diff --git a/crypto/bio/file.cc b/crypto/bio/file.cc
index 1c6bbab..91ca48c 100644
--- a/crypto/bio/file.cc
+++ b/crypto/bio/file.cc

@@ -56,7 +56,7 @@
 #else
 static FILE *fopen_if_available(const char *path, const char *mode) {
   errno = ENOENT;
-  return NULL;
+  return nullptr;
 }
 #endif
 

diff --git a/crypto/cpu_aarch64_apple.cc b/crypto/cpu_aarch64_apple.cc
index 8a8183e..24fe16c 100644
--- a/crypto/cpu_aarch64_apple.cc
+++ b/crypto/cpu_aarch64_apple.cc

@@ -24,7 +24,7 @@
 static int has_hw_feature(const char *name) {
   int value;
   size_t len = sizeof(value);
-  if (sysctlbyname(name, &value, &len, NULL, 0) != 0) {
+  if (sysctlbyname(name, &value, &len, nullptr, 0) != 0) {
     return 0;
   }
   if (len != sizeof(int)) {

diff --git a/crypto/cpu_aarch64_openbsd.cc b/crypto/cpu_aarch64_openbsd.cc
index 51e7058..e0b884c 100644
--- a/crypto/cpu_aarch64_openbsd.cc
+++ b/crypto/cpu_aarch64_openbsd.cc

@@ -29,7 +29,7 @@
   uint64_t cpu_id = 0;
   size_t len = sizeof(cpu_id);
 
-  if (sysctl(isar0_mib, 2, &cpu_id, &len, NULL, 0) < 0) {
+  if (sysctl(isar0_mib, 2, &cpu_id, &len, nullptr, 0) < 0) {
     return;
   }
 

diff --git a/crypto/cpu_arm_linux.cc b/crypto/cpu_arm_linux.cc
index 90489f7..7733d18 100644
--- a/crypto/cpu_arm_linux.cc
+++ b/crypto/cpu_arm_linux.cc

@@ -55,7 +55,7 @@
   int ret = 0;
   size_t cap = kReadSize, len = 0;
   char *buf = reinterpret_cast<char *>(OPENSSL_malloc(cap));
-  if (buf == NULL) {
+  if (buf == nullptr) {
     goto err;
   }
 
@@ -66,7 +66,7 @@
         goto err;
       }
       char *new_buf = reinterpret_cast<char *>(OPENSSL_realloc(buf, new_cap));
-      if (new_buf == NULL) {
+      if (new_buf == nullptr) {
         goto err;
       }
       buf = new_buf;
@@ -86,7 +86,7 @@
   *out_ptr = buf;
   *out_len = len;
   ret = 1;
-  buf = NULL;
+  buf = nullptr;
 
 err:
   OPENSSL_free(buf);
@@ -100,7 +100,7 @@
   // We ignore the return value of |read_file| and proceed with an empty
   // /proc/cpuinfo on error. If |getauxval| works, we will still detect
   // capabilities.
-  char *cpuinfo_data = NULL;
+  char *cpuinfo_data = nullptr;
   size_t cpuinfo_len = 0;
   read_file(&cpuinfo_data, &cpuinfo_len, "/proc/cpuinfo");
   STRING_PIECE cpuinfo;

diff --git a/crypto/fipsmodule/aes/cbc.cc.inc b/crypto/fipsmodule/aes/cbc.cc.inc
index eec324a..97bcc32 100644
--- a/crypto/fipsmodule/aes/cbc.cc.inc
+++ b/crypto/fipsmodule/aes/cbc.cc.inc

@@ -22,13 +22,13 @@
 void CRYPTO_cbc128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                            const AES_KEY *key, uint8_t ivec[16],
                            block128_f block) {
-  assert(key != NULL && ivec != NULL);
+  assert(key != nullptr && ivec != nullptr);
   if (len == 0) {
     // Avoid |ivec| == |iv| in the |memcpy| below, which is not legal in C.
     return;
   }
 
-  assert(in != NULL && out != NULL);
+  assert(in != nullptr && out != nullptr);
   size_t n;
   const uint8_t *iv = ivec;
   while (len >= 16) {
@@ -63,13 +63,13 @@
 void CRYPTO_cbc128_decrypt(const uint8_t *in, uint8_t *out, size_t len,
                            const AES_KEY *key, uint8_t ivec[16],
                            block128_f block) {
-  assert(key != NULL && ivec != NULL);
+  assert(key != nullptr && ivec != nullptr);
   if (len == 0) {
     // Avoid |ivec| == |iv| in the |memcpy| below, which is not legal in C.
     return;
   }
 
-  assert(in != NULL && out != NULL);
+  assert(in != nullptr && out != nullptr);
 
   const uintptr_t inptr = (uintptr_t) in;
   const uintptr_t outptr = (uintptr_t) out;

diff --git a/crypto/fipsmodule/aes/gcm.cc.inc b/crypto/fipsmodule/aes/gcm.cc.inc
index 30855ee..918cbef 100644
--- a/crypto/fipsmodule/aes/gcm.cc.inc
+++ b/crypto/fipsmodule/aes/gcm.cc.inc

@@ -589,7 +589,7 @@
 
 void CRYPTO_gcm128_tag(const GCM128_KEY *key, GCM128_CONTEXT *ctx, uint8_t *tag,
                        size_t len) {
-  CRYPTO_gcm128_finish(key, ctx, NULL, 0);
+  CRYPTO_gcm128_finish(key, ctx, nullptr, 0);
   OPENSSL_memcpy(tag, ctx->Xi, len <= sizeof(ctx->Xi) ? len : sizeof(ctx->Xi));
 }
 

diff --git a/crypto/fipsmodule/aes/key_wrap.cc.inc b/crypto/fipsmodule/aes/key_wrap.cc.inc
index ad1c314..5c8acb7 100644
--- a/crypto/fipsmodule/aes/key_wrap.cc.inc
+++ b/crypto/fipsmodule/aes/key_wrap.cc.inc

@@ -41,7 +41,7 @@
     return -1;
   }
 
-  if (iv == NULL) {
+  if (iv == nullptr) {
     iv = kDefaultIV;
   }
 
@@ -113,7 +113,7 @@
     return -1;
   }
 
-  if (iv == NULL) {
+  if (iv == nullptr) {
     iv = kDefaultIV;
   }
   if (CRYPTO_memcmp(calculated_iv, iv, 8) != 0) {
@@ -152,7 +152,7 @@
   }
 
   uint8_t *padded_in = reinterpret_cast<uint8_t *>(OPENSSL_malloc(padded_len));
-  if (padded_in == NULL) {
+  if (padded_in == nullptr) {
     return 0;
   }
   assert(padded_len >= 8);

diff --git a/crypto/fipsmodule/aes/ofb.cc.inc b/crypto/fipsmodule/aes/ofb.cc.inc
index 7a6834a..df981f0 100644
--- a/crypto/fipsmodule/aes/ofb.cc.inc
+++ b/crypto/fipsmodule/aes/ofb.cc.inc

@@ -23,8 +23,8 @@
 void CRYPTO_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                            const AES_KEY *key, uint8_t ivec[16], unsigned *num,
                            block128_f block) {
-  assert(key != NULL && ivec != NULL && num != NULL);
-  assert(len == 0 || (in != NULL && out != NULL));
+  assert(key != nullptr && ivec != nullptr && num != nullptr);
+  assert(len == 0 || (in != nullptr && out != nullptr));
 
   unsigned n = *num;
 

diff --git a/crypto/fipsmodule/bcm.cc b/crypto/fipsmodule/bcm.cc
index e4cd769..daea544 100644
--- a/crypto/fipsmodule/bcm.cc
+++ b/crypto/fipsmodule/bcm.cc

@@ -230,7 +230,7 @@
   HMAC_CTX hmac_ctx;
   HMAC_CTX_init(&hmac_ctx);
   if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), kHashFunction,
-                    NULL /* no ENGINE */)) {
+                    nullptr /* no ENGINE */)) {
     fprintf(CRYPTO_get_stderr(), "HMAC_Init_ex failed.\n");
     return 0;
   }

diff --git a/crypto/fipsmodule/bn/bn.cc.inc b/crypto/fipsmodule/bn/bn.cc.inc
index 83ee833..c57db0e 100644
--- a/crypto/fipsmodule/bn/bn.cc.inc
+++ b/crypto/fipsmodule/bn/bn.cc.inc

@@ -33,8 +33,8 @@
 BIGNUM *BN_new(void) {
   BIGNUM *bn = reinterpret_cast<BIGNUM *>(OPENSSL_malloc(sizeof(BIGNUM)));
 
-  if (bn == NULL) {
-    return NULL;
+  if (bn == nullptr) {
+    return nullptr;
   }
 
   OPENSSL_memset(bn, 0, sizeof(BIGNUM));
@@ -48,7 +48,7 @@
 void BN_init(BIGNUM *bn) { OPENSSL_memset(bn, 0, sizeof(BIGNUM)); }
 
 void BN_free(BIGNUM *bn) {
-  if (bn == NULL) {
+  if (bn == nullptr) {
     return;
   }
 
@@ -59,7 +59,7 @@
   if (bn->flags & BN_FLG_MALLOCED) {
     OPENSSL_free(bn);
   } else {
-    bn->d = NULL;
+    bn->d = nullptr;
   }
 }
 
@@ -68,18 +68,18 @@
 BIGNUM *BN_dup(const BIGNUM *src) {
   BIGNUM *copy;
 
-  if (src == NULL) {
-    return NULL;
+  if (src == nullptr) {
+    return nullptr;
   }
 
   copy = BN_new();
-  if (copy == NULL) {
-    return NULL;
+  if (copy == nullptr) {
+    return nullptr;
   }
 
   if (!BN_copy(copy, src)) {
     BN_free(copy);
-    return NULL;
+    return nullptr;
   }
 
   return copy;
@@ -91,7 +91,7 @@
   }
 
   if (!bn_wexpand(dest, src->width)) {
-    return NULL;
+    return nullptr;
   }
 
   OPENSSL_memcpy(dest->d, src->d, sizeof(src->d[0]) * src->width);
@@ -102,7 +102,7 @@
 }
 
 void BN_clear(BIGNUM *bn) {
-  if (bn->d != NULL) {
+  if (bn->d != nullptr) {
     OPENSSL_memset(bn->d, 0, bn->dmax * sizeof(bn->d[0]));
   }
 
@@ -308,7 +308,7 @@
   }
 
   a = reinterpret_cast<BN_ULONG *>(OPENSSL_calloc(words, sizeof(BN_ULONG)));
-  if (a == NULL) {
+  if (a == nullptr) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/bn/bytes.cc.inc b/crypto/fipsmodule/bn/bytes.cc.inc
index b5066ea..fad749a 100644
--- a/crypto/fipsmodule/bn/bytes.cc.inc
+++ b/crypto/fipsmodule/bn/bytes.cc.inc

@@ -49,11 +49,11 @@
 }
 
 BIGNUM *BN_bin2bn(const uint8_t *in, size_t len, BIGNUM *ret) {
-  BIGNUM *bn = NULL;
-  if (ret == NULL) {
+  BIGNUM *bn = nullptr;
+  if (ret == nullptr) {
     bn = BN_new();
-    if (bn == NULL) {
-      return NULL;
+    if (bn == nullptr) {
+      return nullptr;
     }
     ret = bn;
   }
@@ -66,7 +66,7 @@
   size_t num_words = ((len - 1) / BN_BYTES) + 1;
   if (!bn_wexpand(ret, num_words)) {
     BN_free(bn);
-    return NULL;
+    return nullptr;
   }
 
   // |bn_wexpand| must check bounds on |num_words| to write it into
@@ -80,11 +80,11 @@
 }
 
 BIGNUM *BN_lebin2bn(const uint8_t *in, size_t len, BIGNUM *ret) {
-  BIGNUM *bn = NULL;
-  if (ret == NULL) {
+  BIGNUM *bn = nullptr;
+  if (ret == nullptr) {
     bn = BN_new();
-    if (bn == NULL) {
-      return NULL;
+    if (bn == nullptr) {
+      return nullptr;
     }
     ret = bn;
   }
@@ -99,7 +99,7 @@
   size_t num_words = ((len - 1) / BN_BYTES) + 1;
   if (!bn_wexpand(ret, num_words)) {
     BN_free(bn);
-    return NULL;
+    return nullptr;
   }
   ret->width = (int)num_words;
 

diff --git a/crypto/fipsmodule/bn/cmp.cc.inc b/crypto/fipsmodule/bn/cmp.cc.inc
index d60beca..8ef79c6 100644
--- a/crypto/fipsmodule/bn/cmp.cc.inc
+++ b/crypto/fipsmodule/bn/cmp.cc.inc

@@ -59,10 +59,10 @@
 }
 
 int BN_cmp(const BIGNUM *a, const BIGNUM *b) {
-  if ((a == NULL) || (b == NULL)) {
-    if (a != NULL) {
+  if ((a == nullptr) || (b == nullptr)) {
+    if (a != nullptr) {
       return -1;
-    } else if (b != NULL) {
+    } else if (b != nullptr) {
       return 1;
     } else {
       return 0;

diff --git a/crypto/fipsmodule/bn/div.cc.inc b/crypto/fipsmodule/bn/div.cc.inc
index a29bf9c..7cffb32 100644
--- a/crypto/fipsmodule/bn/div.cc.inc
+++ b/crypto/fipsmodule/bn/div.cc.inc

@@ -170,10 +170,10 @@
   BIGNUM *tmp = BN_CTX_get(ctx);
   BIGNUM *snum = BN_CTX_get(ctx);
   BIGNUM *sdiv = BN_CTX_get(ctx);
-  BIGNUM *res = quotient == NULL ? BN_CTX_get(ctx) : quotient;
+  BIGNUM *res = quotient == nullptr ? BN_CTX_get(ctx) : quotient;
   int norm_shift, num_n, loop, div_n;
   BN_ULONG d0, d1;
-  if (tmp == NULL || snum == NULL || sdiv == NULL || res == NULL) {
+  if (tmp == nullptr || snum == nullptr || sdiv == nullptr || res == nullptr) {
     return 0;
   }
 
@@ -330,7 +330,7 @@
   bn_set_minimal_width(res);
 
   // Knuth step D8: Unnormalize. snum now contains the remainder.
-  if (rem != NULL && !BN_rshift(rem, snum, norm_shift)) {
+  if (rem != nullptr && !BN_rshift(rem, snum, norm_shift)) {
     return 0;
   }
 
@@ -412,15 +412,15 @@
 
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *q = quotient, *r = remainder;
-  if (quotient == NULL || quotient == numerator || quotient == divisor) {
+  if (quotient == nullptr || quotient == numerator || quotient == divisor) {
     q = BN_CTX_get(ctx);
   }
-  if (remainder == NULL || remainder == numerator || remainder == divisor) {
+  if (remainder == nullptr || remainder == numerator || remainder == divisor) {
     r = BN_CTX_get(ctx);
   }
   BIGNUM *tmp = BN_CTX_get(ctx);
   int initial_words;
-  if (q == NULL || r == NULL || tmp == NULL ||
+  if (q == nullptr || r == nullptr || tmp == nullptr ||
       !bn_wexpand(q, numerator->width) || !bn_wexpand(r, divisor->width) ||
       !bn_wexpand(tmp, divisor->width)) {
     return 0;
@@ -472,8 +472,8 @@
     }
   }
 
-  if ((quotient != NULL && !BN_copy(quotient, q)) ||
-      (remainder != NULL && !BN_copy(remainder, r))) {
+  if ((quotient != nullptr && !BN_copy(quotient, q)) ||
+      (remainder != nullptr && !BN_copy(remainder, r))) {
     return 0;
   }
 
@@ -482,8 +482,8 @@
 
 static BIGNUM *bn_scratch_space_from_ctx(size_t width, BN_CTX *ctx) {
   BIGNUM *ret = BN_CTX_get(ctx);
-  if (ret == NULL || !bn_wexpand(ret, width)) {
-    return NULL;
+  if (ret == nullptr || !bn_wexpand(ret, width)) {
+    return nullptr;
   }
   ret->neg = 0;
   ret->width = (int)width;
@@ -503,8 +503,8 @@
     return bn;
   }
   BIGNUM *ret = bn_scratch_space_from_ctx(width, ctx);
-  if (ret == NULL || !BN_copy(ret, bn) || !bn_resize_words(ret, width)) {
-    return NULL;
+  if (ret == nullptr || !BN_copy(ret, bn) || !bn_resize_words(ret, width)) {
+    return nullptr;
   }
   return ret;
 }
@@ -573,7 +573,7 @@
                BN_CTX *ctx) {
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *t = BN_CTX_get(ctx);
-  if (t == NULL) {
+  if (t == nullptr) {
     return 0;
   }
 
@@ -713,7 +713,7 @@
   // fall back to using |BN_div_word|.
   if (w > ((BN_ULONG)1 << BN_BITS4)) {
     BIGNUM *tmp = BN_dup(a);
-    if (tmp == NULL) {
+    if (tmp == nullptr) {
       return (BN_ULONG)-1;
     }
     ret = BN_div_word(tmp, w);

diff --git a/crypto/fipsmodule/bn/exponentiation.cc.inc b/crypto/fipsmodule/bn/exponentiation.cc.inc
index e537476..3f36756 100644
--- a/crypto/fipsmodule/bn/exponentiation.cc.inc
+++ b/crypto/fipsmodule/bn/exponentiation.cc.inc

@@ -154,7 +154,7 @@
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *r = BN_CTX_get(ctx);
   val[0] = BN_CTX_get(ctx);
-  if (r == NULL || val[0] == NULL) {
+  if (r == nullptr || val[0] == nullptr) {
     return 0;
   }
 
@@ -178,12 +178,12 @@
   }
   if (window > 1) {
     BIGNUM *d = BN_CTX_get(ctx);
-    if (d == NULL || !BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx)) {
+    if (d == nullptr || !BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx)) {
       return 0;
     }
     for (int i = 1; i < 1 << (window - 1); i++) {
       val[i] = BN_CTX_get(ctx);
-      if (val[i] == NULL ||
+      if (val[i] == nullptr ||
           !BN_mod_mul_montgomery(val[i], val[i - 1], d, mont, ctx)) {
         return 0;
       }
@@ -414,9 +414,9 @@
                               const BN_MONT_CTX *mont) {
   int i, ret = 0, wvalue;
 
-  void *powerbuf_free = NULL;
+  void *powerbuf_free = nullptr;
   size_t powerbuf_len = 0;
-  BN_ULONG *powerbuf = NULL;
+  BN_ULONG *powerbuf = nullptr;
 
   if (!BN_is_odd(m)) {
     OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
@@ -516,11 +516,11 @@
     powerbuf = storage;
   }
   // |storage| is more than large enough to handle 1024-bit inputs.
-  assert(powerbuf != NULL || top * BN_BITS2 > 1024);
+  assert(powerbuf != nullptr || top * BN_BITS2 > 1024);
 #endif
-  if (powerbuf == NULL) {
+  if (powerbuf == nullptr) {
     powerbuf_free = OPENSSL_malloc(powerbuf_len + MOD_EXP_CTIME_ALIGN);
-    if (powerbuf_free == NULL) {
+    if (powerbuf_free == nullptr) {
       goto err;
     }
     powerbuf = reinterpret_cast<BN_ULONG *>(
@@ -731,7 +731,7 @@
   ret = 1;
 
 err:
-  if (powerbuf != NULL && powerbuf_free == NULL) {
+  if (powerbuf != nullptr && powerbuf_free == nullptr) {
     OPENSSL_cleanse(powerbuf, powerbuf_len);
   }
   OPENSSL_free(powerbuf_free);

diff --git a/crypto/fipsmodule/bn/gcd.cc.inc b/crypto/fipsmodule/bn/gcd.cc.inc
index e876c4d..907592f 100644
--- a/crypto/fipsmodule/bn/gcd.cc.inc
+++ b/crypto/fipsmodule/bn/gcd.cc.inc

@@ -40,12 +40,12 @@
   BIGNUM *X = BN_CTX_get(ctx);
   BIGNUM *Y = BN_CTX_get(ctx);
   BIGNUM *R = out;
-  if (Y == NULL) {
+  if (Y == nullptr) {
     return 0;
   }
 
   BN_zero(Y);
-  if (!BN_one(X) || BN_copy(B, a) == NULL || BN_copy(A, n) == NULL) {
+  if (!BN_one(X) || BN_copy(B, a) == nullptr || BN_copy(A, n) == nullptr) {
     return 0;
   }
   A->neg = 0;

diff --git a/crypto/fipsmodule/bn/jacobi.cc.inc b/crypto/fipsmodule/bn/jacobi.cc.inc
index 1c1c51f..2c90f8c 100644
--- a/crypto/fipsmodule/bn/jacobi.cc.inc
+++ b/crypto/fipsmodule/bn/jacobi.cc.inc

@@ -45,7 +45,7 @@
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *A = BN_CTX_get(ctx);
   BIGNUM *B = BN_CTX_get(ctx);
-  if (B == NULL) {
+  if (B == nullptr) {
     return -2;
   }
 

diff --git a/crypto/fipsmodule/bn/montgomery.cc.inc b/crypto/fipsmodule/bn/montgomery.cc.inc
index b3d7107..26f311a 100644
--- a/crypto/fipsmodule/bn/montgomery.cc.inc
+++ b/crypto/fipsmodule/bn/montgomery.cc.inc

@@ -40,8 +40,8 @@
 BN_MONT_CTX *BN_MONT_CTX_new(void) {
   BN_MONT_CTX *ret =
       reinterpret_cast<BN_MONT_CTX *>(OPENSSL_malloc(sizeof(BN_MONT_CTX)));
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   bn_mont_ctx_init(ret);
@@ -62,7 +62,7 @@
   }
 
   if (!BN_copy(&to->RR, &from->RR) || !BN_copy(&to->N, &from->N)) {
-    return NULL;
+    return nullptr;
   }
   for (size_t i = 0; i < BN_MONT_CTX_N0_LIMBS; i++) {
     to->n0[i] = from->n0[i];
@@ -121,10 +121,10 @@
     return 0;
   }
 
