,7 +55,7 @@
   int ret = 0;
   size_t cap = kReadSize, len = 0;
   char *buf = reinterpret_cast<char *>(OPENSSL_malloc(cap));
-  if (buf == NULL) {
+  if (buf == nullptr) {
     goto err;
   }
 
@@ -66,7 +66,7 @@
         goto err;
       }
       char *new_buf = reinterpret_cast<char *>(OPENSSL_realloc(buf, new_cap));
-      if (new_buf == NULL) {
+      if (new_buf == nullptr) {
         goto err;
       }
       buf = new_buf;
@@ -86,7 +86,7 @@
   *out_ptr = buf;
   *out_len = len;
   ret = 1;
-  buf = NULL;
+  buf = nullptr;
 
 err:
   OPENSSL_free(buf);
@@ -100,7 +100,7 @@
   // We ignore the return value of |read_file| and proceed with an empty
   // /proc/cpuinfo on error. If |getauxval| works, we will still detect
   // capabilities.
-  char *cpuinfo_data = NULL;
+  char *cpuinfo_data = nullptr;
   size_t cpuinfo_len = 0;
   read_file(&cpuinfo_data, &cpuinfo_len, "/proc/cpuinfo");
   STRING_PIECE cpuinfo;
diff --git a/crypto/fipsmodule/bcm.cc b/crypto/fipsmodule/bcm.cc
index e4cd769..daea544 100644
--- a/crypto/fipsmodule/bcm.cc
+++ b/crypto/fipsmodule/bcm.cc
@@ -230,7 +230,7 @@
   HMAC_CTX hmac_ctx;
   HMAC_CTX_init(&hmac_ctx);
   if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), kHashFunction,
-                    NULL /* no ENGINE */)) {
+                    nullptr /* no ENGINE */)) {
     fprintf(CRYPTO_get_stderr(), "HMAC_Init_ex failed.\n");
     return 0;
   }
diff --git a/crypto/fipsmodule/bn/div.cc.inc b/crypto/fipsmodule/bn/div.cc.inc
index 2429591..7cffb32 100644
--- a/crypto/fipsmodule/bn/div.cc.inc
+++ b/crypto/fipsmodule/bn/div.cc.inc
@@ -713,7 +713,7 @@
   // fall back to using |BN_div_word|.
   if (w > ((BN_ULONG)1 << BN_BITS4)) {
     BIGNUM *tmp = BN_dup(a);
-    if (tmp == NULL) {
+    if (tmp == nullptr) {
       return (BN_ULONG)-1;
     }
     ret = BN_div_word(tmp, w);
diff --git a/crypto/fipsmodule/rand/rand.cc.inc b/crypto/fipsmodule/rand/rand.cc.inc
index 753a04a..1b30551 100644
--- a/crypto/fipsmodule/rand/rand.cc.inc
+++ b/crypto/fipsmodule/rand/rand.cc.inc
@@ -71,8 +71,8 @@
 #if defined(BORINGSSL_FIPS)
   // last_block contains the previous block from |get_seed_entropy|.
   uint8_t last_block[CRNGT_BLOCK_SIZE];
-  // next and prev form a NULL-terminated, double-linked list of all states in
-  // a process.
+  // next and prev form a nullptr-terminated, double-linked list of all states
+  // in a process.
   struct rand_thread_state *next, *prev;
   // clear_drbg_lock synchronizes between uses of |drbg| and
   // |rand_thread_state_clear_all| clearing it. This lock should be uncontended
@@ -94,7 +94,7 @@
 static void rand_thread_state_clear_all(void) {
   CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get());
   for (struct rand_thread_state *cur = *thread_states_list_bss_get();
-       cur != NULL; cur = cur->next) {
+       cur != nullptr; cur = cur->next) {
     CRYPTO_MUTEX_lock_write(&cur->clear_drbg_lock);
     CTR_DRBG_clear(&cur->drbg);
   }
@@ -118,16 +118,16 @@
 #if defined(BORINGSSL_FIPS)
   CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get());
 
-  if (state->prev != NULL) {
+  if (state->prev != nullptr) {
     state->prev->next = state->next;
   } else if (*thread_states_list_bss_get() == state) {
-    // |state->prev| may be NULL either if it is the head of the list,
+    // |state->prev| may be nullptr either if it is the head of the list,
     // or if |state| is freed before it was added to the list at all.
     // Compare against the head of the list to distinguish these cases.
     *thread_states_list_bss_get() = state->next;
   }
 
