src: replace NULL with nullptr

Now that we are building with C++11 features enabled, replace use
of NULL with nullptr.

The benefit of using nullptr is that it can never be confused for
an integral type because it does not support implicit conversions
to integral types except boolean - unlike NULL, which is defined
as a literal `0`.

1 files changed, 229 insertions, 225 deletions

diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 5d295df7cb..7575fff97a 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -112,7 +112,7 @@ static uv_rwlock_t* locks;
 
 const char* root_certs[] = {
 #include "node_root_certs.h"  // NOLINT(build/include_order)
-  NULL
+  nullptr
 };
 
 X509_STORE* root_cert_store;
@@ -200,9 +200,9 @@ static int CryptoPemCallback(char *buf, int size, int rwflag, void *u) {
 
 void ThrowCryptoError(Environment* env,
                       unsigned long err,
-                      const char* default_message = NULL) {
+                      const char* default_message = nullptr) {
   HandleScope scope(env->isolate());
-  if (err != 0 || default_message == NULL) {
+  if (err != 0 || default_message == nullptr) {
     char errmsg[128] = { 0 };
     ERR_error_string_n(err, errmsg, sizeof(errmsg));
     env->ThrowError(errmsg);
@@ -371,7 +371,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
   SSL_CTX_sess_set_get_cb(sc->ctx_, SSLWrap<Connection>::GetSessionCallback);
   SSL_CTX_sess_set_new_cb(sc->ctx_, SSLWrap<Connection>::NewSessionCallback);
 
-  sc->ca_store_ = NULL;
+  sc->ca_store_ = nullptr;
 }
 
 
@@ -380,7 +380,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
 static BIO* LoadBIO(Environment* env, Handle<Value> v) {
   BIO* bio = NodeBIO::New();
   if (!bio)
-    return NULL;
+    return nullptr;
 
   HandleScope scope(env->isolate());
 
@@ -397,7 +397,7 @@ static BIO* LoadBIO(Environment* env, Handle<Value> v) {
 
   if (r <= 0) {
     BIO_free_all(bio);
-    return NULL;
+    return nullptr;
   }
 
   return bio;
@@ -411,12 +411,12 @@ static X509* LoadX509(Environment* env, Handle<Value> v) {
 
   BIO *bio = LoadBIO(env, v);
   if (!bio)
-    return NULL;
+    return nullptr;
 
-  X509 * x509 = PEM_read_bio_X509(bio, NULL, CryptoPemCallback, NULL);
+  X509 * x509 = PEM_read_bio_X509(bio, nullptr, CryptoPemCallback, nullptr);
   if (!x509) {
     BIO_free_all(bio);
-    return NULL;
+    return nullptr;
   }
 
   BIO_free_all(bio);
@@ -444,9 +444,9 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
   node::Utf8Value passphrase(args[1]);
 
   EVP_PKEY* key = PEM_read_bio_PrivateKey(bio,
-                                          NULL,
+                                          nullptr,
                                           CryptoPemCallback,
-                                          len == 1 ? NULL : *passphrase);
+                                          len == 1 ? nullptr : *passphrase);
 
   if (!key) {
     BIO_free_all(bio);
@@ -469,7 +469,7 @@ int SSL_CTX_get_issuer(SSL_CTX* ctx, X509* cert, X509** issuer) {
   X509_STORE* store = SSL_CTX_get_cert_store(ctx);
   X509_STORE_CTX store_ctx;
 
-  ret = X509_STORE_CTX_init(&store_ctx, store, NULL, NULL);
+  ret = X509_STORE_CTX_init(&store_ctx, store, nullptr, nullptr);
   if (!ret)
     goto end;
 
@@ -491,11 +491,11 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
                                   X509** cert,
                                   X509** issuer) {
   int ret = 0;
-  X509* x = NULL;
+  X509* x = nullptr;
 
-  x = PEM_read_bio_X509_AUX(in, NULL, CryptoPemCallback, NULL);
+  x = PEM_read_bio_X509_AUX(in, nullptr, CryptoPemCallback, nullptr);
 
-  if (x == NULL) {
+  if (x == nullptr) {
     SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
     goto end;
   }
@@ -514,12 +514,12 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
     int r;
     unsigned long err;
 
-    if (ctx->extra_certs != NULL) {
+    if (ctx->extra_certs != nullptr) {
       sk_X509_pop_free(ctx->extra_certs, X509_free);
-      ctx->extra_certs = NULL;
+      ctx->extra_certs = nullptr;
     }
 
-    while ((ca = PEM_read_bio_X509(in, NULL, CryptoPemCallback, NULL))) {
+    while ((ca = PEM_read_bio_X509(in, nullptr, CryptoPemCallback, nullptr))) {
       r = SSL_CTX_add_extra_chain_cert(ctx, ca);
 
       if (!r) {
@@ -533,7 +533,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
       // by SSL_CTX_use_certificate).
 
       // Find issuer
-      if (*issuer != NULL || X509_check_issued(ca, x) != X509_V_OK)
+      if (*issuer != nullptr || X509_check_issued(ca, x) != X509_V_OK)
         continue;
       *issuer = ca;
     }
@@ -551,7 +551,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
 
   // Try getting issuer from a cert store
   if (ret) {
-    if (*issuer == NULL) {
+    if (*issuer == nullptr) {
       ret = SSL_CTX_get_issuer(ctx, x, issuer);
       ret = ret < 0 ? 0 : 1;
       // NOTE: get_cert_store doesn't increment reference count,
@@ -563,7 +563,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
   }
 
  end:
-  if (x != NULL)
+  if (x != nullptr)
     *cert = x;
   return ret;
 }
@@ -645,9 +645,10 @@ void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {
   if (!bio)
     return;
 
-  X509_CRL *x509 = PEM_read_bio_X509_CRL(bio, NULL, CryptoPemCallback, NULL);
+  X509_CRL *x509 =
+      PEM_read_bio_X509_CRL(bio, nullptr, CryptoPemCallback, nullptr);
 
-  if (x509 == NULL) {
+  if (x509 == nullptr) {
     BIO_free_all(bio);
     return;
   }
@@ -664,7 +665,7 @@ void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {
 void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
   SecureContext* sc = Unwrap<SecureContext>(args.Holder());
 
-  CHECK_EQ(sc->ca_store_, NULL);
+  CHECK_EQ(sc->ca_store_, nullptr);
 
   if (!root_cert_store) {
     root_cert_store = X509_STORE_new();
@@ -677,9 +678,9 @@ void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
         return;
       }
 
-      X509 *x509 = PEM_read_bio_X509(bp, NULL, CryptoPemCallback, NULL);
+      X509 *x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
 
-      if (x509 == NULL) {
+      if (x509 == nullptr) {
         BIO_free_all(bp);
         return;
       }
@@ -724,7 +725,7 @@ void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
 
   EC_KEY* ecdh = EC_KEY_new_by_curve_name(nid);
 
-  if (ecdh == NULL)
+  if (ecdh == nullptr)
     return env->ThrowTypeError("First argument should be a valid curve name");
 
   SSL_CTX_set_options(sc->ctx_, SSL_OP_SINGLE_ECDH_USE);
@@ -748,10 +749,10 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
   if (!bio)
     return;
 
-  DH* dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
+  DH* dh = PEM_read_bio_DHparams(bio, nullptr, nullptr, nullptr);
   BIO_free_all(bio);
 