-  BN_CTX *new_ctx = NULL;
-  if (ctx == NULL) {
+  BN_CTX *new_ctx = nullptr;
+  if (ctx == nullptr) {
     new_ctx = BN_CTX_new();
-    if (new_ctx == NULL) {
+    if (new_ctx == nullptr) {
       return 0;
     }
     ctx = new_ctx;
@@ -146,19 +146,19 @@
 
 BN_MONT_CTX *BN_MONT_CTX_new_for_modulus(const BIGNUM *mod, BN_CTX *ctx) {
   BN_MONT_CTX *mont = BN_MONT_CTX_new();
-  if (mont == NULL || !BN_MONT_CTX_set(mont, mod, ctx)) {
+  if (mont == nullptr || !BN_MONT_CTX_set(mont, mod, ctx)) {
     BN_MONT_CTX_free(mont);
-    return NULL;
+    return nullptr;
   }
   return mont;
 }
 
 BN_MONT_CTX *BN_MONT_CTX_new_consttime(const BIGNUM *mod, BN_CTX *ctx) {
   BN_MONT_CTX *mont = BN_MONT_CTX_new();
-  if (mont == NULL || !bn_mont_ctx_set_N_and_n0(mont, mod) ||
+  if (mont == nullptr || !bn_mont_ctx_set_N_and_n0(mont, mod) ||
       !bn_mont_ctx_set_RR_consttime(mont, ctx)) {
     BN_MONT_CTX_free(mont);
-    return NULL;
+    return nullptr;
   }
   return mont;
 }
@@ -174,10 +174,10 @@
   }
 
   CRYPTO_MUTEX_lock_write(lock);
-  if (*pmont == NULL) {
+  if (*pmont == nullptr) {
     *pmont = BN_MONT_CTX_new_for_modulus(mod, bn_ctx);
   }
-  const int ok = *pmont != NULL;
+  const int ok = *pmont != nullptr;
   CRYPTO_MUTEX_unlock_write(lock);
   return ok;
 }
@@ -242,7 +242,7 @@
                        BN_CTX *ctx) {
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *t = BN_CTX_get(ctx);
-  if (t == NULL || !BN_copy(t, a)) {
+  if (t == nullptr || !BN_copy(t, a)) {
     return 0;
   }
 
@@ -275,7 +275,7 @@
                                           BN_CTX *ctx) {
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  if (tmp == NULL) {
+  if (tmp == nullptr) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/bn/mul.cc.inc b/crypto/fipsmodule/bn/mul.cc.inc
index e33fb48..f98b886 100644
--- a/crypto/fipsmodule/bn/mul.cc.inc
+++ b/crypto/fipsmodule/bn/mul.cc.inc

@@ -158,7 +158,7 @@
   bssl::BN_CTXScope scope(ctx);
   if (r == a || r == b) {
     rr = BN_CTX_get(ctx);
-    if (rr == NULL) {
+    if (rr == nullptr) {
       return 0;
     }
   } else {

diff --git a/crypto/fipsmodule/bn/prime.cc.inc b/crypto/fipsmodule/bn/prime.cc.inc
index cf9c203..42f0dd2 100644
--- a/crypto/fipsmodule/bn/prime.cc.inc
+++ b/crypto/fipsmodule/bn/prime.cc.inc

@@ -317,7 +317,7 @@
 
 loop:
   // make a random number and set the top and bottom bits
-  if (add == NULL) {
+  if (add == nullptr) {
     if (!probable_prime(ret, bits)) {
       return 0;
     }
@@ -358,14 +358,14 @@
     // TODO(davidben): This doesn't quite work because an iteration count of 1
     // still runs the blinding mechanism.
     for (i = 0; i < checks; i++) {
-      j = BN_is_prime_fasttest_ex(ret, 1, ctx.get(), 0, NULL);
+      j = BN_is_prime_fasttest_ex(ret, 1, ctx.get(), 0, nullptr);
       if (j == -1) {
         return 0;
       } else if (j == 0) {
         goto loop;
       }
 
-      j = BN_is_prime_fasttest_ex(t, 1, ctx.get(), 0, NULL);
+      j = BN_is_prime_fasttest_ex(t, 1, ctx.get(), 0, nullptr);
       if (j == -1) {
         return 0;
       } else if (j == 0) {
@@ -412,10 +412,10 @@
   miller_rabin->m = BN_CTX_get(ctx);
   miller_rabin->one_mont = BN_CTX_get(ctx);
   miller_rabin->w1_mont = BN_CTX_get(ctx);
-  if (miller_rabin->w1 == NULL ||        //
-      miller_rabin->m == NULL ||         //
-      miller_rabin->one_mont == NULL ||  //
-      miller_rabin->w1_mont == NULL) {
+  if (miller_rabin->w1 == nullptr ||        //
+      miller_rabin->m == nullptr ||         //
+      miller_rabin->one_mont == nullptr ||  //
+      miller_rabin->w1_mont == nullptr) {
     return 0;
   }
 
@@ -452,7 +452,7 @@
   const BIGNUM *w = &mont->N;
   BIGNUM *z = BN_CTX_get(ctx);
   crypto_word_t is_possibly_prime;
-  if (z == NULL ||
+  if (z == nullptr ||
       !BN_mod_exp_mont_consttime(z, b, miller_rabin->m, w, ctx, mont) ||
       !BN_to_montgomery(z, z, mont, ctx)) {
     return 0;
@@ -866,7 +866,7 @@
   BIGNUM *t1 = BN_CTX_get(ctx);
   BIGNUM *q = BN_CTX_get(ctx);
   BIGNUM *qadd = BN_CTX_get(ctx);
-  if (qadd == NULL) {
+  if (qadd == nullptr) {
     return 0;
   }
 
@@ -887,7 +887,7 @@
     return 0;
   }
 
-  if (rem == NULL) {
+  if (rem == nullptr) {
     if (!BN_add_word(q, 1)) {
       return 0;
     }

diff --git a/crypto/fipsmodule/bn/random.cc.inc b/crypto/fipsmodule/bn/random.cc.inc
index 2099335..5c56599 100644
--- a/crypto/fipsmodule/bn/random.cc.inc
+++ b/crypto/fipsmodule/bn/random.cc.inc

@@ -27,7 +27,7 @@
 
 
 int BN_rand(BIGNUM *rnd, int bits, int top, int bottom) {
-  if (rnd == NULL) {
+  if (rnd == nullptr) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/bn/shift.cc.inc b/crypto/fipsmodule/bn/shift.cc.inc
index 491c796..cd7dac9 100644
--- a/crypto/fipsmodule/bn/shift.cc.inc
+++ b/crypto/fipsmodule/bn/shift.cc.inc

@@ -132,7 +132,7 @@
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
   unsigned max_bits;
-  if (tmp == NULL || !BN_copy(r, a) || !bn_wexpand(tmp, r->width)) {
+  if (tmp == nullptr || !BN_copy(r, a) || !bn_wexpand(tmp, r->width)) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/bn/sqrt.cc.inc b/crypto/fipsmodule/bn/sqrt.cc.inc
index 9b76788..05b815d 100644
--- a/crypto/fipsmodule/bn/sqrt.cc.inc
+++ b/crypto/fipsmodule/bn/sqrt.cc.inc

@@ -32,33 +32,31 @@
 
   if (!BN_is_odd(p) || BN_abs_is_word(p, 1)) {
     if (BN_abs_is_word(p, 2)) {
-      if (ret == NULL) {
+      if (ret == nullptr) {
         ret = BN_new();
       }
-      if (ret == NULL ||
-          !BN_set_word(ret, BN_is_bit_set(a, 0))) {
+      if (ret == nullptr || !BN_set_word(ret, BN_is_bit_set(a, 0))) {
         if (ret != in) {
           BN_free(ret);
         }
-        return NULL;
+        return nullptr;
       }
       return ret;
     }
 
     OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
-    return NULL;
+    return nullptr;
   }
 
   if (BN_is_zero(a) || BN_is_one(a)) {
-    if (ret == NULL) {
+    if (ret == nullptr) {
       ret = BN_new();
     }
-    if (ret == NULL ||
-        !BN_set_word(ret, BN_is_one(a))) {
+    if (ret == nullptr || !BN_set_word(ret, BN_is_one(a))) {
       if (ret != in) {
         BN_free(ret);
       }
-      return NULL;
+      return nullptr;
     }
     return ret;
   }
@@ -70,14 +68,14 @@
   t = BN_CTX_get(ctx);
   x = BN_CTX_get(ctx);
   y = BN_CTX_get(ctx);
-  if (y == NULL) {
+  if (y == nullptr) {
     goto end;
   }
 
-  if (ret == NULL) {
+  if (ret == nullptr) {
     ret = BN_new();
   }
-  if (ret == NULL) {
+  if (ret == nullptr) {
     goto end;
   }
 
@@ -104,8 +102,7 @@
       goto end;
     }
     q->neg = 0;
-    if (!BN_add_word(q, 1) ||
-        !BN_mod_exp_mont(ret, A, q, p, ctx, NULL)) {
+    if (!BN_add_word(q, 1) || !BN_mod_exp_mont(ret, A, q, p, ctx, nullptr)) {
       goto end;
     }
     err = 0;
@@ -149,7 +146,7 @@
       goto end;
     }
     q->neg = 0;
-    if (!BN_mod_exp_mont(b, t, q, p, ctx, NULL)) {
+    if (!BN_mod_exp_mont(b, t, q, p, ctx, nullptr)) {
       goto end;
     }
 
@@ -224,7 +221,7 @@
 
   // Now that we have some non-square, we can find an element
   // of order  2^e  by computing its q'th power.
-  if (!BN_mod_exp_mont(y, y, q, p, ctx, NULL)) {
+  if (!BN_mod_exp_mont(y, y, q, p, ctx, nullptr)) {
     goto end;
   }
   if (BN_is_one(y)) {
@@ -268,7 +265,7 @@
       goto end;
     }
   } else {
-    if (!BN_mod_exp_mont(x, A, t, p, ctx, NULL)) {
+    if (!BN_mod_exp_mont(x, A, t, p, ctx, nullptr)) {
       goto end;
     }
     if (BN_is_zero(x)) {
@@ -365,7 +362,7 @@
     if (ret != in) {
       BN_clear_free(ret);
     }
-    ret = NULL;
+    ret = nullptr;
   }
   return ret;
 }

diff --git a/crypto/fipsmodule/cipher/aead.cc.inc b/crypto/fipsmodule/cipher/aead.cc.inc
index 50a218d..b9e4af1 100644
--- a/crypto/fipsmodule/cipher/aead.cc.inc
+++ b/crypto/fipsmodule/cipher/aead.cc.inc

@@ -42,20 +42,20 @@
   EVP_AEAD_CTX *ctx =
       reinterpret_cast<EVP_AEAD_CTX *>(OPENSSL_malloc(sizeof(EVP_AEAD_CTX)));
   if (!ctx) {
-    return NULL;
+    return nullptr;
   }
   EVP_AEAD_CTX_zero(ctx);
 
-  if (EVP_AEAD_CTX_init(ctx, aead, key, key_len, tag_len, NULL)) {
+  if (EVP_AEAD_CTX_init(ctx, aead, key, key_len, tag_len, nullptr)) {
     return ctx;
   }
 
   EVP_AEAD_CTX_free(ctx);
-  return NULL;
+  return nullptr;
 }
 
 void EVP_AEAD_CTX_free(EVP_AEAD_CTX *ctx) {
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return;
   }
   EVP_AEAD_CTX_cleanup(ctx);
@@ -67,7 +67,7 @@
                       ENGINE *impl) {
   if (!aead->init) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_NO_DIRECTION_SET);
-    ctx->aead = NULL;
+    ctx->aead = nullptr;
     return 0;
   }
   return EVP_AEAD_CTX_init_with_direction(ctx, aead, key, key_len, tag_len,
@@ -80,7 +80,7 @@
                                      enum evp_aead_direction_t dir) {
   if (key_len != aead->key_len) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_KEY_SIZE);
-    ctx->aead = NULL;
+    ctx->aead = nullptr;
     return 0;
   }
 
@@ -94,18 +94,18 @@
   }
 
   if (!ok) {
-    ctx->aead = NULL;
+    ctx->aead = nullptr;
   }
 
   return ok;
 }
 
 void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx) {
-  if (ctx->aead == NULL) {
+  if (ctx->aead == nullptr) {
     return;
   }
   ctx->aead->cleanup(ctx);
-  ctx->aead = NULL;
+  ctx->aead = nullptr;
 }
 
 // check_alias returns 1 if |out| is compatible with |in| and 0 otherwise. If
@@ -141,7 +141,7 @@
   size_t out_tag_len;
   if (ctx->aead->seal_scatter(ctx, out, out + in_len, &out_tag_len,
                               max_out_len - in_len, nonce, nonce_len, in,
-                              in_len, NULL, 0, ad, ad_len)) {
+                              in_len, nullptr, 0, ad, ad_len)) {
     *out_len = in_len + out_tag_len;
     return 1;
   }
@@ -268,7 +268,7 @@
 
 int EVP_AEAD_CTX_get_iv(const EVP_AEAD_CTX *ctx, const uint8_t **out_iv,
                         size_t *out_len) {
-  if (ctx->aead->get_iv == NULL) {
+  if (ctx->aead->get_iv == nullptr) {
     OPENSSL_PUT_ERROR(CIPHER, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }

diff --git a/crypto/fipsmodule/cipher/cipher.cc.inc b/crypto/fipsmodule/cipher/cipher.cc.inc
index fb35172..0b2e4f9 100644
--- a/crypto/fipsmodule/cipher/cipher.cc.inc
+++ b/crypto/fipsmodule/cipher/cipher.cc.inc

@@ -41,7 +41,7 @@
 }
 
 int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c) {
-  if (c->cipher != NULL && c->cipher->cleanup) {
+  if (c->cipher != nullptr && c->cipher->cleanup) {
     c->cipher->cleanup(c);
   }
   OPENSSL_free(c->cipher_data);
@@ -58,7 +58,7 @@
 }
 
 int EVP_CIPHER_CTX_copy(EVP_CIPHER_CTX *out, const EVP_CIPHER_CTX *in) {
-  if (in == NULL || in->cipher == NULL) {
+  if (in == nullptr || in->cipher == nullptr) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INPUT_NOT_INITIALIZED);
     return 0;
   }
@@ -74,14 +74,14 @@
   if (in->cipher_data && in->cipher->ctx_size) {
     out->cipher_data = OPENSSL_memdup(in->cipher_data, in->cipher->ctx_size);
     if (!out->cipher_data) {
-      out->cipher = NULL;
+      out->cipher = nullptr;
       return 0;
     }
   }
 
   if (in->cipher->flags & EVP_CIPH_CUSTOM_COPY) {
     if (!in->cipher->ctrl((EVP_CIPHER_CTX *)in, EVP_CTRL_COPY, 0, out)) {
-      out->cipher = NULL;
+      out->cipher = nullptr;
       return 0;
     }
   }
@@ -121,19 +121,19 @@
     if (ctx->cipher->ctx_size) {
       ctx->cipher_data = OPENSSL_malloc(ctx->cipher->ctx_size);
       if (!ctx->cipher_data) {
-        ctx->cipher = NULL;
+        ctx->cipher = nullptr;
         return 0;
       }
     } else {
-      ctx->cipher_data = NULL;
+      ctx->cipher_data = nullptr;
     }
 
     ctx->key_len = cipher->key_len;
     ctx->flags = 0;
 
     if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) {
-      if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) {
-        ctx->cipher = NULL;
+      if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, nullptr)) {
+        ctx->cipher = nullptr;
         OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INITIALIZATION_ERROR);
         return 0;
       }
@@ -316,7 +316,7 @@
     // When EVP_CIPH_FLAG_CUSTOM_CIPHER is set, the return value of |cipher| is
     // the number of bytes written, or -1 on error. Otherwise the return value
     // is one on success and zero on error.
-    const int num_bytes = ctx->cipher->cipher(ctx, out, NULL, 0);
+    const int num_bytes = ctx->cipher->cipher(ctx, out, nullptr, 0);
     if (num_bytes < 0) {
       return 0;
     }
@@ -430,7 +430,7 @@
   }
 
   if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
-    i = ctx->cipher->cipher(ctx, out, NULL, 0);
+    i = ctx->cipher->cipher(ctx, out, nullptr, 0);
     if (i < 0) {
       return 0;
     } else {
@@ -642,7 +642,7 @@
   if (cipher) {
     EVP_CIPHER_CTX_init(ctx);
   }
-  return EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, enc);
+  return EVP_CipherInit_ex(ctx, cipher, nullptr, key, iv, enc);
 }
 
 int EVP_EncryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,

diff --git a/crypto/fipsmodule/cipher/e_aes.cc.inc b/crypto/fipsmodule/cipher/e_aes.cc.inc
index f0089c8..685fa24 100644
--- a/crypto/fipsmodule/cipher/e_aes.cc.inc
+++ b/crypto/fipsmodule/cipher/e_aes.cc.inc

@@ -79,7 +79,7 @@
     if (hwaes_capable()) {
       ret = aes_hw_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
       dat->block = aes_hw_decrypt;
-      dat->stream.cbc = NULL;
+      dat->stream.cbc = nullptr;
       if (mode == EVP_CIPH_CBC_MODE) {
         dat->stream.cbc = aes_hw_cbc_encrypt;
       }
@@ -90,12 +90,12 @@
         vpaes_decrypt_key_to_bsaes(&dat->ks.ks, &dat->ks.ks);
       }
       // If |dat->stream.cbc| is provided, |dat->block| is never used.
-      dat->block = NULL;
+      dat->block = nullptr;
       dat->stream.cbc = bsaes_cbc_encrypt;
     } else if (vpaes_capable()) {
       ret = vpaes_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
       dat->block = vpaes_decrypt;
-      dat->stream.cbc = NULL;
+      dat->stream.cbc = nullptr;
 #if defined(VPAES_CBC)
       if (mode == EVP_CIPH_CBC_MODE) {
         dat->stream.cbc = vpaes_cbc_encrypt;
@@ -104,7 +104,7 @@
     } else {
       ret = aes_nohw_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
       dat->block = aes_nohw_decrypt;
-      dat->stream.cbc = NULL;
+      dat->stream.cbc = nullptr;
       if (mode == EVP_CIPH_CBC_MODE) {
         dat->stream.cbc = aes_nohw_cbc_encrypt;
       }
@@ -112,7 +112,7 @@
   } else if (hwaes_capable()) {
     ret = aes_hw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
     dat->block = aes_hw_encrypt;
-    dat->stream.cbc = NULL;
+    dat->stream.cbc = nullptr;
     if (mode == EVP_CIPH_CBC_MODE) {
       dat->stream.cbc = aes_hw_cbc_encrypt;
     } else if (mode == EVP_CIPH_CTR_MODE) {
@@ -121,7 +121,7 @@
   } else if (vpaes_capable()) {
     ret = vpaes_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
     dat->block = vpaes_encrypt;
-    dat->stream.cbc = NULL;
+    dat->stream.cbc = nullptr;
 #if defined(VPAES_CBC)
     if (mode == EVP_CIPH_CBC_MODE) {
       dat->stream.cbc = vpaes_cbc_encrypt;
@@ -138,7 +138,7 @@
   } else {
     ret = aes_nohw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
     dat->block = aes_nohw_encrypt;
-    dat->stream.cbc = NULL;
+    dat->stream.cbc = nullptr;
     if (mode == EVP_CIPH_CBC_MODE) {
       dat->stream.cbc = aes_nohw_cbc_encrypt;
     } else if (mode == EVP_CIPH_CTR_MODE) {
@@ -216,7 +216,7 @@
     OPENSSL_memset(&gctx->gcm, 0, sizeof(gctx->gcm));
     CRYPTO_gcm128_init_aes_key(&gctx->key, key, ctx->key_len);
     // Use the IV if specified. Otherwise, use the saved IV, if any.
-    if (iv == NULL && gctx->iv_set) {
+    if (iv == nullptr && gctx->iv_set) {
       iv = gctx->iv;
     }
     if (iv) {
@@ -387,7 +387,7 @@
   }
 
   if (in) {
-    if (out == NULL) {
+    if (out == nullptr) {
       if (!CRYPTO_gcm128_aad(&gctx->key, &gctx->gcm, in, len)) {
         return -1;
       }
@@ -728,7 +728,7 @@
   return 1;
 }
 
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
                   sizeof(struct aead_aes_gcm_ctx),
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >=
@@ -1031,7 +1031,7 @@
 };
 }  // namespace
 
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
                   sizeof(struct aead_aes_gcm_tls12_ctx),
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >=
@@ -1126,7 +1126,7 @@
 };
 }  // namespace
 
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
                   sizeof(struct aead_aes_gcm_tls13_ctx),
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >=

diff --git a/crypto/fipsmodule/cipher/e_aesccm.cc.inc b/crypto/fipsmodule/cipher/e_aesccm.cc.inc
index b45ecdd..af5077e 100644
--- a/crypto/fipsmodule/cipher/e_aesccm.cc.inc
+++ b/crypto/fipsmodule/cipher/e_aesccm.cc.inc