-  if (state->next != NULL) {
+  if (state->next != nullptr) {
     state->next->prev = state->prev;
   }
 
@@ -397,10 +397,10 @@
       CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get());
       struct rand_thread_state **states_list = thread_states_list_bss_get();
       state->next = *states_list;
-      if (state->next != NULL) {
+      if (state->next != nullptr) {
         state->next->prev = state;
       }
-      state->prev = NULL;
+      state->prev = nullptr;
       *states_list = state;
       CRYPTO_MUTEX_unlock_write(thread_states_list_lock_bss_get());
     }
diff --git a/crypto/fipsmodule/service_indicator/service_indicator.cc.inc b/crypto/fipsmodule/service_indicator/service_indicator.cc.inc
index d7ace3a..e1db7e9 100644
--- a/crypto/fipsmodule/service_indicator/service_indicator.cc.inc
+++ b/crypto/fipsmodule/service_indicator/service_indicator.cc.inc
@@ -38,7 +38,7 @@
 };
 
 // service_indicator_get returns a pointer to the |fips_service_indicator_state|
-// for the current thread. It returns NULL on error.
+// for the current thread. It returns nullptr on error.
 //
 // FIPS 140-3 requires that the module should provide the service indicator
 // for approved services irrespective of whether the user queries it or not.
@@ -48,11 +48,11 @@
       reinterpret_cast<fips_service_indicator_state *>(CRYPTO_get_thread_local(
           OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE));
 
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     indicator = reinterpret_cast<fips_service_indicator_state *>(
         OPENSSL_malloc(sizeof(struct fips_service_indicator_state)));
-    if (indicator == NULL) {
-      return NULL;
+    if (indicator == nullptr) {
+      return nullptr;
     }
 
     indicator->lock_state = STATE_UNLOCKED;
@@ -62,7 +62,7 @@
             OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE, indicator,
             OPENSSL_free)) {
       OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
-      return NULL;
+      return nullptr;
     }
   }
 
@@ -71,7 +71,7 @@
 
 static uint64_t service_indicator_get_counter(void) {
   struct fips_service_indicator_state *indicator = service_indicator_get();
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     return 0;
   }
   return indicator->counter;
@@ -94,7 +94,7 @@
 
 void FIPS_service_indicator_lock_state(void) {
   struct fips_service_indicator_state *indicator = service_indicator_get();
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     return;
   }
 
@@ -115,7 +115,7 @@
 
 void FIPS_service_indicator_unlock_state(void) {
   struct fips_service_indicator_state *indicator = service_indicator_get();
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     return;
   }
 
@@ -185,7 +185,7 @@
 
 static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
                                                 int (*md_ok)(int md_type)) {
-  if (EVP_MD_CTX_get0_md(ctx) == NULL) {
+  if (EVP_MD_CTX_get0_md(ctx) == nullptr) {
     // Signature schemes without a prehash are currently never FIPS approved.
     return;
   }
diff --git a/crypto/lhash/internal.h b/crypto/lhash/internal.h
index 5484880..fe510ea 100644
--- a/crypto/lhash/internal.h
+++ b/crypto/lhash/internal.h
@@ -187,7 +187,7 @@
                                                                                \
   inline int lh_##type##_insert(LHASH_OF(type) *lh, type **old_data,           \
                                 type *data) {                                  \
-    void *old_data_void = NULL;                                                \
+    void *old_data_void = nullptr;                                             \
     int ret = OPENSSL_lh_insert((_LHASH *)lh, &old_data_void, data,            \
                                 lh_##type##_call_hash_func,                    \
                                 lh_##type##_call_cmp_func);                    \
diff --git a/crypto/mem.cc b/crypto/mem.cc
index 5001ab3..21faca6 100644
--- a/crypto/mem.cc
+++ b/crypto/mem.cc
@@ -63,7 +63,7 @@
   }
 #else
 #define WEAK_SYMBOL_FUNC(rettype, name, args) \
-  static rettype(*const name) args = NULL;
+  static rettype(*const name) args = nullptr;
 #endif
 