-  if (dh == NULL)
+  if (dh == nullptr)
     return;
 
   SSL_CTX_set_options(sc->ctx_, SSL_OP_SINGLE_DH_USE);
@@ -796,7 +797,7 @@ void SecureContext::SetSessionIdContext(
   Local<String> message;
 
   bio = BIO_new(BIO_s_mem());
-  if (bio == NULL) {
+  if (bio == nullptr) {
     message = FIXED_ONE_BYTE_STRING(args.GetIsolate(),
                                     "SSL_CTX_set_session_id_context error");
   } else {
@@ -832,12 +833,12 @@ void SecureContext::Close(const FunctionCallbackInfo<Value>& args) {
 void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  BIO* in = NULL;
-  PKCS12* p12 = NULL;
-  EVP_PKEY* pkey = NULL;
-  X509* cert = NULL;
-  STACK_OF(X509)* extraCerts = NULL;
-  char* pass = NULL;
+  BIO* in = nullptr;
+  PKCS12* p12 = nullptr;
+  EVP_PKEY* pkey = nullptr;
+  X509* cert = nullptr;
+  STACK_OF(X509)* extraCerts = nullptr;
+  char* pass = nullptr;
   bool ret = false;
 
   SecureContext* sc = Unwrap<SecureContext>(args.Holder());
@@ -847,7 +848,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
   }
 
   in = LoadBIO(env, args[0]);
-  if (in == NULL) {
+  if (in == nullptr) {
     return env->ThrowError("Unable to load BIO");
   }
 
@@ -952,10 +953,10 @@ void SecureContext::GetCertificate(const FunctionCallbackInfo<Value>& args) {
     cert = wrap->cert_;
   else
     cert = wrap->issuer_;
-  if (cert == NULL)
+  if (cert == nullptr)
     return args.GetReturnValue().Set(Null(env->isolate()));
 
-  int size = i2d_X509(cert, NULL);
+  int size = i2d_X509(cert, nullptr);
   Local<Object> buff = Buffer::New(env, size);
   unsigned char* serialized = reinterpret_cast<unsigned char*>(
       Buffer::Data(buff));
@@ -1010,16 +1011,16 @@ void SSLWrap<Base>::InitNPN(SecureContext* sc) {
   // Server should advertise NPN protocols
   SSL_CTX_set_next_protos_advertised_cb(sc->ctx_,
                                         AdvertiseNextProtoCallback,
-                                        NULL);
+                                        nullptr);
   // Client should select protocol from list of advertised
   // If server supports NPN
-  SSL_CTX_set_next_proto_select_cb(sc->ctx_, SelectNextProtoCallback, NULL);
+  SSL_CTX_set_next_proto_select_cb(sc->ctx_, SelectNextProtoCallback, nullptr);
 #endif  // OPENSSL_NPN_NEGOTIATED
 
 #ifdef NODE__HAVE_TLSEXT_STATUS_CB
   // OCSP stapling
   SSL_CTX_set_tlsext_status_cb(sc->ctx_, TLSExtStatusCallback);
-  SSL_CTX_set_tlsext_status_arg(sc->ctx_, NULL);
+  SSL_CTX_set_tlsext_status_arg(sc->ctx_, nullptr);
 #endif  // NODE__HAVE_TLSEXT_STATUS_CB
 }
 
@@ -1033,7 +1034,7 @@ SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
 
   *copy = 0;
   SSL_SESSION* sess = w->next_sess_;
-  w->next_sess_ = NULL;
+  w->next_sess_ = nullptr;
 
   return sess;
 }
@@ -1050,7 +1051,7 @@ int SSLWrap<Base>::NewSessionCallback(SSL* s, SSL_SESSION* sess) {
     return 0;
 
   // Check if session is small enough to be stored
-  int size = i2d_SSL_SESSION(sess, NULL);
+  int size = i2d_SSL_SESSION(sess, nullptr);
   if (size > SecureContext::kMaxSessionSize)
     return 0;
 
@@ -1086,7 +1087,7 @@ void SSLWrap<Base>::OnClientHello(void* arg,
       reinterpret_cast<const char*>(hello.session_id()),
       hello.session_size());
   hello_obj->Set(env->session_id_string(), buff);
-  if (hello.servername() == NULL) {
+  if (hello.servername() == nullptr) {
     hello_obj->Set(env->servername_string(), String::Empty(env->isolate()));
   } else {
     Local<String> servername = OneByteString(env->isolate(),
@@ -1144,7 +1145,7 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
     int rv;
 
     ext = X509_get_ext(cert, index);
-    CHECK_NE(ext, NULL);
+    CHECK_NE(ext, nullptr);
 
     rv = X509V3_EXT_print(bio, ext, 0, 0);
     CHECK_EQ(rv, 1);
@@ -1158,11 +1159,11 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
   }
 
   EVP_PKEY* pkey = X509_get_pubkey(cert);
-  RSA* rsa = NULL;
-  if (pkey != NULL)
+  RSA* rsa = nullptr;
+  if (pkey != nullptr)
     rsa = EVP_PKEY_get1_RSA(pkey);
 
-  if (rsa != NULL) {
+  if (rsa != nullptr) {
       BN_print(bio, rsa->n);
       BIO_get_mem_ptr(bio, &mem);
       info->Set(env->modulus_string(),
@@ -1178,13 +1179,13 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
       (void) BIO_reset(bio);
   }
 
-  if (pkey != NULL) {
+  if (pkey != nullptr) {
     EVP_PKEY_free(pkey);
-    pkey = NULL;
+    pkey = nullptr;
   }
-  if (rsa != NULL) {
+  if (rsa != nullptr) {
     RSA_free(rsa);
-    rsa = NULL;
+    rsa = nullptr;
   }
 
   ASN1_TIME_print(bio, X509_get_notBefore(cert));
@@ -1225,8 +1226,8 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
   }
 
   STACK_OF(ASN1_OBJECT)* eku = static_cast<STACK_OF(ASN1_OBJECT)*>(
-      X509_get_ext_d2i(cert, NID_ext_key_usage, NULL, NULL));
-  if (eku != NULL) {
+      X509_get_ext_d2i(cert, NID_ext_key_usage, nullptr, nullptr));
+  if (eku != nullptr) {
     Local<Array> ext_key_usage = Array::New(env->isolate());
     char buf[256];
 
@@ -1241,7 +1242,7 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
   }
 
   if (ASN1_INTEGER* serial_number = X509_get_serialNumber(cert)) {
-    if (BIGNUM* bn = ASN1_INTEGER_to_BN(serial_number, NULL)) {
+    if (BIGNUM* bn = ASN1_INTEGER_to_BN(serial_number, nullptr)) {
       if (char* buf = BN_bn2hex(bn)) {
         info->Set(env->serial_number_string(),
                   OneByteString(env->isolate(), buf));
@@ -1252,7 +1253,7 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
   }
 
   // Raw DER certificate
-  int size = i2d_X509(cert, NULL);
+  int size = i2d_X509(cert, nullptr);
   Local<Object> buff = Buffer::New(env, size);
   unsigned char* serialized = reinterpret_cast<unsigned char*>(
       Buffer::Data(buff));
@@ -1278,29 +1279,29 @@ void SSLWrap<Base>::GetPeerCertificate(
 