@@ -232,7 +232,7 @@
 };
 }  // namespace
 
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
                   sizeof(struct aead_aes_ccm_ctx),
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >=
@@ -263,7 +263,8 @@
   struct aead_aes_ccm_ctx *ccm_ctx = (struct aead_aes_ccm_ctx *)&ctx->state;
 
   block128_f block;
-  ctr128_f ctr = aes_ctr_set_key(&ccm_ctx->ks.ks, NULL, &block, key, key_len);
+  ctr128_f ctr =
+      aes_ctr_set_key(&ccm_ctx->ks.ks, nullptr, &block, key, key_len);
   ctx->tag_len = tag_len;
   if (!CRYPTO_ccm128_init(&ccm_ctx->ccm, &ccm_ctx->ks.ks, block, ctr, M, L)) {
     OPENSSL_PUT_ERROR(CIPHER, ERR_R_INTERNAL_ERROR);

diff --git a/crypto/fipsmodule/cmac/cmac.cc.inc b/crypto/fipsmodule/cmac/cmac.cc.inc
index c05be09..a087009 100644
--- a/crypto/fipsmodule/cmac/cmac.cc.inc
+++ b/crypto/fipsmodule/cmac/cmac.cc.inc

@@ -72,7 +72,7 @@
   // We have to verify that all the CMAC services actually succeed before
   // updating the indicator state, so we lock the state here.
   FIPS_service_indicator_lock_state();
-  const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
+  const int ok = CMAC_Init(&ctx, key, key_len, cipher, nullptr /* engine */) &&
                  CMAC_Update(&ctx, in, in_len) &&
                  CMAC_Final(&ctx, out, &scratch_out_len);
   FIPS_service_indicator_unlock_state();
@@ -86,14 +86,14 @@
 
 CMAC_CTX *CMAC_CTX_new(void) {
   CMAC_CTX *ctx = reinterpret_cast<CMAC_CTX *>(OPENSSL_malloc(sizeof(*ctx)));
-  if (ctx != NULL) {
+  if (ctx != nullptr) {
     CMAC_CTX_init(ctx);
   }
   return ctx;
 }
 
 void CMAC_CTX_free(CMAC_CTX *ctx) {
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return;
   }
 
@@ -160,11 +160,12 @@
   size_t block_size = EVP_CIPHER_block_size(cipher);
   if ((block_size != AES_BLOCK_SIZE && block_size != 8 /* 3-DES */) ||
       EVP_CIPHER_key_length(cipher) != key_len ||
-      !EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, NULL,
+      !EVP_EncryptInit_ex(&ctx->cipher_ctx, cipher, nullptr,
                           reinterpret_cast<const uint8_t *>(key), kZeroIV) ||
       !EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, block_size) ||
       // Reset context again ready for first data.
-      !EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
+      !EVP_EncryptInit_ex(&ctx->cipher_ctx, nullptr, nullptr, nullptr,
+                          kZeroIV)) {
     goto out;
   }
 
@@ -185,7 +186,8 @@
 
 int CMAC_Reset(CMAC_CTX *ctx) {
   ctx->block_used = 0;
-  return EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV);
+  return EVP_EncryptInit_ex(&ctx->cipher_ctx, nullptr, nullptr, nullptr,
+                            kZeroIV);
 }
 
 int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
@@ -259,7 +261,7 @@
 
   *out_len = block_size;
   const uint8_t *mask = ctx->k1;
-  if (out == NULL) {
+  if (out == nullptr) {
     ret = 1;
     goto out;
   }

diff --git a/crypto/fipsmodule/dh/check.cc.inc b/crypto/fipsmodule/dh/check.cc.inc
index 4d023d5..dc41bc6 100644
--- a/crypto/fipsmodule/dh/check.cc.inc
+++ b/crypto/fipsmodule/dh/check.cc.inc

@@ -34,7 +34,8 @@
   }
 
   // q must be bounded by p.
-  if (dh->q != NULL && (BN_is_negative(dh->q) || BN_ucmp(dh->q, dh->p) > 0)) {
+  if (dh->q != nullptr &&
+      (BN_is_negative(dh->q) || BN_ucmp(dh->q, dh->p) > 0)) {
     OPENSSL_PUT_ERROR(DH, DH_R_INVALID_PARAMETERS);
     return 0;
   }
@@ -56,7 +57,7 @@
   }
 
   bssl::UniquePtr<BN_CTX> ctx(BN_CTX_new());
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return 0;
   }
   bssl::BN_CTXScope scope(ctx.get());
@@ -68,20 +69,18 @@
 
   // Check |pub_key| is less than |dh->p| - 1.
   BIGNUM *tmp = BN_CTX_get(ctx.get());
-  if (tmp == NULL ||
-      !BN_copy(tmp, dh->p) ||
-      !BN_sub_word(tmp, 1)) {
+  if (tmp == nullptr || !BN_copy(tmp, dh->p) || !BN_sub_word(tmp, 1)) {
     return 0;
   }
   if (BN_cmp(pub_key, tmp) >= 0) {
     *out_flags |= DH_CHECK_PUBKEY_TOO_LARGE;
   }
 
-  if (dh->q != NULL) {
+  if (dh->q != nullptr) {
     // Check |pub_key|^|dh->q| is 1 mod |dh->p|. This is necessary for RFC 5114
     // groups which are not safe primes but pick a generator on a prime-order
     // subgroup of size |dh->q|.
-    if (!BN_mod_exp_mont(tmp, pub_key, dh->q, dh->p, ctx.get(), NULL)) {
+    if (!BN_mod_exp_mont(tmp, pub_key, dh->q, dh->p, ctx.get(), nullptr)) {
       return 0;
     }
     if (!BN_is_one(tmp)) {

diff --git a/crypto/fipsmodule/dh/dh.cc.inc b/crypto/fipsmodule/dh/dh.cc.inc
index 097e4c6..60d6531 100644
--- a/crypto/fipsmodule/dh/dh.cc.inc
+++ b/crypto/fipsmodule/dh/dh.cc.inc

@@ -31,8 +31,8 @@
 
 DH *DH_new(void) {
   DH *dh = reinterpret_cast<DH *>(OPENSSL_zalloc(sizeof(DH)));
-  if (dh == NULL) {
-    return NULL;
+  if (dh == nullptr) {
+    return nullptr;
   }
 
   CRYPTO_MUTEX_init(&dh->method_mont_p_lock);
@@ -41,7 +41,7 @@
 }
 
 void DH_free(DH *dh) {
-  if (dh == NULL) {
+  if (dh == nullptr) {
     return;
   }
 
@@ -74,21 +74,21 @@
 
 void DH_get0_key(const DH *dh, const BIGNUM **out_pub_key,
                  const BIGNUM **out_priv_key) {
-  if (out_pub_key != NULL) {
+  if (out_pub_key != nullptr) {
     *out_pub_key = dh->pub_key;
   }
-  if (out_priv_key != NULL) {
+  if (out_priv_key != nullptr) {
     *out_priv_key = dh->priv_key;
   }
 }
 
 int DH_set0_key(DH *dh, BIGNUM *pub_key, BIGNUM *priv_key) {
-  if (pub_key != NULL) {
+  if (pub_key != nullptr) {
     BN_free(dh->pub_key);
     dh->pub_key = pub_key;
   }
 
-  if (priv_key != NULL) {
+  if (priv_key != nullptr) {
     BN_free(dh->priv_key);
     dh->priv_key = priv_key;
   }
@@ -98,40 +98,41 @@
 
 void DH_get0_pqg(const DH *dh, const BIGNUM **out_p, const BIGNUM **out_q,
                  const BIGNUM **out_g) {
-  if (out_p != NULL) {
+  if (out_p != nullptr) {
     *out_p = dh->p;
   }
-  if (out_q != NULL) {
+  if (out_q != nullptr) {
     *out_q = dh->q;
   }
-  if (out_g != NULL) {
+  if (out_g != nullptr) {
     *out_g = dh->g;
   }
 }
 
 int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) {
-  if ((dh->p == NULL && p == NULL) || (dh->g == NULL && g == NULL)) {
+  if ((dh->p == nullptr && p == nullptr) ||
+      (dh->g == nullptr && g == nullptr)) {
     return 0;
   }
 
-  if (p != NULL) {
+  if (p != nullptr) {
     BN_free(dh->p);
     dh->p = p;
   }
 
-  if (q != NULL) {
+  if (q != nullptr) {
     BN_free(dh->q);
     dh->q = q;
   }
 
-  if (g != NULL) {
+  if (g != nullptr) {
     BN_free(dh->g);
     dh->g = g;
   }
 
   // Invalidate the cached Montgomery parameters.
   BN_MONT_CTX_free(dh->method_mont_p);
-  dh->method_mont_p = NULL;
+  dh->method_mont_p = nullptr;
   return 1;
 }
 
@@ -254,7 +255,7 @@
     return 0;
   }
 
-  if (dh->priv_key == NULL) {
+  if (dh->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(DH, DH_R_NO_PRIVATE_VALUE);
     return 0;
   }
@@ -354,7 +355,8 @@
       // Also, padded output avoids side-channels, so is always strongly
       // advisable.
       DH_compute_key_padded(shared_bytes, peers_key, dh) != (int)dh_len ||
-      !EVP_Digest(shared_bytes, dh_len, out, &out_len_unsigned, digest, NULL) ||
+      !EVP_Digest(shared_bytes, dh_len, out, &out_len_unsigned, digest,
+                  nullptr) ||
       out_len_unsigned != digest_len) {
     goto err;
   }

diff --git a/crypto/fipsmodule/digest/digest.cc.inc b/crypto/fipsmodule/digest/digest.cc.inc
index 0b206be..49e083b 100644
--- a/crypto/fipsmodule/digest/digest.cc.inc
+++ b/crypto/fipsmodule/digest/digest.cc.inc

@@ -55,7 +55,7 @@
 EVP_MD_CTX *EVP_MD_CTX_create(void) { return EVP_MD_CTX_new(); }
 
 int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx) {
-  assert(ctx->pctx == NULL || ctx->pctx_ops != NULL);
+  assert(ctx->pctx == nullptr || ctx->pctx_ops != nullptr);
   if (ctx->pctx_ops) {
     ctx->pctx_ops->free(ctx->pctx);
   }
@@ -93,7 +93,7 @@
 int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in) {
   // |in->digest| may be NULL if this is a signing |EVP_MD_CTX| for, e.g.,
   // Ed25519 which does not hash with |EVP_MD_CTX|.
-  if (in == NULL || (in->pctx == NULL && in->digest == NULL)) {
+  if (in == nullptr || (in->pctx == nullptr && in->digest == nullptr)) {
     OPENSSL_PUT_ERROR(DIGEST, DIGEST_R_INPUT_NOT_INITIALIZED);
     return 0;
   }
@@ -102,8 +102,8 @@
     return 0;
   }
 
-  EVP_PKEY_CTX *pctx = NULL;
-  assert(in->pctx == NULL || in->pctx_ops != NULL);
+  EVP_PKEY_CTX *pctx = nullptr;
+  assert(in->pctx == nullptr || in->pctx_ops != nullptr);
   if (in->pctx) {
     pctx = in->pctx_ops->dup(in->pctx);
     if (!pctx) {
@@ -114,12 +114,12 @@
   EVP_MD_CTX_cleanup(out);
 
   out->digest = in->digest;
-  if (in->digest != NULL) {
+  if (in->digest != nullptr) {
     OPENSSL_memcpy(out->md_data, in->md_data, in->digest->ctx_size);
   }
   out->pctx = pctx;
   out->pctx_ops = in->pctx_ops;
-  assert(out->pctx == NULL || out->pctx_ops != NULL);
+  assert(out->pctx == nullptr || out->pctx_ops != nullptr);
 
   return 1;
 }
@@ -153,7 +153,7 @@
     ctx->digest = type;
   }
 
-  assert(ctx->pctx == NULL || ctx->pctx_ops != NULL);
+  assert(ctx->pctx == nullptr || ctx->pctx_ops != nullptr);
 
   ctx->digest->init(ctx);
   return 1;
@@ -161,7 +161,7 @@
 
 int EVP_DigestInit(EVP_MD_CTX *ctx, const EVP_MD *type) {
   EVP_MD_CTX_init(ctx);
-  return EVP_DigestInit_ex(ctx, type, NULL);
+  return EVP_DigestInit_ex(ctx, type, nullptr);
 }
 
 int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t len) {
@@ -172,7 +172,7 @@
 int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, uint8_t *md_out, unsigned int *size) {
   assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE);
   ctx->digest->final(ctx, md_out);
-  if (size != NULL) {
+  if (size != nullptr) {
     *size = ctx->digest->md_size;
   }
   OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size);
@@ -194,8 +194,8 @@
 }
 
 const EVP_MD *EVP_MD_CTX_get0_md(const EVP_MD_CTX *ctx) {
-  if (ctx == NULL) {
-    return NULL;
+  if (ctx == nullptr) {
+    return nullptr;
   }
   return ctx->digest;
 }

diff --git a/crypto/fipsmodule/digestsign/digestsign.cc.inc b/crypto/fipsmodule/digestsign/digestsign.cc.inc
index ced1fd8..870cd49 100644
--- a/crypto/fipsmodule/digestsign/digestsign.cc.inc
+++ b/crypto/fipsmodule/digestsign/digestsign.cc.inc

@@ -33,17 +33,17 @@
 }
 
 static int uses_prehash(EVP_MD_CTX *ctx, enum evp_sign_verify_t op) {
-  return (op == evp_sign) ? (ctx->pctx->pmeth->sign != NULL)
-                          : (ctx->pctx->pmeth->verify != NULL);
+  return (op == evp_sign) ? (ctx->pctx->pmeth->sign != nullptr)
+                          : (ctx->pctx->pmeth->verify != nullptr);
 }
 
 static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
                           const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey,
                           enum evp_sign_verify_t op) {
-  if (ctx->pctx == NULL) {
+  if (ctx->pctx == nullptr) {
     ctx->pctx = EVP_PKEY_CTX_new(pkey, e);
   }
-  if (ctx->pctx == NULL) {
+  if (ctx->pctx == nullptr) {
     return 0;
   }
   ctx->pctx_ops = md_pctx_ops();
@@ -58,13 +58,12 @@
     }
   }
 
-  if (type != NULL &&
-      !EVP_PKEY_CTX_set_signature_md(ctx->pctx, type)) {
+  if (type != nullptr && !EVP_PKEY_CTX_set_signature_md(ctx->pctx, type)) {
     return 0;
   }
 
   if (uses_prehash(ctx, op)) {
-    if (type == NULL) {
+    if (type == nullptr) {
       OPENSSL_PUT_ERROR(EVP, EVP_R_NO_DEFAULT_DIGEST);
       return 0;
     }
@@ -135,7 +134,7 @@
     return ret;
   } else {
     size_t s = EVP_MD_size(ctx->digest);
-    return EVP_PKEY_sign(ctx->pctx, out_sig, out_sig_len, NULL, s);
+    return EVP_PKEY_sign(ctx->pctx, out_sig, out_sig_len, nullptr, s);
   }
 }
 
@@ -174,8 +173,7 @@
   if (uses_prehash(ctx, evp_sign)) {
     // If |out_sig| is NULL, the caller is only querying the maximum output
     // length. |data| should only be incorporated in the final call.
-    if (out_sig != NULL &&
-        !EVP_DigestSignUpdate(ctx, data, data_len)) {
+    if (out_sig != nullptr && !EVP_DigestSignUpdate(ctx, data, data_len)) {
       goto end;
     }
 
@@ -183,7 +181,7 @@
     goto end;
   }
 
-  if (ctx->pctx->pmeth->sign_message == NULL) {
+  if (ctx->pctx->pmeth->sign_message == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     goto end;
   }
@@ -210,7 +208,7 @@
     goto end;
   }
 
-  if (ctx->pctx->pmeth->verify_message == NULL) {
+  if (ctx->pctx->pmeth->verify_message == nullptr) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
     goto end;
   }

diff --git a/crypto/fipsmodule/ec/ec.cc.inc b/crypto/fipsmodule/ec/ec.cc.inc
index 4d76d0e..cb46593 100644
--- a/crypto/fipsmodule/ec/ec.cc.inc
+++ b/crypto/fipsmodule/ec/ec.cc.inc

@@ -256,7 +256,7 @@
 
   EC_AFFINE affine;
   if (!ec_jacobian_to_affine(group, &affine, &generator->raw) ||
-      !BN_MONT_CTX_set(&group->order, order, NULL)) {
+      !BN_MONT_CTX_set(&group->order, order, nullptr)) {
     return 0;
   }
 
@@ -280,12 +280,12 @@
       return (EC_GROUP *)EC_group_p521();
     default:
       OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-      return NULL;
+      return nullptr;
   }
 }
 
 void EC_GROUP_free(EC_GROUP *group) {
-  if (group == NULL ||
+  if (group == nullptr ||
       // Built-in curves are static.
       group->curve_name != NID_undef ||
       !CRYPTO_refcount_dec_and_test_zero(&group->references)) {
@@ -298,7 +298,7 @@
 }
 
 EC_GROUP *EC_GROUP_dup(const EC_GROUP *a) {
-  if (a == NULL ||
+  if (a == nullptr ||
       // Built-in curves are static.
       a->curve_name != NID_undef) {
     return (EC_GROUP *)a;
@@ -338,7 +338,7 @@
 }
 
 const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group) {
-  return group->has_order ? &group->generator : NULL;
+  return group->has_order ? &group->generator : nullptr;
 }
 
 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) {
@@ -347,7 +347,7 @@
 }
 
 int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx) {
-  if (BN_copy(order, EC_GROUP_get0_order(group)) == NULL) {
+  if (BN_copy(order, EC_GROUP_get0_order(group)) == nullptr) {
     return 0;
   }
   return 1;
@@ -385,7 +385,7 @@
     case NID_secp521r1:
       return "P-521";
   }
-  return NULL;
+  return nullptr;
 }
 
 int EC_curve_nist2nid(const char *name) {
@@ -405,14 +405,14 @@
 }
 
 EC_POINT *EC_POINT_new(const EC_GROUP *group) {
-  if (group == NULL) {
+  if (group == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
-    return NULL;
+    return nullptr;
   }
 
   EC_POINT *ret = reinterpret_cast<EC_POINT *>(OPENSSL_malloc(sizeof *ret));
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   ret->group = EC_GROUP_dup(group);
@@ -437,7 +437,7 @@
 void EC_POINT_clear_free(EC_POINT *point) { EC_POINT_free(point); }
 
 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) {
-  if (EC_GROUP_cmp(dest->group, src->group, NULL) != 0) {
+  if (EC_GROUP_cmp(dest->group, src->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -449,21 +449,21 @@
 }
 
 EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group) {
-  if (a == NULL) {
-    return NULL;
+  if (a == nullptr) {
+    return nullptr;
   }
 
   EC_POINT *ret = EC_POINT_new(group);
-  if (ret == NULL || !EC_POINT_copy(ret, a)) {
+  if (ret == nullptr || !EC_POINT_copy(ret, a)) {
     EC_POINT_free(ret);
-    return NULL;
+    return nullptr;
   }
 
   return ret;
 }
 
 int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -472,7 +472,7 @@
 }
 
 int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -481,7 +481,7 @@
 
 int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point,
                          BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -490,8 +490,8 @@
 
 int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b,
                  BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, a->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, b->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, a->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, b->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return -1;
   }
@@ -503,20 +503,20 @@
 int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
                                         const EC_POINT *point, BIGNUM *x,
                                         BIGNUM *y, BN_CTX *ctx) {
-  if (group->meth->point_get_affine_coordinates == 0) {
+  if (group->meth->point_get_affine_coordinates == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
   EC_FELEM x_felem, y_felem;
-  if (!group->meth->point_get_affine_coordinates(group, &point->raw,
-                                                 x == NULL ? NULL : &x_felem,
-                                                 y == NULL ? NULL : &y_felem) ||
-      (x != NULL && !ec_felem_to_bignum(group, x, &x_felem)) ||
-      (y != NULL && !ec_felem_to_bignum(group, y, &y_felem))) {
+  if (!group->meth->point_get_affine_coordinates(
+          group, &point->raw, x == nullptr ? nullptr : &x_felem,
+          y == nullptr ? nullptr : &y_felem) ||
+      (x != nullptr && !ec_felem_to_bignum(group, x, &x_felem)) ||
+      (y != nullptr && !ec_felem_to_bignum(group, y, &y_felem))) {
     return 0;
   }
   return 1;
@@ -542,7 +542,7 @@
 
 int ec_jacobian_to_affine_batch(const EC_GROUP *group, EC_AFFINE *out,
                                 const EC_JACOBIAN *in, size_t num) {
-  if (group->meth->jacobian_to_affine_batch == NULL) {
+  if (group->meth->jacobian_to_affine_batch == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -584,12 +584,12 @@
 int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group, EC_POINT *point,
                                         const BIGNUM *x, const BIGNUM *y,
                                         BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
 
-  if (x == NULL || y == NULL) {
+  if (x == nullptr || y == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -617,9 +617,9 @@
 
 int EC_POINT_add(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
                  const EC_POINT *b, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, r->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, a->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, b->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, r->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, a->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, b->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -629,8 +629,8 @@
 
 int EC_POINT_dbl(const EC_GROUP *group, EC_POINT *r, const EC_POINT *a,
                  BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, r->group, NULL) != 0 ||
-      EC_GROUP_cmp(group, a->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, r->group, nullptr) != 0 ||
+      EC_GROUP_cmp(group, a->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -640,7 +640,7 @@
 
 
 int EC_POINT_invert(const EC_GROUP *group, EC_POINT *a, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, a->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, a->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -669,22 +669,22 @@
   // Previously, this function set |r| to the point at infinity if there was
   // nothing to multiply. But, nobody should be calling this function with
   // nothing to multiply in the first place.
-  if ((g_scalar == NULL && p_scalar == NULL) ||
-      (p == NULL) != (p_scalar == NULL)) {
+  if ((g_scalar == nullptr && p_scalar == nullptr) ||
+      (p == nullptr) != (p_scalar == nullptr)) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
-  if (EC_GROUP_cmp(group, r->group, NULL) != 0 ||
-      (p != NULL && EC_GROUP_cmp(group, p->group, NULL) != 0)) {
+  if (EC_GROUP_cmp(group, r->group, nullptr) != 0 ||
+      (p != nullptr && EC_GROUP_cmp(group, p->group, nullptr) != 0)) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
 
   bssl::UniquePtr<BN_CTX> new_ctx;
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     new_ctx.reset(BN_CTX_new());
-    if (new_ctx == NULL) {
+    if (new_ctx == nullptr) {
       return 0;
     }
     ctx = new_ctx.get();
@@ -701,7 +701,7 @@
   // which combined the two multiplications did not avoid the doubling case
   // in the incomplete addition formula and were not constant-time.
 
