#fixed code
                                private Object getWithProperty(Object ctx) {
        String root = new String(expr, 0, cursor - 1).trim();

        int start = cursor + 1;
        cursor = balancedCaptureWithLineAccounting(expr, cursor, '{', pCtx);

        WithAccessor wa = new WithAccessor(root, subset(expr, start, cursor++ - start), ingressType, false);

        addAccessorNode(wa);

        return wa.getValue(ctx, thisRef, variableFactory);
    }
#vulnerable code 
                                private Object getWithProperty(Object ctx) {
        String root = new String(expr, 0, cursor - 1).trim();

        int start = cursor + 1;
        int[] res = balancedCaptureWithLineAccounting(expr, cursor, '{');
        cursor = res[0];
        getParserContext().incrementLineCount(res[1]);

        WithAccessor wa = new WithAccessor(root, subset(expr, start, cursor++ - start), ingressType, false);

        addAccessorNode(wa);

        return wa.getValue(ctx, thisRef, variableFactory);
    } 
                            #location 7 
                            #vulnerability type NULL_DEREFERENCE