   // NOTE: This is because of the odd OpenSSL behavior. On client `cert_chain`
   // contains the `peer_certificate`, but on server it doesn't
-  X509* cert = w->is_server() ? SSL_get_peer_certificate(w->ssl_) : NULL;
+  X509* cert = w->is_server() ? SSL_get_peer_certificate(w->ssl_) : nullptr;
   STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(w->ssl_);
-  STACK_OF(X509)* peer_certs = NULL;
-  if (cert == NULL && ssl_certs == NULL)
+  STACK_OF(X509)* peer_certs = nullptr;
+  if (cert == nullptr && ssl_certs == nullptr)
     goto done;
 
-  if (cert == NULL && sk_X509_num(ssl_certs) == 0)
+  if (cert == nullptr && sk_X509_num(ssl_certs) == 0)
     goto done;
 
   // Short result requested
   if (args.Length() < 1 || !args[0]->IsTrue()) {
     result = X509ToObject(env,
-                          cert == NULL ? sk_X509_value(ssl_certs, 0) : cert);
+                          cert == nullptr ? sk_X509_value(ssl_certs, 0) : cert);
     goto done;
   }
 
   // Clone `ssl_certs`, because we are going to destruct it
-  peer_certs = sk_X509_new(NULL);
-  if (cert != NULL)
+  peer_certs = sk_X509_new(nullptr);
+  if (cert != nullptr)
     sk_X509_push(peer_certs, cert);
   for (int i = 0; i < sk_X509_num(ssl_certs); i++) {
     cert = X509_dup(sk_X509_value(ssl_certs, i));
-    if (cert == NULL)
+    if (cert == nullptr)
       goto done;
     if (!sk_X509_push(peer_certs, cert))
       goto done;
@@ -1358,11 +1359,11 @@ void SSLWrap<Base>::GetPeerCertificate(
   if (X509_check_issued(cert, cert) == X509_V_OK)
     info->Set(env->issuercert_string(), info);
 
-  CHECK_NE(cert, NULL);
+  CHECK_NE(cert, nullptr);
   X509_free(cert);
 
  done:
-  if (peer_certs != NULL)
+  if (peer_certs != nullptr)
     sk_X509_pop_free(peer_certs, X509_free);
   if (result.IsEmpty())
     result = Object::New(env->isolate());
@@ -1377,10 +1378,10 @@ void SSLWrap<Base>::GetSession(const FunctionCallbackInfo<Value>& args) {
   Base* w = Unwrap<Base>(args.Holder());
 
   SSL_SESSION* sess = SSL_get_session(w->ssl_);
-  if (sess == NULL)
+  if (sess == nullptr)
     return;
 
-  int slen = i2d_SSL_SESSION(sess, NULL);
+  int slen = i2d_SSL_SESSION(sess, nullptr);
   CHECK_GT(slen, 0);
 
   unsigned char* sbuf = new unsigned char[slen];
@@ -1408,11 +1409,11 @@ void SSLWrap<Base>::SetSession(const FunctionCallbackInfo<Value>& args) {
   memcpy(sbuf, Buffer::Data(args[0]), slen);
 
   const unsigned char* p = reinterpret_cast<const unsigned char*>(sbuf);
-  SSL_SESSION* sess = d2i_SSL_SESSION(NULL, &p, slen);
+  SSL_SESSION* sess = d2i_SSL_SESSION(nullptr, &p, slen);
 
   delete[] sbuf;
 
-  if (sess == NULL)
+  if (sess == nullptr)
     return;
 
   int r = SSL_set_session(w->ssl_, sess);
@@ -1433,16 +1434,16 @@ void SSLWrap<Base>::LoadSession(const FunctionCallbackInfo<Value>& args) {
     char* sbuf = Buffer::Data(args[0]);
 
     const unsigned char* p = reinterpret_cast<unsigned char*>(sbuf);
-    SSL_SESSION* sess = d2i_SSL_SESSION(NULL, &p, slen);
+    SSL_SESSION* sess = d2i_SSL_SESSION(nullptr, &p, slen);
 
     // Setup next session and move hello to the BIO buffer
-    if (w->next_sess_ != NULL)
+    if (w->next_sess_ != nullptr)
       SSL_SESSION_free(w->next_sess_);
     w->next_sess_ = sess;
 
     Local<Object> info = Object::New(env->isolate());
 #ifndef OPENSSL_NO_TLSEXT
-    if (sess->tlsext_hostname == NULL) {
+    if (sess->tlsext_hostname == nullptr) {
       info->Set(env->servername_string(), False(args.GetIsolate()));
     } else {
       info->Set(env->servername_string(),
@@ -1496,7 +1497,7 @@ void SSLWrap<Base>::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
   Environment* env = w->ssl_env();
 
   SSL_SESSION* sess = SSL_get_session(w->ssl_);
-  if (sess == NULL || sess->tlsext_tick == NULL)
+  if (sess == nullptr || sess->tlsext_tick == nullptr)
     return;
 
   Local<Object> buf = Buffer::New(env,
@@ -1635,7 +1636,7 @@ void SSLWrap<Base>::GetCurrentCipher(const FunctionCallbackInfo<Value>& args) {
   Environment* env = w->ssl_env();
 
   OPENSSL_CONST SSL_CIPHER* c = SSL_get_current_cipher(w->ssl_);
-  if (c == NULL)
+  if (c == nullptr)
     return;
 
   Local<Object> info = Object::New(env->isolate());
@@ -1777,7 +1778,7 @@ int SSLWrap<Base>::TLSExtStatusCallback(SSL* s, void* arg) {
     const unsigned char* resp;
     int len = SSL_get_tlsext_status_ocsp_resp(s, &resp);
     Local<Value> arg;
-    if (resp == NULL) {
+    if (resp == nullptr) {
       arg = Null(env->isolate());
     } else {
       arg = Buffer::New(
@@ -1801,7 +1802,7 @@ int SSLWrap<Base>::TLSExtStatusCallback(SSL* s, void* arg) {
 
     // OpenSSL takes control of the pointer after accepting it
     char* data = reinterpret_cast<char*>(malloc(len));
-    CHECK_NE(data, NULL);
+    CHECK_NE(data, nullptr);
     memcpy(data, resp, len);
 
     if (!SSL_set_tlsext_status_ocsp_resp(s, data, len))
@@ -1933,7 +1934,7 @@ int Connection::HandleSSLError(const char* func,
     // into JavaScript. There is no test which demonstrates this problem.
     // https://github.com/joyent/node/issues/1719
     bio = BIO_new(BIO_s_mem());
-    if (bio != NULL) {
+    if (bio != nullptr) {
       ERR_print_errors(bio);
       BIO_get_mem_ptr(bio, &mem);
       Local<Value> exception = Exception::Error(
@@ -1983,7 +1984,7 @@ void Connection::SetShutdownFlags() {
 void Connection::NewSessionDoneCb() {
   HandleScope scope(env()->isolate());
 
-  MakeCallback(env()->onnewsessiondone_string(), 0, NULL);
+  MakeCallback(env()->onnewsessiondone_string(), 0, nullptr);
 }
 