-  if (g_scalar != NULL) {
+  if (g_scalar != nullptr) {
     EC_SCALAR scalar;
     if (!arbitrary_bignum_to_scalar(group, &scalar, g_scalar, ctx) ||
         !ec_point_mul_scalar_base(group, &r->raw, &scalar)) {
@@ -709,14 +709,14 @@
     }
   }
 
-  if (p_scalar != NULL) {
+  if (p_scalar != nullptr) {
     EC_SCALAR scalar;
     EC_JACOBIAN tmp;
     if (!arbitrary_bignum_to_scalar(group, &scalar, p_scalar, ctx) ||
         !ec_point_mul_scalar(group, &tmp, &p->raw, &scalar)) {
       return 0;
     }
-    if (g_scalar == NULL) {
+    if (g_scalar == nullptr) {
       OPENSSL_memcpy(&r->raw, &tmp, sizeof(EC_JACOBIAN));
     } else {
       group->meth->add(group, &r->raw, &r->raw, &tmp);
@@ -736,12 +736,12 @@
 int ec_point_mul_scalar_public(const EC_GROUP *group, EC_JACOBIAN *r,
                                const EC_SCALAR *g_scalar, const EC_JACOBIAN *p,
                                const EC_SCALAR *p_scalar) {
-  if (g_scalar == NULL || p_scalar == NULL || p == NULL) {
+  if (g_scalar == nullptr || p_scalar == nullptr || p == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
-  if (group->meth->mul_public == NULL) {
+  if (group->meth->mul_public == nullptr) {
     return group->meth->mul_public_batch(group, r, g_scalar, p, p_scalar, 1);
   }
 
@@ -753,7 +753,7 @@
                                      const EC_SCALAR *g_scalar,
                                      const EC_JACOBIAN *points,
                                      const EC_SCALAR *scalars, size_t num) {
-  if (group->meth->mul_public_batch == NULL) {
+  if (group->meth->mul_public_batch == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -764,7 +764,7 @@
 
 int ec_point_mul_scalar(const EC_GROUP *group, EC_JACOBIAN *r,
                         const EC_JACOBIAN *p, const EC_SCALAR *scalar) {
-  if (p == NULL || scalar == NULL) {
+  if (p == nullptr || scalar == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -783,7 +783,7 @@
 
 int ec_point_mul_scalar_base(const EC_GROUP *group, EC_JACOBIAN *r,
                              const EC_SCALAR *scalar) {
-  if (scalar == NULL) {
+  if (scalar == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -806,7 +806,7 @@
                               const EC_JACOBIAN *p0, const EC_SCALAR *scalar0,
                               const EC_JACOBIAN *p1, const EC_SCALAR *scalar1,
                               const EC_JACOBIAN *p2, const EC_SCALAR *scalar2) {
-  if (group->meth->mul_batch == NULL) {
+  if (group->meth->mul_batch == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -825,7 +825,7 @@
 
 int ec_init_precomp(const EC_GROUP *group, EC_PRECOMP *out,
                     const EC_JACOBIAN *p) {
-  if (group->meth->init_precomp == NULL) {
+  if (group->meth->init_precomp == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -838,7 +838,7 @@
                                 const EC_PRECOMP *p1, const EC_SCALAR *scalar1,
                                 const EC_PRECOMP *p2,
                                 const EC_SCALAR *scalar2) {
-  if (group->meth->mul_precomp == NULL) {
+  if (group->meth->mul_precomp == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -928,7 +928,7 @@
   }
 
   EC_FELEM x;
-  if (!group->meth->point_get_affine_coordinates(group, p, &x, NULL)) {
+  if (!group->meth->point_get_affine_coordinates(group, p, &x, nullptr)) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/ec/ec_key.cc.inc b/crypto/fipsmodule/ec/ec_key.cc.inc
index cf9b1f6..7b54c83 100644
--- a/crypto/fipsmodule/ec/ec_key.cc.inc
+++ b/crypto/fipsmodule/ec/ec_key.cc.inc

@@ -37,8 +37,8 @@
 static EC_WRAPPED_SCALAR *ec_wrapped_scalar_new(const EC_GROUP *group) {
   EC_WRAPPED_SCALAR *wrapped = reinterpret_cast<EC_WRAPPED_SCALAR *>(
       OPENSSL_zalloc(sizeof(EC_WRAPPED_SCALAR)));
-  if (wrapped == NULL) {
-    return NULL;
+  if (wrapped == nullptr) {
+    return nullptr;
   }
 
   wrapped->bignum.d = wrapped->scalar.words;
@@ -52,12 +52,12 @@
   OPENSSL_free(scalar);
 }
 
-EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); }
+EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(nullptr); }
 
 EC_KEY *EC_KEY_new_method(const ENGINE *engine) {
   EC_KEY *ret = reinterpret_cast<EC_KEY *>(OPENSSL_zalloc(sizeof(EC_KEY)));
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   if (engine) {
@@ -78,7 +78,7 @@
       METHOD_unref(ret->ecdsa_meth);
     }
     OPENSSL_free(ret);
-    return NULL;
+    return nullptr;
   }
 
   return ret;
@@ -86,19 +86,19 @@
 
 EC_KEY *EC_KEY_new_by_curve_name(int nid) {
   EC_KEY *ret = EC_KEY_new();
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
   ret->group = EC_GROUP_new_by_curve_name(nid);
-  if (ret->group == NULL) {
+  if (ret->group == nullptr) {
     EC_KEY_free(ret);
-    return NULL;
+    return nullptr;
   }
   return ret;
 }
 
 void EC_KEY_free(EC_KEY *r) {
-  if (r == NULL) {
+  if (r == nullptr) {
     return;
   }
 
@@ -123,22 +123,22 @@
 }
 
 EC_KEY *EC_KEY_dup(const EC_KEY *src) {
-  if (src == NULL) {
+  if (src == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
-    return NULL;
+    return nullptr;
   }
 
   EC_KEY *ret = EC_KEY_new();
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
 
-  if ((src->group != NULL && !EC_KEY_set_group(ret, src->group)) ||
-      (src->pub_key != NULL && !EC_KEY_set_public_key(ret, src->pub_key)) ||
-      (src->priv_key != NULL &&
+  if ((src->group != nullptr && !EC_KEY_set_group(ret, src->group)) ||
+      (src->pub_key != nullptr && !EC_KEY_set_public_key(ret, src->pub_key)) ||
+      (src->priv_key != nullptr &&
        !EC_KEY_set_private_key(ret, EC_KEY_get0_private_key(src)))) {
     EC_KEY_free(ret);
-    return NULL;
+    return nullptr;
   }
 
   ret->enc_flag = src->enc_flag;
@@ -159,34 +159,34 @@
 
 int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group) {
   // If |key| already has a group, it is an error to switch to another one.
-  if (key->group != NULL) {
-    if (EC_GROUP_cmp(key->group, group, NULL) != 0) {
+  if (key->group != nullptr) {
+    if (EC_GROUP_cmp(key->group, group, nullptr) != 0) {
       OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
       return 0;
     }
     return 1;
   }
 
-  assert(key->priv_key == NULL);
-  assert(key->pub_key == NULL);
+  assert(key->priv_key == nullptr);
+  assert(key->pub_key == nullptr);
 
   EC_GROUP_free(key->group);
   key->group = EC_GROUP_dup(group);
-  return key->group != NULL;
+  return key->group != nullptr;
 }
 
 const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key) {
-  return key->priv_key != NULL ? &key->priv_key->bignum : NULL;
+  return key->priv_key != nullptr ? &key->priv_key->bignum : nullptr;
 }
 
 int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) {
-  if (key->group == NULL) {
+  if (key->group == nullptr) {
     OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
     return 0;
   }
 
   EC_WRAPPED_SCALAR *scalar = ec_wrapped_scalar_new(key->group);
-  if (scalar == NULL) {
+  if (scalar == nullptr) {
     return 0;
   }
   if (!ec_bignum_to_scalar(key->group, &scalar->scalar, priv_key) ||
@@ -208,24 +208,25 @@
 }
 
 int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key) {
-  if (key->group == NULL) {
+  if (key->group == nullptr) {
     OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
     return 0;
   }
 
-  if (pub_key != NULL && EC_POINT_is_at_infinity(pub_key->group, pub_key)) {
+  if (pub_key != nullptr && EC_POINT_is_at_infinity(pub_key->group, pub_key)) {
     OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
     return 0;
   }
 
-  if (pub_key != NULL && EC_GROUP_cmp(key->group, pub_key->group, NULL) != 0) {
+  if (pub_key != nullptr &&
+      EC_GROUP_cmp(key->group, pub_key->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
     return 0;
   }
 
   EC_POINT_free(key->pub_key);
   key->pub_key = EC_POINT_dup(pub_key, key->group);
-  return (key->pub_key == NULL) ? 0 : 1;
+  return (key->pub_key == nullptr) ? 0 : 1;
 }
 
 unsigned int EC_KEY_get_enc_flags(const EC_KEY *key) { return key->enc_flag; }
@@ -254,7 +255,7 @@
   }
 
   // Test whether the public key is on the elliptic curve.
-  if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, NULL)) {
+  if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, nullptr)) {
     OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE);
     return 0;
   }
@@ -263,7 +264,7 @@
   //
   // NOTE: this is a FIPS pair-wise consistency check for the ECDH case. See SP
   // 800-56Ar3, page 36.
-  if (eckey->priv_key != NULL) {
+  if (eckey->priv_key != nullptr) {
     EC_JACOBIAN point;
     if (!ec_point_mul_scalar_base(eckey->group, &point,
                                   &eckey->priv_key->scalar)) {
@@ -351,7 +352,7 @@
 
 size_t EC_KEY_key2buf(const EC_KEY *key, point_conversion_form_t form,
                       uint8_t **out_buf, BN_CTX *ctx) {
-  if (key == NULL || key->pub_key == NULL || key->group == NULL) {
+  if (key == nullptr || key->pub_key == nullptr || key->group == nullptr) {
     OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
     return 0;
   }
@@ -360,7 +361,7 @@
 }
 
 int EC_KEY_oct2priv(EC_KEY *key, const uint8_t *in, size_t len) {
-  if (key->group == NULL) {
+  if (key->group == nullptr) {
     OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
     return 0;
   }
@@ -370,21 +371,21 @@
     return 0;
   }
 
-  BIGNUM *priv_key = BN_bin2bn(in, len, NULL);
-  int ok = priv_key != NULL &&  //
+  BIGNUM *priv_key = BN_bin2bn(in, len, nullptr);
+  int ok = priv_key != nullptr &&  //
            EC_KEY_set_private_key(key, priv_key);
   BN_free(priv_key);
   return ok;
 }
 
 size_t EC_KEY_priv2oct(const EC_KEY *key, uint8_t *out, size_t max_out) {
-  if (key->group == NULL || key->priv_key == NULL) {
+  if (key->group == nullptr || key->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
     return 0;
   }
 
   size_t len = BN_num_bytes(EC_GROUP_get0_order(key->group));
-  if (out == NULL) {
+  if (out == nullptr) {
     return len;
   }
 
@@ -400,14 +401,14 @@
 }
 
 size_t EC_KEY_priv2buf(const EC_KEY *key, uint8_t **out_buf) {
-  *out_buf = NULL;
-  size_t len = EC_KEY_priv2oct(key, NULL, 0);
+  *out_buf = nullptr;
+  size_t len = EC_KEY_priv2oct(key, nullptr, 0);
   if (len == 0) {
     return 0;
   }
 
   uint8_t *buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(len));
-  if (buf == NULL) {
+  if (buf == nullptr) {
     return 0;
   }
 
@@ -422,7 +423,7 @@
 }
 
 int EC_KEY_generate_key(EC_KEY *key) {
-  if (key == NULL || key->group == NULL) {
+  if (key == nullptr || key->group == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -436,7 +437,7 @@
   static const uint8_t kDefaultAdditionalData[32] = {0};
   EC_WRAPPED_SCALAR *priv_key = ec_wrapped_scalar_new(key->group);
   EC_POINT *pub_key = EC_POINT_new(key->group);
-  if (priv_key == NULL || pub_key == NULL ||
+  if (priv_key == nullptr || pub_key == nullptr ||
       // Generate the private key by testing candidates (FIPS 186-4 B.4.2).
       !ec_random_nonzero_scalar(key->group, &priv_key->scalar,
                                 kDefaultAdditionalData) ||
@@ -462,7 +463,7 @@
 }
 
 int EC_KEY_generate_key_fips(EC_KEY *eckey) {
-  if (eckey == NULL || eckey->group == NULL) {
+  if (eckey == nullptr || eckey->group == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -475,8 +476,8 @@
 
   EC_POINT_free(eckey->pub_key);
   ec_wrapped_scalar_free(eckey->priv_key);
-  eckey->pub_key = NULL;
-  eckey->priv_key = NULL;
+  eckey->pub_key = nullptr;
+  eckey->priv_key = nullptr;
   return 0;
 }
 

diff --git a/crypto/fipsmodule/ec/ec_montgomery.cc.inc b/crypto/fipsmodule/ec/ec_montgomery.cc.inc
index a5205fb..f841622 100644
--- a/crypto/fipsmodule/ec/ec_montgomery.cc.inc
+++ b/crypto/fipsmodule/ec/ec_montgomery.cc.inc

@@ -105,11 +105,11 @@
   ec_GFp_mont_felem_inv0(group, &z2, &point->Z);
   ec_GFp_mont_felem_sqr(group, &z1, &z2);
 
-  if (x != NULL) {
+  if (x != nullptr) {
     ec_GFp_mont_felem_mul(group, x, &point->X, &z1);
   }
 
-  if (y != NULL) {
+  if (y != nullptr) {
     ec_GFp_mont_felem_mul(group, &z1, &z1, &z2);
     ec_GFp_mont_felem_mul(group, y, &point->Y, &z1);
   }

diff --git a/crypto/fipsmodule/ec/felem.cc.inc b/crypto/fipsmodule/ec/felem.cc.inc
index 567856f..b706f09 100644
--- a/crypto/fipsmodule/ec/felem.cc.inc
+++ b/crypto/fipsmodule/ec/felem.cc.inc

@@ -45,7 +45,7 @@
   uint8_t bytes[EC_MAX_BYTES];
   size_t len;
   ec_felem_to_bytes(group, bytes, &len, in);
-  return BN_bin2bn(bytes, len, out) != NULL;
+  return BN_bin2bn(bytes, len, out) != nullptr;
 }
 
 void ec_felem_to_bytes(const EC_GROUP *group, uint8_t *out, size_t *out_len,

diff --git a/crypto/fipsmodule/ec/oct.cc.inc b/crypto/fipsmodule/ec/oct.cc.inc
index ac34f5e..094e322 100644
--- a/crypto/fipsmodule/ec/oct.cc.inc
+++ b/crypto/fipsmodule/ec/oct.cc.inc

@@ -144,7 +144,7 @@
 
 int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *point,
                        const uint8_t *buf, size_t len, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -154,11 +154,11 @@
 size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *point,
                           point_conversion_form_t form, uint8_t *buf,
                           size_t max_out, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
-  if (buf == NULL) {
+  if (buf == nullptr) {
     // When |buf| is NULL, just return the number of bytes that would be
     // written, without doing an expensive Jacobian-to-affine conversion.
     if (ec_GFp_simple_is_at_infinity(group, &point->raw)) {
@@ -177,13 +177,13 @@
 size_t EC_POINT_point2buf(const EC_GROUP *group, const EC_POINT *point,
                           point_conversion_form_t form, uint8_t **out_buf,
                           BN_CTX *ctx) {
-  *out_buf = NULL;
-  size_t len = EC_POINT_point2oct(group, point, form, NULL, 0, ctx);
+  *out_buf = nullptr;
+  size_t len = EC_POINT_point2oct(group, point, form, nullptr, 0, ctx);
   if (len == 0) {
     return 0;
   }
   uint8_t *buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(len));
-  if (buf == NULL) {
+  if (buf == nullptr) {
     return 0;
   }
   len = EC_POINT_point2oct(group, point, form, buf, len, ctx);
@@ -198,7 +198,7 @@
 int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group,
                                             EC_POINT *point, const BIGNUM *x,
                                             int y_bit, BN_CTX *ctx) {
-  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, point->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }
@@ -228,7 +228,7 @@
   BIGNUM *a = BN_CTX_get(ctx);
   BIGNUM *b = BN_CTX_get(ctx);
   BIGNUM *y = BN_CTX_get(ctx);
-  if (y == NULL || !EC_GROUP_get_curve_GFp(group, NULL, a, b, ctx)) {
+  if (y == nullptr || !EC_GROUP_get_curve_GFp(group, nullptr, a, b, ctx)) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/ec/p224-64.cc.inc b/crypto/fipsmodule/ec/p224-64.cc.inc
index f36929f..10e90e5 100644
--- a/crypto/fipsmodule/ec/p224-64.cc.inc
+++ b/crypto/fipsmodule/ec/p224-64.cc.inc

@@ -876,7 +876,7 @@
   p224_felem_square(tmp, z2);
   p224_felem_reduce(z1, tmp);
 
-  if (x != NULL) {
+  if (x != nullptr) {
     p224_felem x_in, x_out;
     p224_generic_to_felem(x_in, &point->X);
     p224_felem_mul(tmp, x_in, z1);
@@ -884,7 +884,7 @@
     p224_felem_to_generic(x, x_out);
   }
 
-  if (y != NULL) {
+  if (y != nullptr) {
     p224_felem y_in, y_out;
     p224_generic_to_felem(y_in, &point->Y);
     p224_felem_mul(tmp, z1, z2);

diff --git a/crypto/fipsmodule/ec/p256-nistz.cc.inc b/crypto/fipsmodule/ec/p256-nistz.cc.inc
index fd01452..250975c 100644
--- a/crypto/fipsmodule/ec/p256-nistz.cc.inc
+++ b/crypto/fipsmodule/ec/p256-nistz.cc.inc

@@ -293,8 +293,8 @@
 static void ecp_nistz256_windowed_mul(const EC_GROUP *group, P256_POINT *r,
                                       const EC_JACOBIAN *p,
                                       const EC_SCALAR *p_scalar) {
-  assert(p != NULL);
-  assert(p_scalar != NULL);
+  assert(p != nullptr);
+  assert(p_scalar != nullptr);
   assert(group->field.N.width == P256_LIMBS);
 
   static const size_t kWindowSize = 5;
@@ -464,7 +464,7 @@
                                            const EC_SCALAR *g_scalar,
                                            const EC_JACOBIAN *p_,
                                            const EC_SCALAR *p_scalar) {
-  assert(p_ != NULL && p_scalar != NULL && g_scalar != NULL);
+  assert(p_ != nullptr && p_scalar != nullptr && g_scalar != nullptr);
 
   alignas(32) P256_POINT p;
   uint8_t p_str[33];
@@ -536,11 +536,11 @@
   assert(group->field.N.width == P256_LIMBS);
   ecp_nistz256_mod_inverse_sqr_mont(z_inv2, point->Z.words);
 
-  if (x != NULL) {
+  if (x != nullptr) {
     ecp_nistz256_mul_mont(x->words, z_inv2, point->X.words);
   }
 
-  if (y != NULL) {
+  if (y != nullptr) {
     ecp_nistz256_sqr_mont(z_inv2, z_inv2);                            // z^-4
     ecp_nistz256_mul_mont(y->words, point->Y.words, point->Z.words);  // y * z
     ecp_nistz256_mul_mont(y->words, y->words, z_inv2);  // y * z^-3

diff --git a/crypto/fipsmodule/ec/p256.cc.inc b/crypto/fipsmodule/ec/p256.cc.inc
index cdf28f2..96822d6 100644
--- a/crypto/fipsmodule/ec/p256.cc.inc
+++ b/crypto/fipsmodule/ec/p256.cc.inc

@@ -261,14 +261,14 @@
   fiat_p256_from_generic(z1, &point->Z);
   fiat_p256_inv_square(z2, z1);
 
-  if (x_out != NULL) {
+  if (x_out != nullptr) {
     fiat_p256_felem x;
     fiat_p256_from_generic(x, &point->X);
     fiat_p256_mul(x, x, z2);
     fiat_p256_to_generic(x_out, x);
   }
 
-  if (y_out != NULL) {
+  if (y_out != nullptr) {
     fiat_p256_felem y;
     fiat_p256_from_generic(y, &point->Y);
     fiat_p256_square(z2, z2);  // z^-4

diff --git a/crypto/fipsmodule/ec/simple.cc.inc b/crypto/fipsmodule/ec/simple.cc.inc
index 59a130b..d0148dd 100644
--- a/crypto/fipsmodule/ec/simple.cc.inc
+++ b/crypto/fipsmodule/ec/simple.cc.inc

@@ -71,9 +71,9 @@
 
 int ec_GFp_simple_group_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a,
                                   BIGNUM *b) {
-  if ((p != NULL && !BN_copy(p, &group->field.N)) ||
-      (a != NULL && !ec_felem_to_bignum(group, a, &group->a)) ||
-      (b != NULL && !ec_felem_to_bignum(group, b, &group->b))) {
+  if ((p != nullptr && !BN_copy(p, &group->field.N)) ||
+      (a != nullptr && !ec_felem_to_bignum(group, a, &group->a)) ||
+      (b != nullptr && !ec_felem_to_bignum(group, b, &group->b))) {
     return 0;
   }
   return 1;

diff --git a/crypto/fipsmodule/ec/simple_mul.cc.inc b/crypto/fipsmodule/ec/simple_mul.cc.inc
index b317ccd..9ac18fc 100644
--- a/crypto/fipsmodule/ec/simple_mul.cc.inc
+++ b/crypto/fipsmodule/ec/simple_mul.cc.inc