 #if defined(BORINGSSL_DETECT_SDALLOCX)
@@ -121,7 +121,7 @@
 
 static void init_malloc_failure(void) {
   const char *env = getenv("MALLOC_NUMBER_TO_FAIL");
-  if (env != NULL && env[0] != 0) {
+  if (env != nullptr && env[0] != 0) {
     char *endptr;
     malloc_number_to_fail = strtoull(env, &endptr, 10);
     if (*endptr == 0) {
@@ -129,7 +129,7 @@
       atexit(malloc_exit_handler);
     }
   }
-  break_on_malloc_fail = getenv("MALLOC_BREAK_ON_FAIL") != NULL;
+  break_on_malloc_fail = getenv("MALLOC_BREAK_ON_FAIL") != nullptr;
 }
 
 // should_fail_allocation returns one if the current allocation should fail and
diff --git a/crypto/rand/fork_detect.cc b/crypto/rand/fork_detect.cc
index 17e93e9..0f6f5c3 100644
--- a/crypto/rand/fork_detect.cc
+++ b/crypto/rand/fork_detect.cc
@@ -163,7 +163,7 @@
 }
 
 static void init_pthread_fork_detection(void) {
-  if (pthread_atfork(NULL, NULL, we_are_forked) != 0) {
+  if (pthread_atfork(nullptr, nullptr, we_are_forked) != 0) {
     abort();
   }
   g_atfork_fork_generation = 1;
diff --git a/crypto/rand/windows.cc b/crypto/rand/windows.cc
index 42cc981..1916e89 100644
--- a/crypto/rand/windows.cc
+++ b/crypto/rand/windows.cc
@@ -43,7 +43,7 @@
       output_bytes_this_pass = (ULONG)requested;
     }
     if (!BCRYPT_SUCCESS(BCryptGenRandom(
-            /*hAlgorithm=*/NULL, out, output_bytes_this_pass,
+            /*hAlgorithm=*/nullptr, out, output_bytes_this_pass,
             BCRYPT_USE_SYSTEM_PREFERRED_RNG))) {
       abort();
     }
@@ -56,15 +56,15 @@
 
 // See: https://learn.microsoft.com/en-us/windows/win32/seccng/processprng
 typedef BOOL (WINAPI *ProcessPrngFunction)(PBYTE pbData, SIZE_T cbData);
-static ProcessPrngFunction g_processprng_fn = NULL;
+static ProcessPrngFunction g_processprng_fn = nullptr;
 
 static void init_processprng(void) {
   HMODULE hmod = LoadLibraryW(L"bcryptprimitives");
-  if (hmod == NULL) {
+  if (hmod == nullptr) {
     abort();
   }
   g_processprng_fn = (ProcessPrngFunction)GetProcAddress(hmod, "ProcessPrng");
-  if (g_processprng_fn == NULL) {
+  if (g_processprng_fn == nullptr) {
     abort();
   }
 }
diff --git a/crypto/test/abi_test.cc b/crypto/test/abi_test.cc
index 2c300f4..c3c7393 100644
--- a/crypto/test/abi_test.cc
+++ b/crypto/test/abi_test.cc
@@ -698,7 +698,7 @@
   sigemptyset(&trap_action.sa_mask);
   trap_action.sa_flags = SA_SIGINFO;
   trap_action.sa_sigaction = TrapHandler;
-  if (sigaction(SIGTRAP, &trap_action, NULL) != 0) {
+  if (sigaction(SIGTRAP, &trap_action, nullptr) != 0) {
     perror("sigaction");
     abort();
   }
diff --git a/crypto/thread_win.cc b/crypto/thread_win.cc
index 4e22c47..8d7316e 100644
--- a/crypto/thread_win.cc
+++ b/crypto/thread_win.cc
@@ -31,7 +31,7 @@
 }
 
 void CRYPTO_once(CRYPTO_once_t *once, void (*init)(void)) {
-  if (!InitOnceExecuteOnce(once, call_once_init, &init, NULL)) {
+  if (!InitOnceExecuteOnce(once, call_once_init, &init, nullptr)) {
     abort();
   }
 }
@@ -85,7 +85,7 @@
   }
 
   void **pointers = (void **)TlsGetValue(g_thread_local_key);
-  if (pointers == NULL) {
+  if (pointers == nullptr) {
     return;
   }
 