 
@@ -2181,11 +2182,11 @@ void Connection::SSLInfoCallback(const SSL *ssl_, int where, int ret) {
   Context::Scope context_scope(env->context());
 
   if (where & SSL_CB_HANDSHAKE_START) {
-    conn->MakeCallback(env->onhandshakestart_string(), 0, NULL);
+    conn->MakeCallback(env->onhandshakestart_string(), 0, nullptr);
   }
 
   if (where & SSL_CB_HANDSHAKE_DONE) {
-    conn->MakeCallback(env->onhandshakedone_string(), 0, NULL);
+    conn->MakeCallback(env->onhandshakedone_string(), 0, nullptr);
   }
 }
 
@@ -2417,9 +2418,9 @@ void Connection::Start(const FunctionCallbackInfo<Value>& args) {
 void Connection::Close(const FunctionCallbackInfo<Value>& args) {
   Connection* conn = Unwrap<Connection>(args.Holder());
 
-  if (conn->ssl_ != NULL) {
+  if (conn->ssl_ != nullptr) {
     SSL_free(conn->ssl_);
-    conn->ssl_ = NULL;
+    conn->ssl_ = nullptr;
   }
 }
 
@@ -2483,9 +2484,9 @@ void CipherBase::Init(const char* cipher_type,
                       int key_buf_len) {
   HandleScope scope(env()->isolate());
 
-  CHECK_EQ(cipher_, NULL);
+  CHECK_EQ(cipher_, nullptr);
   cipher_ = EVP_get_cipherbyname(cipher_type);
-  if (cipher_ == NULL) {
+  if (cipher_ == nullptr) {
     return env()->ThrowError("Unknown cipher");
   }
 
@@ -2494,7 +2495,7 @@ void CipherBase::Init(const char* cipher_type,
 
   int key_len = EVP_BytesToKey(cipher_,
                                EVP_md5(),
-                               NULL,
+                               nullptr,
                                reinterpret_cast<const unsigned char*>(key_buf),
                                key_buf_len,
                                1,
@@ -2502,15 +2503,16 @@ void CipherBase::Init(const char* cipher_type,
                                iv);
 
   EVP_CIPHER_CTX_init(&ctx_);
-  EVP_CipherInit_ex(&ctx_, cipher_, NULL, NULL, NULL, kind_ == kCipher);
+  const bool encrypt = (kind_ == kCipher);
+  EVP_CipherInit_ex(&ctx_, cipher_, nullptr, nullptr, nullptr, encrypt);
   if (!EVP_CIPHER_CTX_set_key_length(&ctx_, key_len)) {
     EVP_CIPHER_CTX_cleanup(&ctx_);
     return env()->ThrowError("Invalid key length");
   }
 
   EVP_CipherInit_ex(&ctx_,
-                    NULL,
-                    NULL,
+                    nullptr,
+                    nullptr,
                     reinterpret_cast<unsigned char*>(key),
                     reinterpret_cast<unsigned char*>(iv),
                     kind_ == kCipher);
@@ -2541,7 +2543,7 @@ void CipherBase::InitIv(const char* cipher_type,
   HandleScope scope(env()->isolate());
 
   cipher_ = EVP_get_cipherbyname(cipher_type);
-  if (cipher_ == NULL) {
+  if (cipher_ == nullptr) {
     return env()->ThrowError("Unknown cipher");
   }
 
@@ -2552,15 +2554,16 @@ void CipherBase::InitIv(const char* cipher_type,
     return env()->ThrowError("Invalid IV length");
   }
   EVP_CIPHER_CTX_init(&ctx_);
-  EVP_CipherInit_ex(&ctx_, cipher_, NULL, NULL, NULL, kind_ == kCipher);
+  const bool encrypt = (kind_ == kCipher);
+  EVP_CipherInit_ex(&ctx_, cipher_, nullptr, nullptr, nullptr, encrypt);
   if (!EVP_CIPHER_CTX_set_key_length(&ctx_, key_len)) {
     EVP_CIPHER_CTX_cleanup(&ctx_);
     return env()->ThrowError("Invalid key length");
   }
 
   EVP_CipherInit_ex(&ctx_,
-                    NULL,
-                    NULL,
+                    nullptr,
+                    nullptr,
                     reinterpret_cast<const unsigned char*>(key),
                     reinterpret_cast<const unsigned char*>(iv),
                     kind_ == kCipher);
@@ -2612,7 +2615,7 @@ void CipherBase::GetAuthTag(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CipherBase* cipher = Unwrap<CipherBase>(args.Holder());
 
-  char* out = NULL;
+  char* out = nullptr;
   unsigned int out_len = 0;
 
   if (cipher->GetAuthTag(&out, &out_len)) {
@@ -2654,7 +2657,7 @@ bool CipherBase::SetAAD(const char* data, unsigned int len) {
     return false;
   int outlen;
   if (!EVP_CipherUpdate(&ctx_,
-                        NULL,
+                        nullptr,
                         &outlen,
                         reinterpret_cast<const unsigned char*>(data),
                         len)) {
@@ -2684,13 +2687,13 @@ bool CipherBase::Update(const char* data,
     return 0;
 
   // on first update:
-  if (kind_ == kDecipher && IsAuthenticatedMode() && auth_tag_ != NULL) {
+  if (kind_ == kDecipher && IsAuthenticatedMode() && auth_tag_ != nullptr) {
     EVP_CIPHER_CTX_ctrl(&ctx_,
                         EVP_CTRL_GCM_SET_TAG,
                         auth_tag_len_,
                         reinterpret_cast<unsigned char*>(auth_tag_));
     delete[] auth_tag_;
-    auth_tag_ = NULL;
+    auth_tag_ = nullptr;
   }
 
   *out_len = len + EVP_CIPHER_CTX_block_size(&ctx_);
@@ -2710,7 +2713,7 @@ void CipherBase::Update(const FunctionCallbackInfo<Value>& args) {
 
   ASSERT_IS_STRING_OR_BUFFER(args[0]);
 
-  unsigned char* out = NULL;
+  unsigned char* out = nullptr;
   bool r;
   int out_len = 0;
 
@@ -2772,7 +2775,7 @@ bool CipherBase::Final(unsigned char** out, int *out_len) {
 
   if (r && kind_ == kCipher) {
     delete[] auth_tag_;
-    auth_tag_ = NULL;
+    auth_tag_ = nullptr;
     if (IsAuthenticatedMode()) {
       auth_tag_len_ = EVP_GCM_TLS_TAG_LEN;  // use default tag length
       auth_tag_ = new char[auth_tag_len_];
@@ -2796,7 +2799,7 @@ void CipherBase::Final(const FunctionCallbackInfo<Value>& args) {
 
   CipherBase* cipher = Unwrap<CipherBase>(args.Holder());
 
-  unsigned char* out_value = NULL;
+  unsigned char* out_value = nullptr;
   int out_len = -1;
   Local<Value> outString;
 
@@ -2804,7 +2807,7 @@ void CipherBase::Final(const FunctionCallbackInfo<Value>& args) {
 
   if (out_len <= 0 || !r) {
     delete[] out_value;
-    out_value = NULL;
+    out_value = nullptr;
     out_len = 0;
     if (!r) {
       const char* msg = cipher->IsAuthenticatedMode() ?
@@ -2845,9 +2848,9 @@ void Hmac::New(const FunctionCallbackInfo<Value>& args) {
 void Hmac::HmacInit(const char* hash_type, const char* key, int key_len) {
   HandleScope scope(env()->isolate());
 