@@ -136,7 +136,7 @@
   EC_JACOBIAN precomp[3][17];
   ec_GFp_mont_batch_precomp(group, precomp[0], 17, p0);
   ec_GFp_mont_batch_precomp(group, precomp[1], 17, p1);
-  if (p2 != NULL) {
+  if (p2 != nullptr) {
     ec_GFp_mont_batch_precomp(group, precomp[2], 17, p2);
   }
 
@@ -160,7 +160,7 @@
       ec_GFp_mont_batch_get_window(group, &tmp, precomp[1], scalar1, i);
       ec_GFp_mont_add(group, r, r, &tmp);
 
-      if (p2 != NULL) {
+      if (p2 != nullptr) {
         ec_GFp_mont_batch_get_window(group, &tmp, precomp[2], scalar2, i);
         ec_GFp_mont_add(group, r, r, &tmp);
       }
@@ -256,12 +256,12 @@
       ec_GFp_mont_add(group, r, r, &tmp);
     }
 
-    if (p1 != NULL) {
+    if (p1 != nullptr) {
       ec_GFp_mont_get_comb_window(group, &tmp, p1, scalar1, i);
       ec_GFp_mont_add(group, r, r, &tmp);
     }
 
-    if (p2 != NULL) {
+    if (p2 != nullptr) {
       ec_GFp_mont_get_comb_window(group, &tmp, p2, scalar2, i);
       ec_GFp_mont_add(group, r, r, &tmp);
     }

diff --git a/crypto/fipsmodule/ec/wnaf.cc.inc b/crypto/fipsmodule/ec/wnaf.cc.inc
index c733895..56d5b84 100644
--- a/crypto/fipsmodule/ec/wnaf.cc.inc
+++ b/crypto/fipsmodule/ec/wnaf.cc.inc

@@ -140,8 +140,8 @@
   EC_JACOBIAN precomp_stack[EC_WNAF_STACK][EC_WNAF_TABLE_SIZE];
 
   // Allocated pointers, which will remain NULL unless needed.
-  EC_JACOBIAN(*precomp_alloc)[EC_WNAF_TABLE_SIZE] = NULL;
-  int8_t(*wNAF_alloc)[EC_MAX_BYTES * 8 + 1] = NULL;
+  EC_JACOBIAN(*precomp_alloc)[EC_WNAF_TABLE_SIZE] = nullptr;
+  int8_t (*wNAF_alloc)[EC_MAX_BYTES * 8 + 1] = nullptr;
 
   // These fields point either to the stack or heap buffers of the same name.
   int8_t(*wNAF)[EC_MAX_BYTES * 8 + 1];
@@ -153,12 +153,12 @@
   } else {
     wNAF_alloc = reinterpret_cast<decltype(wNAF_alloc)>(
         OPENSSL_calloc(num, sizeof(wNAF_alloc[0])));
-    if (wNAF_alloc == NULL) {
+    if (wNAF_alloc == nullptr) {
       return 0;
     }
     precomp_alloc = reinterpret_cast<decltype(precomp_alloc)>(
         OPENSSL_calloc(num, sizeof(precomp_alloc[0])));
-    if (precomp_alloc == NULL) {
+    if (precomp_alloc == nullptr) {
       OPENSSL_free(wNAF_alloc);
       return 0;
     }
@@ -171,7 +171,7 @@
   EC_JACOBIAN g_precomp[EC_WNAF_TABLE_SIZE];
   assert(wNAF_len <= std::size(g_wNAF));
   const EC_JACOBIAN *g = &group->generator.raw;
-  if (g_scalar != NULL) {
+  if (g_scalar != nullptr) {
     ec_compute_wNAF(group, g_wNAF, g_scalar, bits, EC_WNAF_WINDOW_BITS);
     compute_precomp(group, g_precomp, g, EC_WNAF_TABLE_SIZE);
   }
@@ -189,7 +189,7 @@
       ec_GFp_mont_dbl(group, r, r);
     }
 
-    if (g_scalar != NULL && g_wNAF[k] != 0) {
+    if (g_scalar != nullptr && g_wNAF[k] != 0) {
       lookup_precomp(group, &tmp, g_precomp, g_wNAF[k]);
       if (r_is_at_infinity) {
         ec_GFp_simple_point_copy(r, &tmp);

diff --git a/crypto/fipsmodule/ecdh/ecdh.cc.inc b/crypto/fipsmodule/ecdh/ecdh.cc.inc
index 3c3832c..3592a69 100644
--- a/crypto/fipsmodule/ecdh/ecdh.cc.inc
+++ b/crypto/fipsmodule/ecdh/ecdh.cc.inc

@@ -23,6 +23,7 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../ec/internal.h"
 #include "../service_indicator/internal.h"
 
@@ -31,13 +32,13 @@
                           const EC_KEY *priv_key) {
   boringssl_ensure_ecc_self_test();
 
-  if (priv_key->priv_key == NULL) {
+  if (priv_key->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(ECDH, ECDH_R_NO_PRIVATE_VALUE);
     return 0;
   }
   const EC_SCALAR *const priv = &priv_key->priv_key->scalar;
   const EC_GROUP *const group = EC_KEY_get0_group(priv_key);
-  if (EC_GROUP_cmp(group, pub_key->group, NULL) != 0) {
+  if (EC_GROUP_cmp(group, pub_key->group, nullptr) != 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
     return 0;
   }

diff --git a/crypto/fipsmodule/ecdsa/ecdsa.cc.inc b/crypto/fipsmodule/ecdsa/ecdsa.cc.inc
index d2dcc38..64ff0d8 100644
--- a/crypto/fipsmodule/ecdsa/ecdsa.cc.inc
+++ b/crypto/fipsmodule/ecdsa/ecdsa.cc.inc

@@ -62,7 +62,7 @@
                                     const EC_KEY *eckey) {
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
   const EC_POINT *pub_key = EC_KEY_get0_public_key(eckey);
-  if (group == NULL || pub_key == NULL || sig == NULL) {
+  if (group == nullptr || pub_key == nullptr || sig == nullptr) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_MISSING_PARAMETERS);
     return 0;
   }
@@ -195,7 +195,7 @@
   }
 
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
-  if (group == NULL || eckey->priv_key == NULL) {
+  if (group == nullptr || eckey->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -221,7 +221,7 @@
   }
 
   const EC_GROUP *group = EC_KEY_get0_group(eckey);
-  if (group == NULL || eckey->priv_key == NULL) {
+  if (group == nullptr || eckey->priv_key == nullptr) {
     OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }

diff --git a/crypto/fipsmodule/entropy/jitter.cc.inc b/crypto/fipsmodule/entropy/jitter.cc.inc
index af9993b..19c7fbf 100644
--- a/crypto/fipsmodule/entropy/jitter.cc.inc
+++ b/crypto/fipsmodule/entropy/jitter.cc.inc

@@ -153,7 +153,7 @@
  private:
   bool initialized_ = false;
   T sub_sampler_;
-  uint64_t last_sample_;
+  uint64_t last_sample_ = 0;
 };
 
 template <typename U>

diff --git a/crypto/fipsmodule/hkdf/hkdf.cc.inc b/crypto/fipsmodule/hkdf/hkdf.cc.inc
index ee04818..bf496b3 100644
--- a/crypto/fipsmodule/hkdf/hkdf.cc.inc
+++ b/crypto/fipsmodule/hkdf/hkdf.cc.inc

@@ -47,7 +47,8 @@
   // If salt is not given, HashLength zeros are used. However, HMAC does that
   // internally already so we can ignore it.
   unsigned len;
-  if (HMAC(digest, salt, salt_len, secret, secret_len, out_key, &len) == NULL) {
+  if (HMAC(digest, salt, salt_len, secret, secret_len, out_key, &len) ==
+      nullptr) {
     OPENSSL_PUT_ERROR(HKDF, ERR_R_HMAC_LIB);
     return 0;
   }
@@ -75,7 +76,7 @@
   }
 
   HMAC_CTX_init(&hmac);
-  if (!HMAC_Init_ex(&hmac, prk, prk_len, digest, NULL)) {
+  if (!HMAC_Init_ex(&hmac, prk, prk_len, digest, nullptr)) {
     goto out;
   }
 
@@ -83,13 +84,12 @@
     uint8_t ctr = i + 1;
     size_t todo;
 
-    if (i != 0 && (!HMAC_Init_ex(&hmac, NULL, 0, NULL, NULL) ||
+    if (i != 0 && (!HMAC_Init_ex(&hmac, nullptr, 0, nullptr, nullptr) ||
                    !HMAC_Update(&hmac, previous, digest_len))) {
       goto out;
     }
-    if (!HMAC_Update(&hmac, info, info_len) ||
-        !HMAC_Update(&hmac, &ctr, 1) ||
-        !HMAC_Final(&hmac, previous, NULL)) {
+    if (!HMAC_Update(&hmac, info, info_len) || !HMAC_Update(&hmac, &ctr, 1) ||
+        !HMAC_Final(&hmac, previous, nullptr)) {
       goto out;
     }
 

diff --git a/crypto/fipsmodule/hmac/hmac.cc.inc b/crypto/fipsmodule/hmac/hmac.cc.inc
index 9007783..59890b9 100644
--- a/crypto/fipsmodule/hmac/hmac.cc.inc
+++ b/crypto/fipsmodule/hmac/hmac.cc.inc

@@ -33,7 +33,7 @@
   // The underlying hash functions should not set the FIPS service indicator
   // until all operations have completed.
   FIPS_service_indicator_lock_state();
-  const int ok = HMAC_Init_ex(&ctx, key, key_len, evp_md, NULL) &&
+  const int ok = HMAC_Init_ex(&ctx, key, key_len, evp_md, nullptr) &&
                  HMAC_Update(&ctx, data, data_len) &&
                  HMAC_Final(&ctx, out, out_len);
   FIPS_service_indicator_unlock_state();
@@ -41,7 +41,7 @@
   HMAC_CTX_cleanup(&ctx);
 
   if (!ok) {
-    return NULL;
+    return nullptr;
   }
 
   HMAC_verify_service_indicator(evp_md);
@@ -49,7 +49,7 @@
 }
 
 void HMAC_CTX_init(HMAC_CTX *ctx) {
-  ctx->md = NULL;
+  ctx->md = nullptr;
   EVP_MD_CTX_init(&ctx->i_ctx);
   EVP_MD_CTX_init(&ctx->o_ctx);
   EVP_MD_CTX_init(&ctx->md_ctx);
@@ -58,7 +58,7 @@
 HMAC_CTX *HMAC_CTX_new(void) {
   HMAC_CTX *ctx =
       reinterpret_cast<HMAC_CTX *>(OPENSSL_malloc(sizeof(HMAC_CTX)));
-  if (ctx != NULL) {
+  if (ctx != nullptr) {
     HMAC_CTX_init(ctx);
   }
   return ctx;
@@ -79,7 +79,7 @@
 }
 
 void HMAC_CTX_free(HMAC_CTX *ctx) {
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return;
   }
 
@@ -92,7 +92,7 @@
   int ret = 0;
   FIPS_service_indicator_lock_state();
 
-  if (md == NULL) {
+  if (md == nullptr) {
     md = ctx->md;
   }
 
@@ -103,7 +103,7 @@
   // ambiguous between using the empty key and reusing the previous key. There
   // exist callers which intend the latter, but the former is an awkward edge
   // case. Fix to API to avoid this.
-  if (md != ctx->md || key != NULL) {
+  if (md != ctx->md || key != nullptr) {
     uint8_t pad[EVP_MAX_MD_BLOCK_SIZE];
     uint8_t key_block[EVP_MAX_MD_BLOCK_SIZE];
     unsigned key_block_len;
@@ -207,7 +207,7 @@
   if (key && md) {
     HMAC_CTX_init(ctx);
   }
-  return HMAC_Init_ex(ctx, key, key_len, md, NULL);
+  return HMAC_Init_ex(ctx, key, key_len, md, nullptr);
 }
 
 int HMAC_CTX_copy(HMAC_CTX *dest, const HMAC_CTX *src) {

diff --git a/crypto/fipsmodule/rand/ctrdrbg.cc.inc b/crypto/fipsmodule/rand/ctrdrbg.cc.inc
index 994ef5c..a4b15ef 100644
--- a/crypto/fipsmodule/rand/ctrdrbg.cc.inc
+++ b/crypto/fipsmodule/rand/ctrdrbg.cc.inc

@@ -149,11 +149,11 @@
                              size_t personalization_len) {
   CTR_DRBG_STATE *drbg = reinterpret_cast<CTR_DRBG_STATE *>(
       OPENSSL_malloc(sizeof(CTR_DRBG_STATE)));
-  if (drbg == NULL ||
+  if (drbg == nullptr ||
       !CTR_DRBG_init(drbg, /*df=*/false, entropy, CTR_DRBG_ENTROPY_LEN,
                      /*nonce=*/nullptr, personalization, personalization_len)) {
     CTR_DRBG_free(drbg);
-    return NULL;
+    return nullptr;
   }
 
   return drbg;
@@ -165,11 +165,11 @@
                                 size_t personalization_len) {
   CTR_DRBG_STATE *drbg = reinterpret_cast<CTR_DRBG_STATE *>(
       OPENSSL_malloc(sizeof(CTR_DRBG_STATE)));
-  if (drbg == NULL ||
+  if (drbg == nullptr ||
       !CTR_DRBG_init(drbg, /*df=*/true, entropy, entropy_len, nonce,
                      personalization, personalization_len)) {
     CTR_DRBG_free(drbg);
-    return NULL;
+    return nullptr;
   }
 
   return drbg;
@@ -227,7 +227,8 @@
   }
 
   drbg->df = df;
-  drbg->ctr = aes_ctr_set_key(&drbg->ks, NULL, &drbg->block, seed_material, 32);
+  drbg->ctr =
+      aes_ctr_set_key(&drbg->ks, nullptr, &drbg->block, seed_material, 32);
   OPENSSL_memcpy(drbg->counter, seed_material + 32, 16);
   drbg->reseed_counter = 1;
 
@@ -256,7 +257,7 @@
     temp[i] ^= data[i];
   }
 
-  drbg->ctr = aes_ctr_set_key(&drbg->ks, NULL, &drbg->block, temp, 32);
+  drbg->ctr = aes_ctr_set_key(&drbg->ks, nullptr, &drbg->block, temp, 32);
   OPENSSL_memcpy(drbg->counter, temp + 32, 16);
 
   return 1;

diff --git a/crypto/fipsmodule/rand/rand.cc.inc b/crypto/fipsmodule/rand/rand.cc.inc
index be181e9..1b30551 100644
--- a/crypto/fipsmodule/rand/rand.cc.inc
+++ b/crypto/fipsmodule/rand/rand.cc.inc

@@ -71,8 +71,8 @@
 #if defined(BORINGSSL_FIPS)
   // last_block contains the previous block from |get_seed_entropy|.
   uint8_t last_block[CRNGT_BLOCK_SIZE];
-  // next and prev form a NULL-terminated, double-linked list of all states in
-  // a process.
+  // next and prev form a nullptr-terminated, double-linked list of all states
+  // in a process.
   struct rand_thread_state *next, *prev;
   // clear_drbg_lock synchronizes between uses of |drbg| and
   // |rand_thread_state_clear_all| clearing it. This lock should be uncontended
@@ -94,7 +94,7 @@
 static void rand_thread_state_clear_all(void) {
   CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get());
   for (struct rand_thread_state *cur = *thread_states_list_bss_get();
-       cur != NULL; cur = cur->next) {
+       cur != nullptr; cur = cur->next) {
     CRYPTO_MUTEX_lock_write(&cur->clear_drbg_lock);
     CTR_DRBG_clear(&cur->drbg);
   }
@@ -111,23 +111,23 @@
   struct rand_thread_state *state =
       reinterpret_cast<rand_thread_state *>(state_in);
 
-  if (state_in == NULL) {
+  if (state_in == nullptr) {
     return;
   }
 
 #if defined(BORINGSSL_FIPS)
   CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get());
 
-  if (state->prev != NULL) {
+  if (state->prev != nullptr) {
     state->prev->next = state->next;
   } else if (*thread_states_list_bss_get() == state) {
-    // |state->prev| may be NULL either if it is the head of the list,
+    // |state->prev| may be nullptr either if it is the head of the list,
     // or if |state| is freed before it was added to the list at all.
     // Compare against the head of the list to distinguish these cases.
     *thread_states_list_bss_get() = state->next;
   }
 
-  if (state->next != NULL) {
+  if (state->next != nullptr) {
     state->next->prev = state->prev;
   }
 
@@ -366,10 +366,10 @@
   struct rand_thread_state *state = reinterpret_cast<rand_thread_state *>(
       CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_RAND));
 
-  if (state == NULL) {
+  if (state == nullptr) {
     state = reinterpret_cast<rand_thread_state *>(
         OPENSSL_zalloc(sizeof(struct rand_thread_state)));
-    if (state == NULL ||
+    if (state == nullptr ||
         !CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_RAND, state,
                                  rand_thread_state_free)) {
       // If the system is out of memory, use an ephemeral state on the
@@ -397,10 +397,10 @@
       CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get());
       struct rand_thread_state **states_list = thread_states_list_bss_get();
       state->next = *states_list;
-      if (state->next != NULL) {
+      if (state->next != nullptr) {
         state->next->prev = state;
       }
-      state->prev = NULL;
+      state->prev = nullptr;
       *states_list = state;
       CRYPTO_MUTEX_unlock_write(thread_states_list_lock_bss_get());
     }

diff --git a/crypto/fipsmodule/rsa/blinding.cc.inc b/crypto/fipsmodule/rsa/blinding.cc.inc
index b3bf4da..75e98e1 100644
--- a/crypto/fipsmodule/rsa/blinding.cc.inc
+++ b/crypto/fipsmodule/rsa/blinding.cc.inc

@@ -21,6 +21,7 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bn/internal.h"
 #include "internal.h"
 
 
@@ -38,17 +39,17 @@
 BN_BLINDING *BN_BLINDING_new(void) {
   BN_BLINDING *ret =
       reinterpret_cast<BN_BLINDING *>(OPENSSL_zalloc(sizeof(BN_BLINDING)));
-  if (ret == NULL) {
-    return NULL;
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   ret->A = BN_new();
-  if (ret->A == NULL) {
+  if (ret->A == nullptr) {
     goto err;
   }
 
   ret->Ai = BN_new();
-  if (ret->Ai == NULL) {
+  if (ret->Ai == nullptr) {
     goto err;
   }
 
@@ -59,7 +60,7 @@
 
 err:
   BN_BLINDING_free(ret);
-  return NULL;
+  return nullptr;
 }
 
 void BN_BLINDING_free(BN_BLINDING *r) {

diff --git a/crypto/fipsmodule/rsa/padding.cc.inc b/crypto/fipsmodule/rsa/padding.cc.inc
index 726d23d..8d65b81 100644
--- a/crypto/fipsmodule/rsa/padding.cc.inc
+++ b/crypto/fipsmodule/rsa/padding.cc.inc

@@ -166,12 +166,12 @@
 int RSA_verify_PKCS1_PSS_mgf1(const RSA *rsa, const uint8_t *mHash,
                               const EVP_MD *Hash, const EVP_MD *mgf1Hash,
                               const uint8_t *EM, int sLen) {
-  if (mgf1Hash == NULL) {
+  if (mgf1Hash == nullptr) {
     mgf1Hash = Hash;
   }
 
   int ret = 0;
-  uint8_t *DB = NULL;
+  uint8_t *DB = nullptr;
   const uint8_t *H;
   bssl::ScopedEVP_MD_CTX ctx;
   unsigned MSBits;
@@ -242,11 +242,11 @@
     goto err;
   }
   uint8_t H_[EVP_MAX_MD_SIZE];
-  if (!EVP_DigestInit_ex(ctx.get(), Hash, NULL) ||
+  if (!EVP_DigestInit_ex(ctx.get(), Hash, nullptr) ||
       !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) ||
       !EVP_DigestUpdate(ctx.get(), mHash, hLen) ||
       !EVP_DigestUpdate(ctx.get(), DB + salt_start, maskedDBLen - salt_start) ||
-      !EVP_DigestFinal_ex(ctx.get(), H_, NULL)) {
+      !EVP_DigestFinal_ex(ctx.get(), H_, nullptr)) {
     goto err;
   }
   if (OPENSSL_memcmp(H_, H, hLen) != 0) {
@@ -270,9 +270,9 @@
   bssl::ScopedEVP_MD_CTX ctx;
   size_t maskedDBLen, MSBits, emLen;
   size_t hLen;
-  unsigned char *H, *salt = NULL, *p;
+  unsigned char *H, *salt = nullptr, *p;
 
-  if (mgf1Hash == NULL) {
+  if (mgf1Hash == nullptr) {
     mgf1Hash = Hash;
   }
 
@@ -326,11 +326,11 @@
   maskedDBLen = emLen - hLen - 1;
   H = EM + maskedDBLen;
 
-  if (!EVP_DigestInit_ex(ctx.get(), Hash, NULL) ||
+  if (!EVP_DigestInit_ex(ctx.get(), Hash, nullptr) ||
       !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) ||
       !EVP_DigestUpdate(ctx.get(), mHash, hLen) ||
       !EVP_DigestUpdate(ctx.get(), salt, sLen) ||
-      !EVP_DigestFinal_ex(ctx.get(), H, NULL)) {
+      !EVP_DigestFinal_ex(ctx.get(), H, nullptr)) {
     goto err;
   }
 

diff --git a/crypto/fipsmodule/rsa/rsa.cc.inc b/crypto/fipsmodule/rsa/rsa.cc.inc
index 11162ae..bf9b16f 100644
--- a/crypto/fipsmodule/rsa/rsa.cc.inc
+++ b/crypto/fipsmodule/rsa/rsa.cc.inc