@@ -96,7 +96,7 @@
   ReleaseSRWLockExclusive(&g_destructors_lock);
 
   for (unsigned i = 0; i < NUM_OPENSSL_THREAD_LOCALS; i++) {
-    if (destructors[i] != NULL) {
+    if (destructors[i] != nullptr) {
       destructors[i](pointers[i]);
     }
   }
@@ -193,12 +193,12 @@
 void *CRYPTO_get_thread_local(thread_local_data_t index) {
   CRYPTO_once(&g_thread_local_init_once, thread_local_init);
   if (g_thread_local_failed) {
-    return NULL;
+    return nullptr;
   }
 
   void **pointers = get_thread_locals();
-  if (pointers == NULL) {
-    return NULL;
+  if (pointers == nullptr) {
+    return nullptr;
   }
   return pointers[index];
 }
@@ -212,10 +212,10 @@
   }
 
   void **pointers = get_thread_locals();
-  if (pointers == NULL) {
+  if (pointers == nullptr) {
     pointers = reinterpret_cast<void **>(
         malloc(sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS));
-    if (pointers == NULL) {
+    if (pointers == nullptr) {
       destructor(value);
       return 0;
     }
diff --git a/crypto/x509/v3_bitst.cc b/crypto/x509/v3_bitst.cc
index 57cdbec..3f629d2 100644
--- a/crypto/x509/v3_bitst.cc
+++ b/crypto/x509/v3_bitst.cc
@@ -88,7 +88,8 @@
 #define EXT_BITSTRING(nid, table)                                             \
   {                                                                           \
     nid, 0, ASN1_ITEM_ref(ASN1_BIT_STRING), 0, 0, 0, 0, 0, 0,                 \
-        i2v_ASN1_BIT_STRING, v2i_ASN1_BIT_STRING, NULL, NULL, (void *)(table) \
+        i2v_ASN1_BIT_STRING, v2i_ASN1_BIT_STRING, nullptr, nullptr,           \
+    (void *)(table)                                                           \
   }
 
 const X509V3_EXT_METHOD v3_nscert =
diff --git a/crypto/x509/v3_ia5.cc b/crypto/x509/v3_ia5.cc
index f0702d9..e950aac 100644
--- a/crypto/x509/v3_ia5.cc
+++ b/crypto/x509/v3_ia5.cc
@@ -62,7 +62,7 @@
 #define EXT_IA5STRING(nid)                                                 \
   {                                                                        \
     nid, 0, ASN1_ITEM_ref(ASN1_IA5STRING), 0, 0, 0, 0, i2s_ASN1_IA5STRING, \
-        s2i_ASN1_IA5STRING, 0, 0, 0, 0, NULL                               \
+        s2i_ASN1_IA5STRING, 0, 0, 0, 0, nullptr                            \
   }
 
 const X509V3_EXT_METHOD v3_netscape_base_url =
diff --git a/crypto/x509/x_all.cc b/crypto/x509/x_all.cc
index 064487b..d477112 100644
--- a/crypto/x509/x_all.cc
+++ b/crypto/x509/x_all.cc
@@ -157,8 +157,8 @@
 #define IMPLEMENT_D2I_FP(type, name, bio_func) \
   type *name(FILE *fp, type **obj) {           \
     BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE);    \
-    if (bio == NULL) {                         \
-      return NULL;                             \
+    if (bio == nullptr) {                      \
+      return nullptr;                          \
     }                                          \
     type *ret = bio_func(bio, obj);            \
     BIO_free(bio);                             \
@@ -168,7 +168,7 @@
 #define IMPLEMENT_I2D_FP(type, name, bio_func) \
   int name(FILE *fp, const type *obj) {        \
     BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE);    \
-    if (bio == NULL) {                         \
+    if (bio == nullptr) {                      \
       return 0;                                \
     }                                          \
     int ret = bio_func(bio, obj);              \
@@ -193,7 +193,7 @@
     uint8_t *data;                                      \
     size_t len;                                         \
     if (!BIO_read_asn1(bio, &data, &len, 100 * 1024)) { \
-      return NULL;                                      \
+      return nullptr;                                   \
     }                                                   \
     const uint8_t *ptr = data;                          \
     type *ret = d2i_func(obj, &ptr, (long)len);         \
@@ -203,7 +203,7 @@
 
 #define IMPLEMENT_I2D_BIO(type, name, i2d_func) \
   int name(BIO *bio, const type *obj) {         \
-    uint8_t *data = NULL;                       \
+    uint8_t *data = nullptr;                    \
     int len = i2d_func(obj, &data);             \
     if (len < 0) {                              \
       return 0;                                 \