-  CHECK_EQ(md_, NULL);
+  CHECK_EQ(md_, nullptr);
   md_ = EVP_get_digestbyname(hash_type);
-  if (md_ == NULL) {
+  if (md_ == nullptr) {
     return env()->ThrowError("Unknown message digest");
   }
   HMAC_CTX_init(&ctx_);
@@ -2941,12 +2944,12 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
     encoding = ParseEncoding(env->isolate(), args[0]->ToString(), BUFFER);
   }
 
-  unsigned char* md_value = NULL;
+  unsigned char* md_value = nullptr;
   unsigned int md_len = 0;
 
   bool r = hmac->HmacDigest(&md_value, &md_len);
   if (!r) {
-    md_value = NULL;
+    md_value = nullptr;
     md_len = 0;
   }
 
@@ -2988,12 +2991,12 @@ void Hash::New(const FunctionCallbackInfo<Value>& args) {
 
 
 bool Hash::HashInit(const char* hash_type) {
-  CHECK_EQ(md_, NULL);
+  CHECK_EQ(md_, nullptr);
   md_ = EVP_get_digestbyname(hash_type);
-  if (md_ == NULL)
+  if (md_ == nullptr)
     return false;
   EVP_MD_CTX_init(&mdctx_);
-  EVP_DigestInit_ex(&mdctx_, md_, NULL);
+  EVP_DigestInit_ex(&mdctx_, md_, nullptr);
   initialised_ = true;
   return true;
 }
@@ -3131,13 +3134,13 @@ void Sign::New(const FunctionCallbackInfo<Value>& args) {
 
 
 SignBase::Error Sign::SignInit(const char* sign_type) {
-  CHECK_EQ(md_, NULL);
+  CHECK_EQ(md_, nullptr);
   md_ = EVP_get_digestbyname(sign_type);
   if (!md_)
     return kSignUnknownDigest;
 
   EVP_MD_CTX_init(&mdctx_);
-  if (!EVP_SignInit_ex(&mdctx_, md_, NULL))
+  if (!EVP_SignInit_ex(&mdctx_, md_, nullptr))
     return kSignInit;
   initialised_ = true;
 
@@ -3207,19 +3210,19 @@ SignBase::Error Sign::SignFinal(const char* key_pem,
   if (!initialised_)
     return kSignNotInitialised;
 
-  BIO* bp = NULL;
-  EVP_PKEY* pkey = NULL;
+  BIO* bp = nullptr;
+  EVP_PKEY* pkey = nullptr;
   bool fatal = true;
 
   bp = BIO_new_mem_buf(const_cast<char*>(key_pem), key_pem_len);
-  if (bp == NULL)
+  if (bp == nullptr)
     goto exit;
 
   pkey = PEM_read_bio_PrivateKey(bp,
-                                 NULL,
+                                 nullptr,
                                  CryptoPemCallback,
                                  const_cast<char*>(passphrase));
-  if (pkey == NULL)
+  if (pkey == nullptr)
     goto exit;
 
   if (EVP_SignFinal(&mdctx_, *sig, sig_len, pkey))
@@ -3228,9 +3231,9 @@ SignBase::Error Sign::SignFinal(const char* key_pem,
   initialised_ = false;
 
  exit:
-  if (pkey != NULL)
+  if (pkey != nullptr)
     EVP_PKEY_free(pkey);
-  if (bp != NULL)
+  if (bp != nullptr)
     BIO_free_all(bp);
 
   EVP_MD_CTX_cleanup(&mdctx_);
@@ -3268,12 +3271,12 @@ void Sign::SignFinal(const FunctionCallbackInfo<Value>& args) {
   Error err = sign->SignFinal(
       buf,
       buf_len,
-      len >= 3 && !args[2]->IsNull() ? *passphrase : NULL,
+      len >= 3 && !args[2]->IsNull() ? *passphrase : nullptr,
       &md_value,
       &md_len);
   if (err != kSignOk) {
     delete[] md_value;
-    md_value = NULL;
+    md_value = nullptr;
     md_len = 0;
     return sign->CheckThrow(err);
   }
@@ -3308,13 +3311,13 @@ void Verify::New(const FunctionCallbackInfo<Value>& args) {
 
 
 SignBase::Error Verify::VerifyInit(const char* verify_type) {
-  CHECK_EQ(md_, NULL);
+  CHECK_EQ(md_, nullptr);
   md_ = EVP_get_digestbyname(verify_type);
-  if (md_ == NULL)
+  if (md_ == nullptr)
     return kSignUnknownDigest;
 
   EVP_MD_CTX_init(&mdctx_);
-  if (!EVP_VerifyInit_ex(&mdctx_, md_, NULL))
+  if (!EVP_VerifyInit_ex(&mdctx_, md_, nullptr))
     return kSignInit;
   initialised_ = true;
 
@@ -3389,41 +3392,42 @@ SignBase::Error Verify::VerifyFinal(const char* key_pem,
   ClearErrorOnReturn clear_error_on_return;
   (void) &clear_error_on_return;  // Silence compiler warning.
 
-  EVP_PKEY* pkey = NULL;
-  BIO* bp = NULL;
-  X509* x509 = NULL;
+  EVP_PKEY* pkey = nullptr;
+  BIO* bp = nullptr;
+  X509* x509 = nullptr;
   bool fatal = true;
   int r = 0;
 
   bp = BIO_new_mem_buf(const_cast<char*>(key_pem), key_pem_len);
-  if (bp == NULL)
+  if (bp == nullptr)
     goto exit;
 
   // Check if this is a PKCS#8 or RSA public key before trying as X.509.
   // Split this out into a separate function once we have more than one
   // consumer of public keys.
   if (strncmp(key_pem, PUBLIC_KEY_PFX, PUBLIC_KEY_PFX_LEN) == 0) {
-    pkey = PEM_read_bio_PUBKEY(bp, NULL, CryptoPemCallback, NULL);
-    if (pkey == NULL)
+    pkey = PEM_read_bio_PUBKEY(bp, nullptr, CryptoPemCallback, nullptr);
+    if (pkey == nullptr)
       goto exit;
   } else if (strncmp(key_pem, PUBRSA_KEY_PFX, PUBRSA_KEY_PFX_LEN) == 0) {
-    RSA* rsa = PEM_read_bio_RSAPublicKey(bp, NULL, CryptoPemCallback, NULL);
+    RSA* rsa =
+        PEM_read_bio_RSAPublicKey(bp, nullptr, CryptoPemCallback, nullptr);
     if (rsa) {
       pkey = EVP_PKEY_new();
       if (pkey)
         EVP_PKEY_set1_RSA(pkey, rsa);
       RSA_free(rsa);
     }
-    if (pkey == NULL)
+    if (pkey == nullptr)
       goto exit;
   } else {
     // X.509 fallback
-    x509 = PEM_read_bio_X509(bp, NULL, CryptoPemCallback, NULL);
-    if (x509 == NULL)
+    x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
+    if (x509 == nullptr)
       goto exit;
 
     pkey = X509_get_pubkey(x509);
-    if (pkey == NULL)
+    if (pkey == nullptr)
       goto exit;
   }
 
@@ -3434,11 +3438,11 @@ SignBase::Error Verify::VerifyFinal(const char* key_pem,
                       pkey);
 
  exit:
-  if (pkey != NULL)
+  if (pkey != nullptr)
     EVP_PKEY_free(pkey);
-  if (bp != NULL)
+  if (bp != nullptr)
     BIO_free_all(bp);
-  if (x509 != NULL)
+  if (x509 != nullptr)
     X509_free(x509);
 