@@ -43,24 +43,24 @@
 DEFINE_STATIC_EX_DATA_CLASS(g_rsa_ex_data_class)
 
 static int bn_dup_into(BIGNUM **dst, const BIGNUM *src) {
-  if (src == NULL) {
+  if (src == nullptr) {
     OPENSSL_PUT_ERROR(RSA, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
   BN_free(*dst);
   *dst = BN_dup(src);
-  return *dst != NULL;
+  return *dst != nullptr;
 }
 
 RSA *RSA_new_public_key(const BIGNUM *n, const BIGNUM *e) {
   RSA *rsa = RSA_new();
-  if (rsa == NULL ||               //
+  if (rsa == nullptr ||            //
       !bn_dup_into(&rsa->n, n) ||  //
       !bn_dup_into(&rsa->e, e) ||  //
       !RSA_check_key(rsa)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -70,7 +70,7 @@
                          const BIGNUM *p, const BIGNUM *q, const BIGNUM *dmp1,
                          const BIGNUM *dmq1, const BIGNUM *iqmp) {
   RSA *rsa = RSA_new();
-  if (rsa == NULL ||                     //
+  if (rsa == nullptr ||                  //
       !bn_dup_into(&rsa->n, n) ||        //
       !bn_dup_into(&rsa->e, e) ||        //
       !bn_dup_into(&rsa->d, d) ||        //
@@ -81,7 +81,7 @@
       !bn_dup_into(&rsa->iqmp, iqmp) ||  //
       !RSA_check_key(rsa)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -90,13 +90,13 @@
 RSA *RSA_new_private_key_no_crt(const BIGNUM *n, const BIGNUM *e,
                                 const BIGNUM *d) {
   RSA *rsa = RSA_new();
-  if (rsa == NULL ||               //
+  if (rsa == nullptr ||            //
       !bn_dup_into(&rsa->n, n) ||  //
       !bn_dup_into(&rsa->e, e) ||  //
       !bn_dup_into(&rsa->d, d) ||  //
       !RSA_check_key(rsa)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -104,8 +104,8 @@
 
 RSA *RSA_new_private_key_no_e(const BIGNUM *n, const BIGNUM *d) {
   RSA *rsa = RSA_new();
-  if (rsa == NULL) {
-    return NULL;
+  if (rsa == nullptr) {
+    return nullptr;
   }
 
   rsa->flags |= RSA_FLAG_NO_PUBLIC_EXPONENT;
@@ -113,7 +113,7 @@
       !bn_dup_into(&rsa->d, d) ||  //
       !RSA_check_key(rsa)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -121,8 +121,8 @@
 
 RSA *RSA_new_public_key_large_e(const BIGNUM *n, const BIGNUM *e) {
   RSA *rsa = RSA_new();
-  if (rsa == NULL) {
-    return NULL;
+  if (rsa == nullptr) {
+    return nullptr;
   }
 
   rsa->flags |= RSA_FLAG_LARGE_PUBLIC_EXPONENT;
@@ -130,7 +130,7 @@
       !bn_dup_into(&rsa->e, e) ||  //
       !RSA_check_key(rsa)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -141,8 +141,8 @@
                                  const BIGNUM *q, const BIGNUM *dmp1,
                                  const BIGNUM *dmq1, const BIGNUM *iqmp) {
   RSA *rsa = RSA_new();
-  if (rsa == NULL) {
-    return NULL;
+  if (rsa == nullptr) {
+    return nullptr;
   }
 
   rsa->flags |= RSA_FLAG_LARGE_PUBLIC_EXPONENT;
@@ -156,25 +156,25 @@
       !bn_dup_into(&rsa->iqmp, iqmp) ||  //
       !RSA_check_key(rsa)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
 }
 
-RSA *RSA_new(void) { return RSA_new_method(NULL); }
+RSA *RSA_new(void) { return RSA_new_method(nullptr); }
 
 RSA *RSA_new_method(const ENGINE *engine) {
   RSA *rsa = reinterpret_cast<RSA *>(OPENSSL_zalloc(sizeof(RSA)));
-  if (rsa == NULL) {
-    return NULL;
+  if (rsa == nullptr) {
+    return nullptr;
   }
 
   if (engine) {
     rsa->meth = ENGINE_get_RSA_method(engine);
   }
 
-  if (rsa->meth == NULL) {
+  if (rsa->meth == nullptr) {
     rsa->meth = (RSA_METHOD *)RSA_default_method();
   }
   METHOD_ref(rsa->meth);
@@ -187,7 +187,7 @@
   if (rsa->meth->init && !rsa->meth->init(rsa)) {
     rsa->meth = nullptr;
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -195,16 +195,16 @@
 
 RSA *RSA_new_method_no_e(const ENGINE *engine, const BIGNUM *n) {
   RSA *rsa = RSA_new_method(engine);
-  if (rsa == NULL || !bn_dup_into(&rsa->n, n)) {
+  if (rsa == nullptr || !bn_dup_into(&rsa->n, n)) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
   rsa->flags |= RSA_FLAG_NO_PUBLIC_EXPONENT;
   return rsa;
 }
 
 void RSA_free(RSA *rsa) {
-  if (rsa == NULL) {
+  if (rsa == nullptr) {
     return;
   }
 
@@ -257,54 +257,55 @@
 
 void RSA_get0_key(const RSA *rsa, const BIGNUM **out_n, const BIGNUM **out_e,
                   const BIGNUM **out_d) {
-  if (out_n != NULL) {
+  if (out_n != nullptr) {
     *out_n = rsa->n;
   }
-  if (out_e != NULL) {
+  if (out_e != nullptr) {
     *out_e = rsa->e;
   }
-  if (out_d != NULL) {
+  if (out_d != nullptr) {
     *out_d = rsa->d;
   }
 }
 
 void RSA_get0_factors(const RSA *rsa, const BIGNUM **out_p,
                       const BIGNUM **out_q) {
-  if (out_p != NULL) {
+  if (out_p != nullptr) {
     *out_p = rsa->p;
   }
-  if (out_q != NULL) {
+  if (out_q != nullptr) {
     *out_q = rsa->q;
   }
 }
 
 void RSA_get0_crt_params(const RSA *rsa, const BIGNUM **out_dmp1,
                          const BIGNUM **out_dmq1, const BIGNUM **out_iqmp) {
-  if (out_dmp1 != NULL) {
+  if (out_dmp1 != nullptr) {
     *out_dmp1 = rsa->dmp1;
   }
-  if (out_dmq1 != NULL) {
+  if (out_dmq1 != nullptr) {
     *out_dmq1 = rsa->dmq1;
   }
-  if (out_iqmp != NULL) {
+  if (out_iqmp != nullptr) {
     *out_iqmp = rsa->iqmp;
   }
 }
 
 int RSA_set0_key(RSA *rsa, BIGNUM *n, BIGNUM *e, BIGNUM *d) {
-  if ((rsa->n == NULL && n == NULL) || (rsa->e == NULL && e == NULL)) {
+  if ((rsa->n == nullptr && n == nullptr) ||
+      (rsa->e == nullptr && e == nullptr)) {
     return 0;
   }
 
-  if (n != NULL) {
+  if (n != nullptr) {
     BN_free(rsa->n);
     rsa->n = n;
   }
-  if (e != NULL) {
+  if (e != nullptr) {
     BN_free(rsa->e);
     rsa->e = e;
   }
-  if (d != NULL) {
+  if (d != nullptr) {
     BN_free(rsa->d);
     rsa->d = d;
   }
@@ -314,15 +315,16 @@
 }
 
 int RSA_set0_factors(RSA *rsa, BIGNUM *p, BIGNUM *q) {
-  if ((rsa->p == NULL && p == NULL) || (rsa->q == NULL && q == NULL)) {
+  if ((rsa->p == nullptr && p == nullptr) ||
+      (rsa->q == nullptr && q == nullptr)) {
     return 0;
   }
 
-  if (p != NULL) {
+  if (p != nullptr) {
     BN_free(rsa->p);
     rsa->p = p;
   }
-  if (q != NULL) {
+  if (q != nullptr) {
     BN_free(rsa->q);
     rsa->q = q;
   }
@@ -332,21 +334,21 @@
 }
 
 int RSA_set0_crt_params(RSA *rsa, BIGNUM *dmp1, BIGNUM *dmq1, BIGNUM *iqmp) {
-  if ((rsa->dmp1 == NULL && dmp1 == NULL) ||
-      (rsa->dmq1 == NULL && dmq1 == NULL) ||
-      (rsa->iqmp == NULL && iqmp == NULL)) {
+  if ((rsa->dmp1 == nullptr && dmp1 == nullptr) ||
+      (rsa->dmq1 == nullptr && dmq1 == nullptr) ||
+      (rsa->iqmp == nullptr && iqmp == nullptr)) {
     return 0;
   }
 
-  if (dmp1 != NULL) {
+  if (dmp1 != nullptr) {
     BN_free(rsa->dmp1);
     rsa->dmp1 = dmp1;
   }
-  if (dmq1 != NULL) {
+  if (dmq1 != nullptr) {
     BN_free(rsa->dmq1);
     rsa->dmq1 = dmq1;
   }
-  if (iqmp != NULL) {
+  if (iqmp != nullptr) {
     BN_free(rsa->iqmp);
     rsa->iqmp = iqmp;
   }
@@ -554,7 +556,7 @@
 
   const unsigned rsa_size = RSA_size(rsa);
   int ret = 0;
-  uint8_t *signed_msg = NULL;
+  uint8_t *signed_msg = nullptr;
   size_t signed_msg_len = 0;
   int signed_msg_is_alloced = 0;
   size_t size_t_out_len;
@@ -599,7 +601,7 @@
 
   size_t padded_len = RSA_size(rsa);
   uint8_t *padded = reinterpret_cast<uint8_t *>(OPENSSL_malloc(padded_len));
-  if (padded == NULL) {
+  if (padded == nullptr) {
     return 0;
   }
 
@@ -614,15 +616,15 @@
 int rsa_verify_no_self_test(int hash_nid, const uint8_t *digest,
                             size_t digest_len, const uint8_t *sig,
                             size_t sig_len, RSA *rsa) {
-  if (rsa->n == NULL || rsa->e == NULL) {
+  if (rsa->n == nullptr || rsa->e == nullptr) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
     return 0;
   }
 
   const size_t rsa_size = RSA_size(rsa);
-  uint8_t *buf = NULL;
+  uint8_t *buf = nullptr;
   int ret = 0;
-  uint8_t *signed_msg = NULL;
+  uint8_t *signed_msg = nullptr;
   size_t signed_msg_len = 0, len;
   int signed_msg_is_alloced = 0;
 
@@ -678,7 +680,7 @@
 
   size_t em_len = RSA_size(rsa);
   uint8_t *em = reinterpret_cast<uint8_t *>(OPENSSL_malloc(em_len));
-  if (em == NULL) {
+  if (em == nullptr) {
     return 0;
   }
 
@@ -715,7 +717,7 @@
   BIGNUM *tmp = BN_CTX_get(ctx);
   if (tmp == nullptr ||  //
       !bn_mul_consttime(tmp, a, ainv, ctx) ||
-      !bn_div_consttime(NULL, tmp, tmp, m, m_min_bits, ctx)) {
+      !bn_div_consttime(nullptr, tmp, tmp, m, m_min_bits, ctx)) {
     return 0;
   }
   *out_ok = constant_time_declassify_int(BN_is_one(tmp));
@@ -733,27 +735,27 @@
     return 0;
   }
 
-  if ((key->p != NULL) != (key->q != NULL)) {
+  if ((key->p != nullptr) != (key->q != nullptr)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_ONLY_ONE_OF_P_Q_GIVEN);
     return 0;
   }
 
   // |key->d| must be bounded by |key->n|. This ensures bounds on |RSA_bits|
   // translate to bounds on the running time of private key operations.
-  if (key->d != NULL &&
+  if (key->d != nullptr &&
       (BN_is_negative(key->d) || BN_cmp(key->d, key->n) >= 0)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_D_OUT_OF_RANGE);
     return 0;
   }
 
-  if (key->d == NULL || key->p == NULL) {
+  if (key->d == nullptr || key->p == nullptr) {
     // For a public key, or without p and q, there's nothing that can be
     // checked.
     return 1;
   }
 
   BN_CTX *ctx = BN_CTX_new();
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return 0;
   }
 
@@ -799,8 +801,8 @@
   pm1_bits = BN_num_bits(&pm1);
   qm1_bits = BN_num_bits(&qm1);
   if (!bn_mul_consttime(&de, key->d, key->e, ctx) ||
-      !bn_div_consttime(NULL, &tmp, &de, &pm1, pm1_bits, ctx) ||
-      !bn_div_consttime(NULL, &de, &de, &qm1, qm1_bits, ctx)) {
+      !bn_div_consttime(nullptr, &tmp, &de, &pm1, pm1_bits, ctx) ||
+      !bn_div_consttime(nullptr, &de, &de, &qm1, qm1_bits, ctx)) {
     OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
     goto out;
   }
@@ -811,9 +813,9 @@
     goto out;
   }
 
-  has_crt_values = key->dmp1 != NULL;
-  if (has_crt_values != (key->dmq1 != NULL) ||
-      has_crt_values != (key->iqmp != NULL)) {
+  has_crt_values = key->dmp1 != nullptr;
+  if (has_crt_values != (key->dmq1 != nullptr) ||
+      has_crt_values != (key->iqmp != nullptr)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_INCONSISTENT_SET_OF_CRT_VALUES);
     goto out;
   }
@@ -884,7 +886,7 @@
   }
 
   BN_CTX *ctx = BN_CTX_new();
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return 0;
   }
 
@@ -911,7 +913,7 @@
       !BN_is_one(&small_gcd) ||
       !BN_enhanced_miller_rabin_primality_test(&primality_result, key->n,
                                                BN_prime_checks_for_generation,
-                                               ctx, NULL) ||
+                                               ctx, nullptr) ||
       primality_result != bn_non_prime_power_composite) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_PUBLIC_KEY_VALIDATION_FAILED);
     ret = 0;
@@ -920,7 +922,7 @@
   BN_free(&small_gcd);
   BN_CTX_free(ctx);
 
-  if (!ret || key->d == NULL || key->p == NULL) {
+  if (!ret || key->d == nullptr || key->p == nullptr) {
     // On a failure or on only a public key, there's nothing else can be
     // checked.
     return ret;
@@ -933,7 +935,7 @@
   uint8_t data[32] = {0};
   unsigned sig_len = RSA_size(key);
   uint8_t *sig = reinterpret_cast<uint8_t *>(OPENSSL_malloc(sig_len));
-  if (sig == NULL) {
+  if (sig == nullptr) {
     return 0;
   }
 

diff --git a/crypto/fipsmodule/rsa/rsa_impl.cc.inc b/crypto/fipsmodule/rsa/rsa_impl.cc.inc
index 5305f89..11b1494 100644
--- a/crypto/fipsmodule/rsa/rsa_impl.cc.inc
+++ b/crypto/fipsmodule/rsa/rsa_impl.cc.inc

@@ -37,7 +37,7 @@
               "Max RSA size too big for Montgomery arithmetic");
 
 int rsa_check_public_key(const RSA *rsa) {
-  if (rsa->n == NULL) {
+  if (rsa->n == nullptr) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
     return 0;
   }
@@ -63,7 +63,7 @@
   }
 
   static const unsigned kMaxExponentBits = 33;
-  if (rsa->e != NULL) {
+  if (rsa->e != nullptr) {
     // Reject e = 1, negative e, and even e. e must be odd to be relatively
     // prime with phi(n).
     unsigned e_bits = BN_num_bits(rsa->e);
@@ -106,11 +106,11 @@
 }
 
 static int ensure_fixed_copy(BIGNUM **out, const BIGNUM *in, int width) {
-  if (*out != NULL) {
+  if (*out != nullptr) {
     return 1;
   }
   BIGNUM *copy = BN_dup(in);
-  if (copy == NULL || !bn_resize_words(copy, width)) {
+  if (copy == nullptr || !bn_resize_words(copy, width)) {
     BN_free(copy);
     return 0;
   }
@@ -151,9 +151,9 @@
   // copies. We use |mont_n->N|, |mont_p->N|, and |mont_q->N| as copies of |n|,
   // |p|, and |q| with the correct minimal widths.
 
-  if (rsa->mont_n == NULL) {
+  if (rsa->mont_n == nullptr) {
     rsa->mont_n = BN_MONT_CTX_new_for_modulus(rsa->n, ctx);
-    if (rsa->mont_n == NULL) {
+    if (rsa->mont_n == nullptr) {
       goto err;
     }
   }
@@ -163,32 +163,32 @@
   // ASN.1 serialization of RSA private keys unfortunately leaks the byte length
   // of |rsa->d|, but normalize it so we only leak it once, rather than per
   // operation.
-  if (rsa->d != NULL &&
+  if (rsa->d != nullptr &&
       !ensure_fixed_copy(&rsa->d_fixed, rsa->d, n_fixed->width)) {
     goto err;
   }
 
-  if (rsa->e != NULL && rsa->p != NULL && rsa->q != NULL) {
+  if (rsa->e != nullptr && rsa->p != nullptr && rsa->q != nullptr) {
     // TODO: p and q are also CONSTTIME_SECRET but not yet marked as such
     // because the Montgomery code does things like test whether or not values
     // are zero. So the secret marking probably needs to happen inside that
     // code.
 
-    if (rsa->mont_p == NULL) {
+    if (rsa->mont_p == nullptr) {
       rsa->mont_p = BN_MONT_CTX_new_consttime(rsa->p, ctx);
-      if (rsa->mont_p == NULL) {
+      if (rsa->mont_p == nullptr) {
         goto err;
       }
     }
 
-    if (rsa->mont_q == NULL) {
+    if (rsa->mont_q == nullptr) {
       rsa->mont_q = BN_MONT_CTX_new_consttime(rsa->q, ctx);
-      if (rsa->mont_q == NULL) {
+      if (rsa->mont_q == nullptr) {
         goto err;
       }
     }
 
-    if (rsa->dmp1 != NULL && rsa->dmq1 != NULL && rsa->iqmp != NULL) {
+    if (rsa->dmp1 != nullptr && rsa->dmq1 != nullptr && rsa->iqmp != nullptr) {
       // CRT components are only publicly bounded by their corresponding
       // moduli's bit lengths.
       const BIGNUM *p_fixed = &rsa->mont_p->N;
@@ -200,9 +200,9 @@
 
       // Compute |iqmp_mont|, which is |iqmp| in Montgomery form and with the
       // correct bit width.
-      if (rsa->iqmp_mont == NULL) {
+      if (rsa->iqmp_mont == nullptr) {
         BIGNUM *iqmp_mont = BN_new();
-        if (iqmp_mont == NULL ||
+        if (iqmp_mont == nullptr ||
             !BN_to_montgomery(iqmp_mont, rsa->iqmp, rsa->mont_p, ctx)) {
           BN_free(iqmp_mont);
           goto err;
@@ -225,29 +225,29 @@
   rsa->private_key_frozen = 0;
 
   BN_MONT_CTX_free(rsa->mont_n);
-  rsa->mont_n = NULL;
+  rsa->mont_n = nullptr;
   BN_MONT_CTX_free(rsa->mont_p);
-  rsa->mont_p = NULL;
+  rsa->mont_p = nullptr;
   BN_MONT_CTX_free(rsa->mont_q);
-  rsa->mont_q = NULL;
+  rsa->mont_q = nullptr;
 
   BN_free(rsa->d_fixed);
-  rsa->d_fixed = NULL;
+  rsa->d_fixed = nullptr;
   BN_free(rsa->dmp1_fixed);
-  rsa->dmp1_fixed = NULL;
+  rsa->dmp1_fixed = nullptr;
   BN_free(rsa->dmq1_fixed);
-  rsa->dmq1_fixed = NULL;
+  rsa->dmq1_fixed = nullptr;
   BN_free(rsa->iqmp_mont);
-  rsa->iqmp_mont = NULL;
+  rsa->iqmp_mont = nullptr;
 
   for (size_t i = 0; i < rsa->num_blindings; i++) {
     BN_BLINDING_free(rsa->blindings[i]);
   }
   OPENSSL_free(rsa->blindings);
-  rsa->blindings = NULL;
+  rsa->blindings = nullptr;
   rsa->num_blindings = 0;
   OPENSSL_free(rsa->blindings_inuse);
-  rsa->blindings_inuse = NULL;
+  rsa->blindings_inuse = nullptr;
   rsa->blinding_fork_generation = 0;
 }
 
@@ -270,10 +270,10 @@
 // |*index_used| and must be passed to |rsa_blinding_release| when finished.
 static BN_BLINDING *rsa_blinding_get(RSA *rsa, size_t *index_used,
                                      BN_CTX *ctx) {
-  assert(ctx != NULL);
-  assert(rsa->mont_n != NULL);
+  assert(ctx != nullptr);
+  assert(rsa->mont_n != nullptr);
 
-  BN_BLINDING *ret = NULL;
+  BN_BLINDING *ret = nullptr;
   const uint64_t fork_generation = CRYPTO_get_fork_generation();
   CRYPTO_MUTEX_lock_write(&rsa->lock);
 
@@ -294,7 +294,7 @@
   size_t new_num_blindings;
   BN_BLINDING **new_blindings;
   uint8_t *new_blindings_inuse;
-  if (free_inuse_flag != NULL) {
+  if (free_inuse_flag != nullptr) {
     *free_inuse_flag = 1;
     *index_used = free_inuse_flag - rsa->blindings_inuse;
     ret = rsa->blindings[*index_used];
@@ -326,7 +326,7 @@
       OPENSSL_calloc(new_num_blindings, sizeof(BN_BLINDING *)));
   new_blindings_inuse =
       reinterpret_cast<uint8_t *>(OPENSSL_malloc(new_num_blindings));
-  if (new_blindings == NULL || new_blindings_inuse == NULL) {
+  if (new_blindings == nullptr || new_blindings_inuse == nullptr) {
     goto err;
   }
 