   EVP_MD_CTX_cleanup(&mdctx_);
@@ -3505,53 +3509,53 @@ bool PublicKeyCipher::Cipher(const char* key_pem,
                              int len,
                              unsigned char** out,
                              size_t* out_len) {
-  EVP_PKEY* pkey = NULL;
-  EVP_PKEY_CTX* ctx = NULL;
-  BIO* bp = NULL;
-  X509* x509 = NULL;
+  EVP_PKEY* pkey = nullptr;
+  EVP_PKEY_CTX* ctx = nullptr;
+  BIO* bp = nullptr;
+  X509* x509 = nullptr;
   bool fatal = true;
 
   bp = BIO_new_mem_buf(const_cast<char*>(key_pem), key_pem_len);
-  if (bp == NULL)
+  if (bp == nullptr)
     goto exit;
 
   // Check if this is a PKCS#8 or RSA public key before trying as X.509 and
   // private key.
   if (operation == kEncrypt &&
       strncmp(key_pem, PUBLIC_KEY_PFX, PUBLIC_KEY_PFX_LEN) == 0) {
-    pkey = PEM_read_bio_PUBKEY(bp, NULL, NULL, NULL);
-    if (pkey == NULL)
+    pkey = PEM_read_bio_PUBKEY(bp, nullptr, nullptr, nullptr);
+    if (pkey == nullptr)
       goto exit;
   } else if (operation == kEncrypt &&
              strncmp(key_pem, PUBRSA_KEY_PFX, PUBRSA_KEY_PFX_LEN) == 0) {
-    RSA* rsa = PEM_read_bio_RSAPublicKey(bp, NULL, NULL, NULL);
+    RSA* rsa = PEM_read_bio_RSAPublicKey(bp, nullptr, nullptr, nullptr);
     if (rsa) {
       pkey = EVP_PKEY_new();
       if (pkey)
         EVP_PKEY_set1_RSA(pkey, rsa);
       RSA_free(rsa);
     }
-    if (pkey == NULL)
+    if (pkey == nullptr)
       goto exit;
   } else if (operation == kEncrypt &&
              strncmp(key_pem, CERTIFICATE_PFX, CERTIFICATE_PFX_LEN) == 0) {
-    x509 = PEM_read_bio_X509(bp, NULL, CryptoPemCallback, NULL);
-    if (x509 == NULL)
+    x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
+    if (x509 == nullptr)
       goto exit;
 
     pkey = X509_get_pubkey(x509);
-    if (pkey == NULL)
+    if (pkey == nullptr)
       goto exit;
   } else {
     pkey = PEM_read_bio_PrivateKey(bp,
-                                   NULL,
+                                   nullptr,
                                    CryptoPemCallback,
                                    const_cast<char*>(passphrase));
-    if (pkey == NULL)
+    if (pkey == nullptr)
       goto exit;
   }
 
-  ctx = EVP_PKEY_CTX_new(pkey, NULL);
+  ctx = EVP_PKEY_CTX_new(pkey, nullptr);
   if (!ctx)
     goto exit;
   if (EVP_PKEY_cipher_init(ctx) <= 0)
@@ -3559,7 +3563,7 @@ bool PublicKeyCipher::Cipher(const char* key_pem,
   if (EVP_PKEY_CTX_set_rsa_padding(ctx, padding) <= 0)
     goto exit;
 
-  if (EVP_PKEY_cipher(ctx, NULL, out_len, data, len) <= 0)
+  if (EVP_PKEY_cipher(ctx, nullptr, out_len, data, len) <= 0)
     goto exit;
 
   *out = new unsigned char[*out_len];
@@ -3570,11 +3574,11 @@ bool PublicKeyCipher::Cipher(const char* key_pem,
   fatal = false;
 
  exit:
-  if (pkey != NULL)
+  if (pkey != nullptr)
     EVP_PKEY_free(pkey);
-  if (bp != NULL)
+  if (bp != nullptr)
     BIO_free_all(bp);
-  if (ctx != NULL)
+  if (ctx != nullptr)
     EVP_PKEY_CTX_free(ctx);
 
   return !fatal;
@@ -3599,13 +3603,13 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
 
   String::Utf8Value passphrase(args[3]);
 
-  unsigned char* out_value = NULL;
+  unsigned char* out_value = nullptr;
   size_t out_len = 0;
 
   bool r = Cipher<operation, EVP_PKEY_cipher_init, EVP_PKEY_cipher>(
       kbuf,
       klen,
-      args.Length() >= 3 && !args[2]->IsNull() ? *passphrase : NULL,
+      args.Length() >= 3 && !args[2]->IsNull() ? *passphrase : nullptr,
       padding,
       reinterpret_cast<const unsigned char*>(buf),
       len,
@@ -3614,7 +3618,7 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
 
   if (out_len == 0 || !r) {
     delete[] out_value;
-    out_value = NULL;
+    out_value = nullptr;
     out_len = 0;
     if (!r) {
       return ThrowCryptoError(env,
@@ -3647,7 +3651,7 @@ void DiffieHellman::Initialize(Environment* env, Handle<Object> target) {
 
   t->InstanceTemplate()->SetAccessor(env->verify_error_string(),
                                      DiffieHellman::VerifyErrorGetter,
-                                     NULL,
+                                     nullptr,
                                      Handle<Value>(),
                                      v8::DEFAULT,
                                      attributes);
@@ -3667,7 +3671,7 @@ void DiffieHellman::Initialize(Environment* env, Handle<Object> target) {
 
   t2->InstanceTemplate()->SetAccessor(env->verify_error_string(),
                                       DiffieHellman::VerifyErrorGetter,
-                                      NULL,
+                                      nullptr,
                                       Handle<Value>(),
                                       v8::DEFAULT,
                                       attributes);
@@ -3845,7 +3849,7 @@ void DiffieHellman::GetPublicKey(const FunctionCallbackInfo<Value>& args) {
     return env->ThrowError("Not initialized");
   }
 
-  if (diffieHellman->dh->pub_key == NULL) {
+  if (diffieHellman->dh->pub_key == nullptr) {
     return env->ThrowError("No public key - did you forget to generate one?");
   }
 
@@ -3868,7 +3872,7 @@ void DiffieHellman::GetPrivateKey(const FunctionCallbackInfo<Value>& args) {
     return env->ThrowError("Not initialized");
   }
 
-  if (diffieHellman->dh->priv_key == NULL) {
+  if (diffieHellman->dh->priv_key == nullptr) {
     return env->ThrowError("No private key - did you forget to generate one?");
   }
 
@@ -3893,7 +3897,7 @@ void DiffieHellman::ComputeSecret(const FunctionCallbackInfo<Value>& args) {
 
   ClearErrorOnReturn clear_error_on_return;
   (void) &clear_error_on_return;  // Silence compiler warning.
-  BIGNUM* key = NULL;
+  BIGNUM* key = nullptr;
 
   if (args.Length() == 0) {
     return env->ThrowError("First argument must be other party's public key");
@@ -4045,7 +4049,7 @@ void ECDH::New(const FunctionCallbackInfo<Value>& args) {
     return env->ThrowTypeError("First argument should be a valid curve name");
 
   EC_KEY* key = EC_KEY_new_by_curve_name(nid);
-  if (key == NULL)
+  if (key == nullptr)
     return env->ThrowError("Failed to create EC_KEY using curve name");
 
   new ECDH(env, args.This(), key);
@@ -4069,9 +4073,9 @@ EC_POINT* ECDH::BufferToPoint(char* data, size_t len) {
   int r;
 
   pub = EC_POINT_new(group_);
-  if (pub == NULL) {
+  if (pub == nullptr) {
     env()->ThrowError("Failed to allocate EC_POINT for a public key");
-    return NULL;
+    return nullptr;
   }
 
   r = EC_POINT_oct2point(
@@ -4079,7 +4083,7 @@ EC_POINT* ECDH::BufferToPoint(char* data, size_t len) {
       pub,
       reinterpret_cast<unsigned char*>(data),
       len,
-      NULL);
+      nullptr);
   if (!r) {
     env()->ThrowError("Failed to translate Buffer to a EC_POINT");
     goto fatal;
@@ -4089,7 +4093,7 @@ EC_POINT* ECDH::BufferToPoint(char* data, size_t len) {
 
  fatal:
   EC_POINT_free(pub);
-  return NULL;
+  return nullptr;
 }
 
 
@@ -4102,16 +4106,16 @@ void ECDH::ComputeSecret(const FunctionCallbackInfo<Value>& args) {
 
   EC_POINT* pub = ecdh->BufferToPoint(Buffer::Data(args[0]),
                                       Buffer::Length(args[0]));
-  if (pub == NULL)
+  if (pub == nullptr)
     return;
 
   // NOTE: field_size is in bits
   int field_size = EC_GROUP_get_degree(ecdh->group_);
   size_t out_len = (field_size + 7) / 8;
   char* out = static_cast<char*>(malloc(out_len));
-  CHECK_NE(out, NULL);
+  CHECK_NE(out, nullptr);
 
-  int r = ECDH_compute_key(out, out_len, pub, ecdh->key_, NULL);
+  int r = ECDH_compute_key(out, out_len, pub, ecdh->key_, nullptr);
   EC_POINT_free(pub);
   if (!r) {
     free(out);
@@ -4134,21 +4138,21 @@ void ECDH::GetPublicKey(const FunctionCallbackInfo<Value>& args) {
     return env->ThrowError("You should generate ECDH keys first");
 
   const EC_POINT* pub = EC_KEY_get0_public_key(ecdh->key_);
-  if (pub == NULL)
+  if (pub == nullptr)
     return env->ThrowError("Failed to get ECDH public key");
 
   int size;
   point_conversion_form_t form =
       static_cast<point_conversion_form_t>(args[0]->Uint32Value());
 
-  size = EC_POINT_point2oct(ecdh->group_, pub, form, NULL, 0, NULL);
+  size = EC_POINT_point2oct(ecdh->group_, pub, form, nullptr, 0, nullptr);
   if (size == 0)
     return env->ThrowError("Failed to get public key length");
 
   unsigned char* out = static_cast<unsigned char*>(malloc(size));
-  CHECK_NE(out, NULL);
+  CHECK_NE(out, nullptr);
 
-  int r = EC_POINT_point2oct(ecdh->group_, pub, form, out, size, NULL);
+  int r = EC_POINT_point2oct(ecdh->group_, pub, form, out, size, nullptr);
   if (r != size) {
     free(out);
     return env->ThrowError("Failed to get public key");
@@ -4169,12 +4173,12 @@ void ECDH::GetPrivateKey(const FunctionCallbackInfo<Value>& args) {
     return env->ThrowError("You should generate ECDH keys first");
 
   const BIGNUM* b = EC_KEY_get0_private_key(ecdh->key_);
-  if (b == NULL)
+  if (b == nullptr)
     return env->ThrowError("Failed to get ECDH private key");
 
   int size = BN_num_bytes(b);
   unsigned char* out = static_cast<unsigned char*>(malloc(size));
-  CHECK_NE(out, NULL);
+  CHECK_NE(out, nullptr);
 
   if (size != BN_bn2bin(b, out)) {
     free(out);
@@ -4197,8 +4201,8 @@ void ECDH::SetPrivateKey(const FunctionCallbackInfo<Value>& args) {
   BIGNUM* priv = BN_bin2bn(
       reinterpret_cast<unsigned char*>(Buffer::Data(args[0].As<Object>())),
       Buffer::Length(args[0].As<Object>()),
-      NULL);
-  if (priv == NULL)
+      nullptr);
+  if (priv == nullptr)
     return env->ThrowError("Failed to convert Buffer to BN");
 
   if (!EC_KEY_set_private_key(ecdh->key_, priv))
@@ -4215,7 +4219,7 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
 
   EC_POINT* pub = ecdh->BufferToPoint(Buffer::Data(args[0].As<Object>()),
                                       Buffer::Length(args[0].As<Object>()));
-  if (pub == NULL)
+  if (pub == nullptr)
     return;
 
   int r = EC_KEY_set_public_key(ecdh->key_, pub);
@@ -4246,7 +4250,7 @@ class PBKDF2Request : public AsyncWrap {
         keylen_(keylen),
         key_(static_cast<char*>(malloc(keylen))),
         iter_(iter) {
-    if (key() == NULL)
+    if (key() == nullptr)
       FatalError("node::PBKDF2Request()", "Out of Memory");
   }
 
@@ -4372,15 +4376,15 @@ void EIO_PBKDF2After(uv_work_t* work_req, int status) {
 void PBKDF2(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  const EVP_MD* digest = NULL;
-  const char* type_error = NULL;
-  char* pass = NULL;
-  char* salt = NULL;
+  const EVP_MD* digest = nullptr;
+  const char* type_error = nullptr;
+  char* pass = nullptr;
+  char* salt = nullptr;
   ssize_t passlen = -1;
   ssize_t saltlen = -1;
   ssize_t keylen = -1;
   ssize_t iter = -1;
-  PBKDF2Request* req = NULL;
+  PBKDF2Request* req = nullptr;
   Local<Object> obj;
 
   if (args.Length() != 5 && args.Length() != 6) {
@@ -4398,7 +4402,7 @@ void PBKDF2(const FunctionCallbackInfo<Value>& args) {
   ASSERT_IS_BUFFER(args[1]);
 
   pass = static_cast<char*>(malloc(passlen));
-  if (pass == NULL) {
+  if (pass == nullptr) {
     FatalError("node::PBKDF2()", "Out of Memory");
   }
   memcpy(pass, Buffer::Data(args[0]), passlen);
@@ -4410,7 +4414,7 @@ void PBKDF2(const FunctionCallbackInfo<Value>& args) {
   }
 
   salt = static_cast<char*>(malloc(saltlen));
-  if (salt == NULL) {
+  if (salt == nullptr) {
     FatalError("node::PBKDF2()", "Out of Memory");
   }
   memcpy(salt, Buffer::Data(args[1]), saltlen);
@@ -4440,13 +4444,13 @@ void PBKDF2(const FunctionCallbackInfo<Value>& args) {
   if (args[4]->IsString()) {
     node::Utf8Value digest_name(args[4]);
     digest = EVP_get_digestbyname(*digest_name);
-    if (digest == NULL) {
+    if (digest == nullptr) {
       type_error = "Bad digest name";
       goto err;
     }
   }
 