@@ -336,7 +336,7 @@
 
   for (size_t i = rsa->num_blindings; i < new_num_blindings; i++) {
     new_blindings[i] = BN_BLINDING_new();
-    if (new_blindings[i] == NULL) {
+    if (new_blindings[i] == nullptr) {
       for (size_t j = rsa->num_blindings; j < i; j++) {
         BN_BLINDING_free(new_blindings[j]);
       }
@@ -388,7 +388,7 @@
                          size_t max_out, const uint8_t *in, size_t in_len,
                          int padding) {
   const unsigned rsa_size = RSA_size(rsa);
-  uint8_t *buf = NULL;
+  uint8_t *buf = nullptr;
   int i, ret = 0;
 
   if (max_out < rsa_size) {
@@ -397,7 +397,7 @@
   }
 
   buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
-  if (buf == NULL) {
+  if (buf == nullptr) {
     goto err;
   }
 
@@ -437,7 +437,7 @@
 int rsa_verify_raw_no_self_test(RSA *rsa, size_t *out_len, uint8_t *out,
                                 size_t max_out, const uint8_t *in,
                                 size_t in_len, int padding) {
-  if (rsa->n == NULL || rsa->e == NULL) {
+  if (rsa->n == nullptr || rsa->e == nullptr) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
     return 0;
   }
@@ -697,21 +697,21 @@
 }
 
 static int rsa_mod_exp_crt(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {
-  assert(ctx != NULL);
+  assert(ctx != nullptr);
 
-  assert(rsa->n != NULL);
-  assert(rsa->e != NULL);
-  assert(rsa->d != NULL);
-  assert(rsa->p != NULL);
-  assert(rsa->q != NULL);
-  assert(rsa->dmp1 != NULL);
-  assert(rsa->dmq1 != NULL);
-  assert(rsa->iqmp != NULL);
+  assert(rsa->n != nullptr);
+  assert(rsa->e != nullptr);
+  assert(rsa->d != nullptr);
+  assert(rsa->p != nullptr);
+  assert(rsa->q != nullptr);
+  assert(rsa->dmp1 != nullptr);
+  assert(rsa->dmq1 != nullptr);
+  assert(rsa->iqmp != nullptr);
 
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *r1 = BN_CTX_get(ctx);
   BIGNUM *m1 = BN_CTX_get(ctx);
-  if (r1 == NULL || m1 == NULL) {
+  if (r1 == nullptr || m1 == nullptr) {
     return 0;
   }
 
@@ -770,10 +770,10 @@
 }
 
 static int ensure_bignum(BIGNUM **out) {
-  if (*out == NULL) {
+  if (*out == nullptr) {
     *out = BN_new();
   }
-  return *out != NULL;
+  return *out != nullptr;
 }
 
 // kBoringSSLRSASqrtTwo is the BIGNUM representation of ⌊2²⁰⁴⁷×√2⌋. This is
@@ -900,7 +900,7 @@
   int tries = 0, rand_tries = 0;
   bssl::BN_CTXScope scope(ctx);
   BIGNUM *tmp = BN_CTX_get(ctx);
-  if (tmp == NULL) {
+  if (tmp == nullptr) {
     return 0;
   }
 
@@ -913,7 +913,7 @@
       return 0;
     }
 
-    if (p != NULL) {
+    if (p != nullptr) {
       // If |p| and |out| are too close, try again (step 5.4).
       if (!bn_abs_sub_consttime(tmp, out, p, ctx)) {
         return 0;
@@ -1166,13 +1166,13 @@
 static void replace_bignum(BIGNUM **out, BIGNUM **in) {
   BN_free(*out);
   *out = *in;
-  *in = NULL;
+  *in = nullptr;
 }
 
 static void replace_bn_mont_ctx(BN_MONT_CTX **out, BN_MONT_CTX **in) {
   BN_MONT_CTX_free(*out);
   *out = *in;
-  *in = NULL;
+  *in = nullptr;
 }
 
 static int RSA_generate_key_ex_maybe_fips(RSA *rsa, int bits,
@@ -1180,7 +1180,7 @@
                                           int check_fips) {
   boringssl_ensure_rsa_self_test();
 
-  if (rsa == NULL) {
+  if (rsa == nullptr) {
     OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
@@ -1253,7 +1253,7 @@
   }
 
   BIGNUM *e = BN_new();
-  int ret = e != NULL && BN_set_word(e, RSA_F4) &&
+  int ret = e != nullptr && BN_set_word(e, RSA_F4) &&
             RSA_generate_key_ex_maybe_fips(rsa, bits, e, cb, /*check_fips=*/1);
   BN_free(e);
 

diff --git a/crypto/fipsmodule/self_check/self_check.cc.inc b/crypto/fipsmodule/self_check/self_check.cc.inc
index 341ff58..13b4e13 100644
--- a/crypto/fipsmodule/self_check/self_check.cc.inc
+++ b/crypto/fipsmodule/self_check/self_check.cc.inc

@@ -77,8 +77,8 @@
 #else
 
 static int set_bignum(BIGNUM **out, const uint8_t *in, size_t len) {
-  *out = BN_bin2bn(in, len, NULL);
-  return *out != NULL;
+  *out = BN_bin2bn(in, len, nullptr);
+  return *out != nullptr;
 }
 
 static RSA *self_test_rsa_key(void) {
@@ -198,7 +198,7 @@
   };
 
   RSA *rsa = RSA_new();
-  if (rsa == NULL ||  //
+  if (rsa == nullptr ||  //
       !set_bignum(&rsa->n, kN, sizeof(kN)) ||
       !set_bignum(&rsa->e, kE, sizeof(kE)) ||
       !set_bignum(&rsa->d, kD, sizeof(kD)) ||
@@ -208,7 +208,7 @@
       !set_bignum(&rsa->dmq1, kDModQMinusOne, sizeof(kDModQMinusOne)) ||
       !set_bignum(&rsa->iqmp, kQInverseModP, sizeof(kQInverseModP))) {
     RSA_free(rsa);
-    return NULL;
+    return nullptr;
   }
 
   return rsa;
@@ -232,15 +232,15 @@
   };
 
   EC_KEY *ec_key = EC_KEY_new();
-  BIGNUM *qx = BN_bin2bn(kQx, sizeof(kQx), NULL);
-  BIGNUM *qy = BN_bin2bn(kQy, sizeof(kQy), NULL);
-  BIGNUM *d = BN_bin2bn(kD, sizeof(kD), NULL);
-  if (ec_key == NULL || qx == NULL || qy == NULL || d == NULL ||
+  BIGNUM *qx = BN_bin2bn(kQx, sizeof(kQx), nullptr);
+  BIGNUM *qy = BN_bin2bn(kQy, sizeof(kQy), nullptr);
+  BIGNUM *d = BN_bin2bn(kD, sizeof(kD), nullptr);
+  if (ec_key == nullptr || qx == nullptr || qy == nullptr || d == nullptr ||
       !EC_KEY_set_group(ec_key, EC_group_p256()) ||
       !EC_KEY_set_public_key_affine_coordinates(ec_key, qx, qy) ||
       !EC_KEY_set_private_key(ec_key, d)) {
     EC_KEY_free(ec_key);
-    ec_key = NULL;
+    ec_key = nullptr;
   }
 
   BN_free(qx);
@@ -252,7 +252,7 @@
 static DH *self_test_dh(void) {
   DH *dh = DH_get_rfc7919_2048();
   if (!dh) {
-    return NULL;
+    return nullptr;
   }
 
   BIGNUM *priv = BN_new();
@@ -273,7 +273,7 @@
   bn_set_static_words(priv, kFFDHE2048PrivateKeyData,
                       std::size(kFFDHE2048PrivateKeyData));
 
-  if (!DH_set0_key(dh, NULL, priv)) {
+  if (!DH_set0_key(dh, nullptr, priv)) {
     goto err;
   }
   return dh;
@@ -281,7 +281,7 @@
 err:
   BN_free(priv);
   DH_free(dh);
-  return NULL;
+  return nullptr;
 }
 
 
@@ -296,7 +296,7 @@
   uint8_t output[256];
 
   RSA *const rsa_key = self_test_rsa_key();
-  if (rsa_key == NULL) {
+  if (rsa_key == nullptr) {
     fprintf(CRYPTO_get_stderr(), "RSA key construction failed\n");
     goto err;
   }
@@ -393,18 +393,18 @@
 
 static int boringssl_self_test_ecc(void) {
   int ret = 0;
-  EC_KEY *ec_key = NULL;
-  EC_POINT *ec_point_in = NULL;
-  EC_POINT *ec_point_out = NULL;
-  BIGNUM *ec_scalar = NULL;
-  const EC_GROUP *ec_group = NULL;
+  EC_KEY *ec_key = nullptr;
+  EC_POINT *ec_point_in = nullptr;
+  EC_POINT *ec_point_out = nullptr;
+  BIGNUM *ec_scalar = nullptr;
+  const EC_GROUP *ec_group = nullptr;
 
   // The 'k' value for ECDSA is fixed to avoid an entropy draw.
   uint8_t ecdsa_k[32] = {0};
   ecdsa_k[31] = 42;
 
   ec_key = self_test_ecdsa_key();
-  if (ec_key == NULL) {
+  if (ec_key == nullptr) {
     fprintf(CRYPTO_get_stderr(), "ECDSA KeyGen failed\n");
     goto err;
   }
@@ -491,14 +491,15 @@
   ec_point_out = EC_POINT_new(ec_group);
   ec_scalar = BN_new();
   uint8_t z_comp_result[65];
-  if (ec_point_in == NULL || ec_point_out == NULL || ec_scalar == NULL ||
+  if (ec_point_in == nullptr || ec_point_out == nullptr ||
+      ec_scalar == nullptr ||
       !EC_POINT_oct2point(ec_group, ec_point_in, kP256Point, sizeof(kP256Point),
-                          NULL) ||
+                          nullptr) ||
       !BN_bin2bn(kP256Scalar, sizeof(kP256Scalar), ec_scalar) ||
-      !ec_point_mul_no_self_test(ec_group, ec_point_out, NULL, ec_point_in,
-                                 ec_scalar, NULL) ||
+      !ec_point_mul_no_self_test(ec_group, ec_point_out, nullptr, ec_point_in,
+                                 ec_scalar, nullptr) ||
       !EC_POINT_point2oct(ec_group, ec_point_out, POINT_CONVERSION_UNCOMPRESSED,
-                          z_comp_result, sizeof(z_comp_result), NULL) ||
+                          z_comp_result, sizeof(z_comp_result), nullptr) ||
       !BORINGSSL_check_test(kP256PointResult, z_comp_result,
                             sizeof(z_comp_result), "Z Computation Result")) {
     fprintf(CRYPTO_get_stderr(), "Z-computation KAT failed.\n");
@@ -518,8 +519,8 @@
 
 static int boringssl_self_test_ffdh(void) {
   int ret = 0;
-  DH *dh = NULL;
-  BIGNUM *ffdhe2048_value = NULL;
+  DH *dh = nullptr;
+  BIGNUM *ffdhe2048_value = nullptr;
 
   // FFC Diffie-Hellman KAT
 
@@ -576,7 +577,8 @@
 
   dh = self_test_dh();
   uint8_t dh_out[sizeof(kDHOutput)];
-  if (dh == NULL || ffdhe2048_value == NULL || sizeof(dh_out) != DH_size(dh) ||
+  if (dh == nullptr || ffdhe2048_value == nullptr ||
+      sizeof(dh_out) != DH_size(dh) ||
       dh_compute_key_padded_no_self_test(dh_out, ffdhe2048_value, dh) !=
           sizeof(dh_out) ||
       !BORINGSSL_check_test(kDHOutput, dh_out, sizeof(dh_out), "FFC DH")) {
@@ -696,8 +698,8 @@
   uint8_t output[EVP_MAX_MD_SIZE];
 
   unsigned output_len;
-  return NULL != HMAC(EVP_sha256(), kInput, sizeof(kInput), kInput,
-                      sizeof(kInput), output, &output_len) &&
+  return nullptr != HMAC(EVP_sha256(), kInput, sizeof(kInput), kInput,
+                         sizeof(kInput), output, &output_len) &&
          output_len == sizeof(kPlaintextHMACSHA256) &&
          BORINGSSL_check_test(kPlaintextHMACSHA256, output,
                               sizeof(kPlaintextHMACSHA256), "HMAC-SHA-256 KAT");
@@ -769,7 +771,7 @@
   OPENSSL_memset(nonce, 0, sizeof(nonce));
   bssl::ScopedEVP_AEAD_CTX aead_ctx;
   if (!EVP_AEAD_CTX_init(aead_ctx.get(), EVP_aead_aes_128_gcm(), kAESKey,
-                         sizeof(kAESKey), 0, NULL)) {
+                         sizeof(kAESKey), 0, nullptr)) {
     fprintf(CRYPTO_get_stderr(), "EVP_AEAD_CTX_init for AES-128-GCM failed.\n");
     return 0;
   }
@@ -788,8 +790,8 @@
   };
   if (!EVP_AEAD_CTX_seal(aead_ctx.get(), output, &out_len, sizeof(output),
                          nonce, EVP_AEAD_nonce_length(EVP_aead_aes_128_gcm()),
-                         kAESGCMEncPlaintext, sizeof(kAESGCMEncPlaintext), NULL,
-                         0) ||
+                         kAESGCMEncPlaintext, sizeof(kAESGCMEncPlaintext),
+                         nullptr, 0) ||
       !BORINGSSL_check_test(kAESGCMCiphertext, output,
                             sizeof(kAESGCMCiphertext), "AES-GCM-encrypt KAT")) {
     fprintf(CRYPTO_get_stderr(), "EVP_AEAD_CTX_seal for AES-128-GCM failed.\n");
@@ -812,7 +814,7 @@
   if (!EVP_AEAD_CTX_open(aead_ctx.get(), output, &out_len, sizeof(output),
                          nonce, EVP_AEAD_nonce_length(EVP_aead_aes_128_gcm()),
                          kAESGCMDecCiphertext, sizeof(kAESGCMDecCiphertext),
-                         NULL, 0) ||
+                         nullptr, 0) ||
       !BORINGSSL_check_test(kAESGCMDecPlaintext, output,
                             sizeof(kAESGCMDecPlaintext),
                             "AES-GCM-decrypt KAT")) {

diff --git a/crypto/fipsmodule/service_indicator/service_indicator.cc.inc b/crypto/fipsmodule/service_indicator/service_indicator.cc.inc
index d7ace3a..e1db7e9 100644
--- a/crypto/fipsmodule/service_indicator/service_indicator.cc.inc
+++ b/crypto/fipsmodule/service_indicator/service_indicator.cc.inc

@@ -38,7 +38,7 @@
 };
 
 // service_indicator_get returns a pointer to the |fips_service_indicator_state|
-// for the current thread. It returns NULL on error.
+// for the current thread. It returns nullptr on error.
 //
 // FIPS 140-3 requires that the module should provide the service indicator
 // for approved services irrespective of whether the user queries it or not.
@@ -48,11 +48,11 @@
       reinterpret_cast<fips_service_indicator_state *>(CRYPTO_get_thread_local(
           OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE));
 
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     indicator = reinterpret_cast<fips_service_indicator_state *>(
         OPENSSL_malloc(sizeof(struct fips_service_indicator_state)));
-    if (indicator == NULL) {
-      return NULL;
+    if (indicator == nullptr) {
+      return nullptr;
     }
 
     indicator->lock_state = STATE_UNLOCKED;
@@ -62,7 +62,7 @@
             OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE, indicator,
             OPENSSL_free)) {
       OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
-      return NULL;
+      return nullptr;
     }
   }
 
@@ -71,7 +71,7 @@
 
 static uint64_t service_indicator_get_counter(void) {
   struct fips_service_indicator_state *indicator = service_indicator_get();
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     return 0;
   }
   return indicator->counter;
@@ -94,7 +94,7 @@
 
 void FIPS_service_indicator_lock_state(void) {
   struct fips_service_indicator_state *indicator = service_indicator_get();
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     return;
   }
 
@@ -115,7 +115,7 @@
 
 void FIPS_service_indicator_unlock_state(void) {
   struct fips_service_indicator_state *indicator = service_indicator_get();
-  if (indicator == NULL) {
+  if (indicator == nullptr) {
     return;
   }
 
@@ -185,7 +185,7 @@
 
 static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
                                                 int (*md_ok)(int md_type)) {
-  if (EVP_MD_CTX_get0_md(ctx) == NULL) {
+  if (EVP_MD_CTX_get0_md(ctx) == nullptr) {
     // Signature schemes without a prehash are currently never FIPS approved.
     return;
   }

diff --git a/crypto/fipsmodule/tls/kdf.cc.inc b/crypto/fipsmodule/tls/kdf.cc.inc
index d29695e..f83ace4 100644
--- a/crypto/fipsmodule/tls/kdf.cc.inc
+++ b/crypto/fipsmodule/tls/kdf.cc.inc

@@ -45,11 +45,11 @@
   HMAC_CTX_init(&ctx_tmp);
   HMAC_CTX_init(&ctx_init);
 
-  if (!HMAC_Init_ex(&ctx_init, secret, secret_len, md, NULL) ||
+  if (!HMAC_Init_ex(&ctx_init, secret, secret_len, md, nullptr) ||
       !HMAC_CTX_copy_ex(&ctx, &ctx_init) ||
-      !HMAC_Update(&ctx, (const uint8_t *) label, label_len) ||
+      !HMAC_Update(&ctx, (const uint8_t *)label, label_len) ||
       !HMAC_Update(&ctx, seed1, seed1_len) ||
-      !HMAC_Update(&ctx, seed2, seed2_len) ||
+      !HMAC_Update(&ctx, seed2, seed2_len) ||  //
       !HMAC_Final(&ctx, A1, &A1_len)) {
     goto err;
   }
@@ -148,7 +148,7 @@
                                    const uint8_t *hash, size_t hash_len) {
   static const uint8_t kProtocolLabel[] = "tls13 ";
   CBB cbb, child;
-  uint8_t *hkdf_label = NULL;
+  uint8_t *hkdf_label = nullptr;
   size_t hkdf_label_len;
 
   FIPS_service_indicator_lock_state();

diff --git a/crypto/lhash/internal.h b/crypto/lhash/internal.h
index 5484880..fe510ea 100644
--- a/crypto/lhash/internal.h
+++ b/crypto/lhash/internal.h

@@ -187,7 +187,7 @@
                                                                                \
   inline int lh_##type##_insert(LHASH_OF(type) *lh, type **old_data,           \
                                 type *data) {                                  \
-    void *old_data_void = NULL;                                                \
+    void *old_data_void = nullptr;                                             \
     int ret = OPENSSL_lh_insert((_LHASH *)lh, &old_data_void, data,            \
                                 lh_##type##_call_hash_func,                    \
                                 lh_##type##_call_cmp_func);                    \

diff --git a/crypto/mem.cc b/crypto/mem.cc
index 5001ab3..21faca6 100644
--- a/crypto/mem.cc
+++ b/crypto/mem.cc

@@ -63,7 +63,7 @@
   }
 #else
 #define WEAK_SYMBOL_FUNC(rettype, name, args) \
-  static rettype(*const name) args = NULL;
+  static rettype(*const name) args = nullptr;
 #endif
 
 #if defined(BORINGSSL_DETECT_SDALLOCX)
@@ -121,7 +121,7 @@
 
 static void init_malloc_failure(void) {
   const char *env = getenv("MALLOC_NUMBER_TO_FAIL");
-  if (env != NULL && env[0] != 0) {
+  if (env != nullptr && env[0] != 0) {
     char *endptr;
     malloc_number_to_fail = strtoull(env, &endptr, 10);
     if (*endptr == 0) {
@@ -129,7 +129,7 @@
       atexit(malloc_exit_handler);
     }
   }
-  break_on_malloc_fail = getenv("MALLOC_BREAK_ON_FAIL") != NULL;
+  break_on_malloc_fail = getenv("MALLOC_BREAK_ON_FAIL") != nullptr;
 }
 
 // should_fail_allocation returns one if the current allocation should fail and

diff --git a/crypto/rand/fork_detect.cc b/crypto/rand/fork_detect.cc
index 17e93e9..0f6f5c3 100644
--- a/crypto/rand/fork_detect.cc
+++ b/crypto/rand/fork_detect.cc

@@ -163,7 +163,7 @@
 }
 
 static void init_pthread_fork_detection(void) {
-  if (pthread_atfork(NULL, NULL, we_are_forked) != 0) {
+  if (pthread_atfork(nullptr, nullptr, we_are_forked) != 0) {
     abort();
   }
   g_atfork_fork_generation = 1;

diff --git a/crypto/rand/windows.cc b/crypto/rand/windows.cc
index 42cc981..1916e89 100644
--- a/crypto/rand/windows.cc
+++ b/crypto/rand/windows.cc

@@ -43,7 +43,7 @@
       output_bytes_this_pass = (ULONG)requested;
     }
     if (!BCRYPT_SUCCESS(BCryptGenRandom(
-            /*hAlgorithm=*/NULL, out, output_bytes_this_pass,
+            /*hAlgorithm=*/nullptr, out, output_bytes_this_pass,
             BCRYPT_USE_SYSTEM_PREFERRED_RNG))) {
       abort();
     }
@@ -56,15 +56,15 @@
 