-  if (digest == NULL) {
+  if (digest == nullptr) {
     digest = EVP_sha1();
   }
 
@@ -4496,7 +4500,7 @@ class RandomBytesRequest : public AsyncWrap {
         error_(0),
         size_(size),
         data_(static_cast<char*>(malloc(size))) {
-    if (data() == NULL)
+    if (data() == nullptr)
       FatalError("node::RandomBytesRequest()", "Out of Memory");
   }
 
@@ -4523,7 +4527,7 @@ class RandomBytesRequest : public AsyncWrap {
 
   inline void return_memory(char** d, size_t* len) {
     *d = data_;
-    data_ = NULL;
+    data_ = nullptr;
     *len = size_;
     size_ = 0;
   }
@@ -4583,7 +4587,7 @@ void RandomBytesCheck(RandomBytesRequest* req, Local<Value> argv[2]) {
     argv[1] = Null(req->env()->isolate());
     req->release();
   } else {
-    char* data = NULL;
+    char* data = nullptr;
     size_t size;
     req->return_memory(&data, &size);
     argv[0] = Null(req->env()->isolate());
@@ -4652,12 +4656,12 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
   SSL_CTX* ctx = SSL_CTX_new(TLSv1_server_method());
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return env->ThrowError("SSL_CTX_new() failed.");
   }
 
   SSL* ssl = SSL_new(ctx);
-  if (ssl == NULL) {
+  if (ssl == nullptr) {
     SSL_CTX_free(ctx);
     return env->ThrowError("SSL_new() failed.");
   }
@@ -4743,24 +4747,24 @@ void Certificate::New(const FunctionCallbackInfo<Value>& args) {
 
 bool Certificate::VerifySpkac(const char* data, unsigned int len) {
   bool i = 0;
-  EVP_PKEY* pkey = NULL;
-  NETSCAPE_SPKI* spki = NULL;
+  EVP_PKEY* pkey = nullptr;
+  NETSCAPE_SPKI* spki = nullptr;
 
   spki = NETSCAPE_SPKI_b64_decode(data, len);
-  if (spki == NULL)
+  if (spki == nullptr)
     goto exit;
 
   pkey = X509_PUBKEY_get(spki->spkac->pubkey);
-  if (pkey == NULL)
+  if (pkey == nullptr)
     goto exit;
 
   i = NETSCAPE_SPKI_verify(spki, pkey) > 0;
 
  exit:
-  if (pkey != NULL)
+  if (pkey != nullptr)
     EVP_PKEY_free(pkey);
 
-  if (spki != NULL)
+  if (spki != nullptr)
     NETSCAPE_SPKI_free(spki);
 
   return i;
@@ -4782,7 +4786,7 @@ void Certificate::VerifySpkac(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().Set(i);
 
   char* data = Buffer::Data(args[0]);
-  CHECK_NE(data, NULL);
+  CHECK_NE(data, nullptr);
 
   i = certificate->VerifySpkac(data, length);
 
@@ -4791,20 +4795,20 @@ void Certificate::VerifySpkac(const FunctionCallbackInfo<Value>& args) {
 
 
 const char* Certificate::ExportPublicKey(const char* data, int len) {
-  char* buf = NULL;
-  EVP_PKEY* pkey = NULL;
-  NETSCAPE_SPKI* spki = NULL;
+  char* buf = nullptr;
+  EVP_PKEY* pkey = nullptr;
+  NETSCAPE_SPKI* spki = nullptr;
 
   BIO* bio = BIO_new(BIO_s_mem());
-  if (bio == NULL)
+  if (bio == nullptr)
     goto exit;
 
   spki = NETSCAPE_SPKI_b64_decode(data, len);
-  if (spki == NULL)
+  if (spki == nullptr)
     goto exit;
 
   pkey = NETSCAPE_SPKI_get_pubkey(spki);
-  if (pkey == NULL)
+  if (pkey == nullptr)
     goto exit;
 
   if (PEM_write_bio_PUBKEY(bio, pkey) <= 0)
@@ -4818,13 +4822,13 @@ const char* Certificate::ExportPublicKey(const char* data, int len) {
   memcpy(buf, ptr->data, ptr->length);
 
  exit:
-  if (pkey != NULL)
+  if (pkey != nullptr)
     EVP_PKEY_free(pkey);
 
-  if (spki != NULL)
+  if (spki != nullptr)
     NETSCAPE_SPKI_free(spki);
 
-  if (bio != NULL)
+  if (bio != nullptr)
     BIO_free_all(bio);
 
   return buf;
@@ -4846,10 +4850,10 @@ void Certificate::ExportPublicKey(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().SetEmptyString();
 
   char* data = Buffer::Data(args[0]);
-  CHECK_NE(data, NULL);
+  CHECK_NE(data, nullptr);
 
   const char* pkey = certificate->ExportPublicKey(data, length);
-  if (pkey == NULL)
+  if (pkey == nullptr)
     return args.GetReturnValue().SetEmptyString();
 
   Local<Value> out = Encode(env->isolate(), pkey, strlen(pkey), BUFFER);
@@ -4861,13 +4865,13 @@ void Certificate::ExportPublicKey(const FunctionCallbackInfo<Value>& args) {
 
 
 const char* Certificate::ExportChallenge(const char* data, int len) {
-  NETSCAPE_SPKI* sp = NULL;
+  NETSCAPE_SPKI* sp = nullptr;
 
   sp = NETSCAPE_SPKI_b64_decode(data, len);
-  if (sp == NULL)
-    return NULL;
+  if (sp == nullptr)
+    return nullptr;
 
-  const char* buf = NULL;
+  const char* buf = nullptr;
   buf = reinterpret_cast<const char*>(ASN1_STRING_data(sp->spkac->challenge));
 
   return buf;
@@ -4889,10 +4893,10 @@ void Certificate::ExportChallenge(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().SetEmptyString();
 
   char* data = Buffer::Data(args[0]);
-  CHECK_NE(data, NULL);
+  CHECK_NE(data, nullptr);
 
   const char* cert = crt->ExportChallenge(data, len);
-  if (cert == NULL)
+  if (cert == nullptr)
     return args.GetReturnValue().SetEmptyString();
 
   Local<Value> outString = Encode(env->isolate(), cert, strlen(cert), BUFFER);
@@ -4943,18 +4947,18 @@ void SetEngine(const FunctionCallbackInfo<Value>& args) {
   ENGINE* engine = ENGINE_by_id(*engine_id);
 
   // Engine not found, try loading dynamically
-  if (engine == NULL) {
+  if (engine == nullptr) {
     engine = ENGINE_by_id("dynamic");
-    if (engine != NULL) {
+    if (engine != nullptr) {
       if (!ENGINE_ctrl_cmd_string(engine, "SO_PATH", *engine_id, 0) ||
-          !ENGINE_ctrl_cmd_string(engine, "LOAD", NULL, 0)) {
+          !ENGINE_ctrl_cmd_string(engine, "LOAD", nullptr, 0)) {
         ENGINE_free(engine);
-        engine = NULL;
+        engine = nullptr;
       }
     }
   }
 
-  if (engine == NULL) {
+  if (engine == nullptr) {
     int err = ERR_get_error();
     if (err == 0) {
       char tmp[1024];