 // See: https://learn.microsoft.com/en-us/windows/win32/seccng/processprng
 typedef BOOL (WINAPI *ProcessPrngFunction)(PBYTE pbData, SIZE_T cbData);
-static ProcessPrngFunction g_processprng_fn = NULL;
+static ProcessPrngFunction g_processprng_fn = nullptr;
 
 static void init_processprng(void) {
   HMODULE hmod = LoadLibraryW(L"bcryptprimitives");
-  if (hmod == NULL) {
+  if (hmod == nullptr) {
     abort();
   }
   g_processprng_fn = (ProcessPrngFunction)GetProcAddress(hmod, "ProcessPrng");
-  if (g_processprng_fn == NULL) {
+  if (g_processprng_fn == nullptr) {
     abort();
   }
 }

diff --git a/crypto/test/abi_test.cc b/crypto/test/abi_test.cc
index 2c300f4..c3c7393 100644
--- a/crypto/test/abi_test.cc
+++ b/crypto/test/abi_test.cc

@@ -698,7 +698,7 @@
   sigemptyset(&trap_action.sa_mask);
   trap_action.sa_flags = SA_SIGINFO;
   trap_action.sa_sigaction = TrapHandler;
-  if (sigaction(SIGTRAP, &trap_action, NULL) != 0) {
+  if (sigaction(SIGTRAP, &trap_action, nullptr) != 0) {
     perror("sigaction");
     abort();
   }

diff --git a/crypto/thread_win.cc b/crypto/thread_win.cc
index 4e22c47..8d7316e 100644
--- a/crypto/thread_win.cc
+++ b/crypto/thread_win.cc

@@ -31,7 +31,7 @@
 }
 
 void CRYPTO_once(CRYPTO_once_t *once, void (*init)(void)) {
-  if (!InitOnceExecuteOnce(once, call_once_init, &init, NULL)) {
+  if (!InitOnceExecuteOnce(once, call_once_init, &init, nullptr)) {
     abort();
   }
 }
@@ -85,7 +85,7 @@
   }
 
   void **pointers = (void **)TlsGetValue(g_thread_local_key);
-  if (pointers == NULL) {
+  if (pointers == nullptr) {
     return;
   }
 
@@ -96,7 +96,7 @@
   ReleaseSRWLockExclusive(&g_destructors_lock);
 
   for (unsigned i = 0; i < NUM_OPENSSL_THREAD_LOCALS; i++) {
-    if (destructors[i] != NULL) {
+    if (destructors[i] != nullptr) {
       destructors[i](pointers[i]);
     }
   }
@@ -193,12 +193,12 @@
 void *CRYPTO_get_thread_local(thread_local_data_t index) {
   CRYPTO_once(&g_thread_local_init_once, thread_local_init);
   if (g_thread_local_failed) {
-    return NULL;
+    return nullptr;
   }
 
   void **pointers = get_thread_locals();
-  if (pointers == NULL) {
-    return NULL;
+  if (pointers == nullptr) {
+    return nullptr;
   }
   return pointers[index];
 }
@@ -212,10 +212,10 @@
   }
 
   void **pointers = get_thread_locals();
-  if (pointers == NULL) {
+  if (pointers == nullptr) {
     pointers = reinterpret_cast<void **>(
         malloc(sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS));
-    if (pointers == NULL) {
+    if (pointers == nullptr) {
       destructor(value);
       return 0;
     }

diff --git a/crypto/x509/v3_bitst.cc b/crypto/x509/v3_bitst.cc
index 57cdbec..3f629d2 100644
--- a/crypto/x509/v3_bitst.cc
+++ b/crypto/x509/v3_bitst.cc

@@ -88,7 +88,8 @@
 #define EXT_BITSTRING(nid, table)                                             \
   {                                                                           \
     nid, 0, ASN1_ITEM_ref(ASN1_BIT_STRING), 0, 0, 0, 0, 0, 0,                 \
-        i2v_ASN1_BIT_STRING, v2i_ASN1_BIT_STRING, NULL, NULL, (void *)(table) \
+        i2v_ASN1_BIT_STRING, v2i_ASN1_BIT_STRING, nullptr, nullptr,           \
+    (void *)(table)                                                           \
   }
 
 const X509V3_EXT_METHOD v3_nscert =

diff --git a/crypto/x509/v3_ia5.cc b/crypto/x509/v3_ia5.cc
index f0702d9..e950aac 100644
--- a/crypto/x509/v3_ia5.cc
+++ b/crypto/x509/v3_ia5.cc

@@ -62,7 +62,7 @@
 #define EXT_IA5STRING(nid)                                                 \
   {                                                                        \
     nid, 0, ASN1_ITEM_ref(ASN1_IA5STRING), 0, 0, 0, 0, i2s_ASN1_IA5STRING, \
-        s2i_ASN1_IA5STRING, 0, 0, 0, 0, NULL                               \
+        s2i_ASN1_IA5STRING, 0, 0, 0, 0, nullptr                            \
   }
 
 const X509V3_EXT_METHOD v3_netscape_base_url =

diff --git a/crypto/x509/x_all.cc b/crypto/x509/x_all.cc
index 064487b..d477112 100644
--- a/crypto/x509/x_all.cc
+++ b/crypto/x509/x_all.cc

@@ -157,8 +157,8 @@
 #define IMPLEMENT_D2I_FP(type, name, bio_func) \
   type *name(FILE *fp, type **obj) {           \
     BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE);    \
-    if (bio == NULL) {                         \
-      return NULL;                             \
+    if (bio == nullptr) {                      \
+      return nullptr;                          \
     }                                          \
     type *ret = bio_func(bio, obj);            \
     BIO_free(bio);                             \
@@ -168,7 +168,7 @@
 #define IMPLEMENT_I2D_FP(type, name, bio_func) \
   int name(FILE *fp, const type *obj) {        \
     BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE);    \
-    if (bio == NULL) {                         \
+    if (bio == nullptr) {                      \
       return 0;                                \
     }                                          \
     int ret = bio_func(bio, obj);              \
@@ -193,7 +193,7 @@
     uint8_t *data;                                      \
     size_t len;                                         \
     if (!BIO_read_asn1(bio, &data, &len, 100 * 1024)) { \
-      return NULL;                                      \
+      return nullptr;                                   \
     }                                                   \
     const uint8_t *ptr = data;                          \
     type *ret = d2i_func(obj, &ptr, (long)len);         \
@@ -203,7 +203,7 @@
 
 #define IMPLEMENT_I2D_BIO(type, name, i2d_func) \
   int name(BIO *bio, const type *obj) {         \
-    uint8_t *data = NULL;                       \
+    uint8_t *data = nullptr;                    \
     int len = i2d_func(obj, &data);             \
     if (len < 0) {                              \
       return 0;                                 \

diff --git a/ssl/d1_both.cc b/ssl/d1_both.cc
index 1ef97b9..a4a84b3 100644
--- a/ssl/d1_both.cc
+++ b/ssl/d1_both.cc

@@ -723,7 +723,7 @@
   // Pack as many handshake fragments into one record as we can. We stage the
   // fragments in the output buffer, to be sealed in-place.
   bool should_continue = false;
-  Span<uint8_t> fragments = out.subspan(prefix_len, max_in_len);
+  Span<uint8_t> fragments = out.subspan(prefix_len, /* up to */ max_in_len);
   CBB cbb;
   CBB_init_fixed(&cbb, fragments.data(), fragments.size());
   DTLSSentRecord sent_record;

diff --git a/ssl/encrypted_client_hello.cc b/ssl/encrypted_client_hello.cc
index cac0358..be01d9c 100644
--- a/ssl/encrypted_client_hello.cc
+++ b/ssl/encrypted_client_hello.cc

@@ -285,11 +285,21 @@
 
   // We assert with |uintptr_t| because the comparison would be UB if they
   // didn't alias.
+  // - |payload| must be contained in |extensions|.
   assert(reinterpret_cast<uintptr_t>(client_hello_outer->extensions) <=
          reinterpret_cast<uintptr_t>(payload.data()));
   assert(reinterpret_cast<uintptr_t>(client_hello_outer->extensions +
                                      client_hello_outer->extensions_len) >=
          reinterpret_cast<uintptr_t>(payload.data() + payload.size()));
+  // - |extensions| must be contained in |client_hello|.
+  assert(reinterpret_cast<uintptr_t>(client_hello_outer->client_hello) <=
+         reinterpret_cast<uintptr_t>(client_hello_outer->extensions));
+  assert(reinterpret_cast<uintptr_t>(client_hello_outer->client_hello +
+                                     client_hello_outer->client_hello_len) >=
+         reinterpret_cast<uintptr_t>(client_hello_outer->extensions +
+                                     client_hello_outer->extensions_len));
+  // From this then follows that |aad|, being a copy of |client_hello|, contains
+  // the |payload| byte range as well.
   Span<uint8_t> payload_aad = Span(aad).subspan(
       payload.data() - client_hello_outer->client_hello, payload.size());
   OPENSSL_memset(payload_aad.data(), 0, payload_aad.size());

diff --git a/ssl/extensions.cc b/ssl/extensions.cc
index 1bce374..51e8e37 100644
--- a/ssl/extensions.cc
+++ b/ssl/extensions.cc

@@ -2613,9 +2613,9 @@
   if (ssl_has_CA_names(hs->config)) {
     CBB ca_contents;
     if (!CBB_add_u16(out_compressible,
-                     TLSEXT_TYPE_certificate_authorities) ||  //
-        !CBB_add_u16_length_prefixed(out_compressible, &ca_contents) ||    //
-        !ssl_add_CA_names(hs, &ca_contents) ||                //
+                     TLSEXT_TYPE_certificate_authorities) ||             //
+        !CBB_add_u16_length_prefixed(out_compressible, &ca_contents) ||  //
+        !ssl_add_CA_names(hs, &ca_contents) ||                           //
         !CBB_flush(out_compressible)) {
       return false;
     }
@@ -3221,7 +3221,7 @@
   uint8_t prover_secret[spake2plus::kSecretSize];
   if (!hs->pake_prover->ComputeConfirmation(
           prover_confirm, prover_secret,
-          pake_msg_span.subspan(0, spake2plus::kShareSize),
+          pake_msg_span.first<spake2plus::kShareSize>(),
           pake_msg_span.subspan(spake2plus::kShareSize))) {
     // Record a failure before releasing the answer to the client.
     hs->credential->ClaimPAKEAttempt();
@@ -4337,11 +4337,11 @@
   assert(ticket.size() >= SSL_TICKET_KEY_NAME_LEN + EVP_MAX_IV_LENGTH);
   ScopedEVP_CIPHER_CTX cipher_ctx;
   ScopedHMAC_CTX hmac_ctx;
-  auto name = ticket.subspan(0, SSL_TICKET_KEY_NAME_LEN);
+  auto name = ticket.first<SSL_TICKET_KEY_NAME_LEN>();
   // The actual IV is shorter, but the length is determined by the callback's
   // chosen cipher. Instead we pass in |EVP_MAX_IV_LENGTH| worth of IV to ensure
   // the callback has enough.
-  auto iv = ticket.subspan(SSL_TICKET_KEY_NAME_LEN, EVP_MAX_IV_LENGTH);
+  auto iv = ticket.subspan<SSL_TICKET_KEY_NAME_LEN, EVP_MAX_IV_LENGTH>();
   int cb_ret = hs->ssl->session_ctx->ticket_key_cb(
       hs->ssl, const_cast<uint8_t *>(name.data()),
       const_cast<uint8_t *>(iv.data()), cipher_ctx.get(), hmac_ctx.get(),
@@ -4370,7 +4370,7 @@
   }
 
   const EVP_CIPHER *cipher = EVP_aes_128_cbc();
-  auto name = ticket.subspan(0, SSL_TICKET_KEY_NAME_LEN);
+  auto name = ticket.first<SSL_TICKET_KEY_NAME_LEN>();
   auto iv =
       ticket.subspan(SSL_TICKET_KEY_NAME_LEN, EVP_CIPHER_iv_length(cipher));
 

diff --git a/ssl/handshake_client.cc b/ssl/handshake_client.cc
index 769dcfc..c96dedc 100644
--- a/ssl/handshake_client.cc
+++ b/ssl/handshake_client.cc

@@ -687,7 +687,7 @@
         sizeof(kJDK11DowngradeRandom) == sizeof(kTLS13DowngradeRandom),
         "downgrade signals have different size");
     auto suffix =
-        Span(ssl->s3->server_random).last(sizeof(kTLS13DowngradeRandom));
+        Span(ssl->s3->server_random).last<sizeof(kTLS13DowngradeRandom)>();
     if (suffix == kTLS12DowngradeRandom || suffix == kTLS13DowngradeRandom ||
         suffix == kJDK11DowngradeRandom) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_TLS13_DOWNGRADE);

diff --git a/ssl/internal.h b/ssl/internal.h
index e62202a..e4cc29c 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h

@@ -127,7 +127,7 @@
     span[0] = fixed_names[i];
     span = span.subspan(1);
   }
-  span = span.subspan(0, objects.size());
+  span = span.subspan(0, /* up to */ objects.size());
   for (size_t i = 0; i < span.size(); i++) {
     span[i] = objects[i].*name;
   }
@@ -1358,10 +1358,11 @@
 // |transcript| with |msg|. The |ECH_CONFIRMATION_SIGNAL_LEN| bytes from
 // |offset| in |msg| are replaced with zeros before hashing. This function
 // returns true on success, and false on failure.
-bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
-                                 Span<const uint8_t> client_random,
-                                 const SSLTranscript &transcript, bool is_hrr,
-                                 Span<const uint8_t> msg, size_t offset);
+bool ssl_ech_accept_confirmation(
+    const SSL_HANDSHAKE *hs, Span<uint8_t, ECH_CONFIRMATION_SIGNAL_LEN> out,
+    Span<const uint8_t, SSL3_RANDOM_SIZE> client_random,
+    const SSLTranscript &transcript, bool is_hrr, Span<const uint8_t> msg,
+    size_t offset);
 
 // ssl_is_valid_ech_public_name returns true if |public_name| is a valid ECH
 // public name and false otherwise. It is exported for testing.

diff --git a/ssl/s3_both.cc b/ssl/s3_both.cc
index b8c156b..898b549 100644
--- a/ssl/s3_both.cc
+++ b/ssl/s3_both.cc

@@ -99,7 +99,8 @@
   Span<const uint8_t> rest = msg;
   if (!SSL_is_quic(ssl) && ssl->s3->aead_write_ctx->is_null_cipher()) {
     while (!rest.empty()) {
-      Span<const uint8_t> chunk = rest.subspan(0, ssl->max_send_fragment);
+      Span<const uint8_t> chunk =
+          rest.subspan(0, /* up to */ ssl->max_send_fragment);
       rest = rest.subspan(chunk.size());
 
       if (!add_record_to_flight(ssl, SSL3_RT_HANDSHAKE, chunk)) {
@@ -118,7 +119,7 @@
       size_t pending_len =
           ssl->s3->pending_hs_data ? ssl->s3->pending_hs_data->length : 0;
       Span<const uint8_t> chunk =
-          rest.subspan(0, ssl->max_send_fragment - pending_len);
+          rest.subspan(0, /* up to */ ssl->max_send_fragment - pending_len);
       assert(!chunk.empty());
       rest = rest.subspan(chunk.size());
 

diff --git a/ssl/ssl_transcript.cc b/ssl/ssl_transcript.cc
index 6a445be..101da70 100644
--- a/ssl/ssl_transcript.cc
+++ b/ssl/ssl_transcript.cc

@@ -168,8 +168,8 @@
   // transcript format as TLS 1.3 is used. This means we write the 1-byte
   // msg_type, 3-byte length, then skip 2+3+3 bytes for the DTLS-specific
   // fields that get omitted.
-  if (!AddToBufferOrHash(in.subspan(0, 4)) ||
-      !AddToBufferOrHash(in.subspan(12))) {
+  if (!AddToBufferOrHash(in.first<4>()) ||
+      !AddToBufferOrHash(in.subspan<12>())) {
     return false;
   }
   return true;

diff --git a/ssl/tls13_enc.cc b/ssl/tls13_enc.cc
index f94aea7..c5baa83 100644
--- a/ssl/tls13_enc.cc
+++ b/ssl/tls13_enc.cc

@@ -284,7 +284,7 @@
       return false;
     }
     uint32_t counter = CRYPTO_load_u32_le(sample.data());
-    Span<const uint8_t> nonce = sample.subspan(4);
+    auto nonce = sample.subspan<4>();
     OPENSSL_memset(out.data(), 0, out.size());
     CRYPTO_chacha_20(out.data(), out.data(), out.size(), key_, nonce.data(),
                      counter);
@@ -558,8 +558,8 @@
     if (truncated.size() < DTLS1_HM_HEADER_LENGTH) {
       return false;
     }
-    auto header = truncated.subspan(0, 4);
-    auto body = truncated.subspan(12);
+    auto header = truncated.first<4>();
+    auto body = truncated.subspan<12>();
     if (!transcript.CopyToHashContext(ctx.get(), digest) ||
         !EVP_DigestUpdate(ctx.get(), header.data(), header.size()) ||
         !EVP_DigestUpdate(ctx.get(), body.data(), body.size()) ||
@@ -644,10 +644,11 @@
          ECH_CONFIRMATION_SIGNAL_LEN;
 }
 
-bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
-                                 Span<const uint8_t> client_random,
-                                 const SSLTranscript &transcript, bool is_hrr,
-                                 Span<const uint8_t> msg, size_t offset) {
+bool ssl_ech_accept_confirmation(
+    const SSL_HANDSHAKE *hs, Span<uint8_t, ECH_CONFIRMATION_SIGNAL_LEN> out,
+    Span<const uint8_t, SSL3_RANDOM_SIZE> client_random,
+    const SSLTranscript &transcript, bool is_hrr, Span<const uint8_t> msg,
+    size_t offset) {
   // See draft-ietf-tls-esni-13, sections 7.2 and 7.2.1.
   static const uint8_t kZeros[EVP_MAX_MD_SIZE] = {0};
 
@@ -659,7 +660,9 @@
 
   // We represent DTLS messages with the longer DTLS 1.2 header, but DTLS 1.3
   // removes the extra fields from the transcript.
-  auto header = msg.subspan(0, SSL3_HM_HEADER_LENGTH);
+  //
+  // Size bound implied by ECH_CONFIRMATION_SIGNAL_LEN >= SSL3_HM_HEADER_LENGTH.
+  auto header = msg.first<SSL3_HM_HEADER_LENGTH>();
   size_t full_header_len =
       SSL_is_dtls(hs->ssl) ? DTLS1_HM_HEADER_LENGTH : SSL3_HM_HEADER_LENGTH;
   auto before_zeros = msg.subspan(full_header_len, offset - full_header_len);
@@ -685,7 +688,6 @@
     return false;
   }
 
-  assert(out.size() == ECH_CONFIRMATION_SIGNAL_LEN);
   return hkdf_expand_label(
       out, transcript.Digest(), Span(secret, secret_len),
       is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",

diff --git a/ssl/tls13_server.cc b/ssl/tls13_server.cc
index 3452ea3..eade4bd 100644
--- a/ssl/tls13_server.cc
+++ b/ssl/tls13_server.cc

@@ -757,7 +757,7 @@
     // Now that the message is encoded, fill in the whole value.
     size_t offset = hrr.size() - ECH_CONFIRMATION_SIGNAL_LEN;
     if (!ssl_ech_accept_confirmation(
-            hs, Span(hrr).last(ECH_CONFIRMATION_SIGNAL_LEN),
+            hs, Span(hrr).last<ECH_CONFIRMATION_SIGNAL_LEN>(),
             ssl->s3->client_random, hs->transcript, /*is_hrr=*/true, hrr,
             offset)) {
       return ssl_hs_error;
@@ -947,7 +947,7 @@
   if (hs->ech_is_inner) {
     // Fill in the ECH confirmation signal.
     const size_t offset = ssl_ech_confirmation_signal_hello_offset(ssl);
-    Span<uint8_t> random_suffix = random.last(ECH_CONFIRMATION_SIGNAL_LEN);
+    auto random_suffix = random.last<ECH_CONFIRMATION_SIGNAL_LEN>();
     if (!ssl_ech_accept_confirmation(hs, random_suffix, ssl->s3->client_random,
                                      hs->transcript,
                                      /*is_hrr=*/false, server_hello, offset)) {
@@ -955,8 +955,8 @@
     }
 
     // Update |server_hello|.
-    Span<uint8_t> server_hello_out =
-        Span(server_hello).subspan(offset, ECH_CONFIRMATION_SIGNAL_LEN);
+    auto server_hello_out =
+        Span(server_hello).subspan(offset).first<ECH_CONFIRMATION_SIGNAL_LEN>();
     OPENSSL_memcpy(server_hello_out.data(), random_suffix.data(),
                    ECH_CONFIRMATION_SIGNAL_LEN);
   }

diff --git a/ssl/tls_record.cc b/ssl/tls_record.cc
index 328a2da..ba0c4c1 100644
--- a/ssl/tls_record.cc
+++ b/ssl/tls_record.cc

@@ -143,7 +143,7 @@
     return ssl_open_record_partial;
   }
 
-  Span<const uint8_t> header = in.subspan(0, SSL3_RT_HEADER_LENGTH);
+  auto header = in.first(SSL3_RT_HEADER_LENGTH);
   ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HEADER, header);
 
   *out_consumed = in.size() - CBS_len(&cbs);

diff --git a/util/fipstools/acvp/modulewrapper/modulewrapper.cc b/util/fipstools/acvp/modulewrapper/modulewrapper.cc
index f4bb4d7..762f3e9 100644
--- a/util/fipstools/acvp/modulewrapper/modulewrapper.cc
+++ b/util/fipstools/acvp/modulewrapper/modulewrapper.cc

@@ -880,7 +880,7 @@
 static bool Hash(const Span<const uint8_t> args[], ReplyCallback write_reply) {
   uint8_t digest[DigestLength];
   OneShotHash(args[0].data(), args[0].size(), digest);
-  return write_reply({Span<const uint8_t>(digest)});
+  return write_reply({MakeConstSpan(digest)});
 }
 
 template <uint8_t *(*OneShotHash)(const uint8_t *, size_t, uint8_t *),