#fixed code
                                public void onStarted(AbstractBuild<?, ?> build, TaskListener listener) {
        PrintStream logger = listener.getLogger();
        GhprbCause c = Ghprb.getCause(build);
        if (c == null) {
            return;
        }

        GhprbTrigger trigger = Ghprb.extractTrigger(build);

        ConcurrentMap<Integer, GhprbPullRequest> pulls = trigger.getDescriptor().getPullRequests(build.getProject().getFullName());

        GHPullRequest pr = pulls.get(c.getPullID()).getPullRequest();

        try {
            int counter = 0;
            // If the PR is being resolved by GitHub then getMergeable will return null
            Boolean isMergeable = pr.getMergeable();
            Boolean isMerged = pr.isMerged();
            // Not sure if isMerged can return null, but adding if just in case
            if (isMerged == null) {
                isMerged = false;
            }
            while (isMergeable == null && !isMerged && counter++ < 60) {
                Thread.sleep(1000);
                isMergeable = pr.getMergeable();
                isMerged = pr.isMerged();
                if (isMerged == null) {
                    isMerged = false;
                }
            }
            
            if (isMerged) {
                logger.println("PR has already been merged, builds using the merged sha1 will fail!!!");
            } else if (isMergeable == null) {
                logger.println("PR merge status couldn't be retrieved, maybe GitHub hasn't settled yet");
            } else if (isMergeable != c.isMerged()) {
                logger.println("!!! PR mergeability status has changed !!!  ");
                 if (isMergeable) {
                    logger.println("PR now has NO merge conflicts");
                } else if (!isMergeable) {
                    logger.println("PR now has merge conflicts!");
                }
            }
            
        } catch (Exception e) {
            logger.print("Unable to query GitHub for status of PullRequest");
            e.printStackTrace(logger);
        }

        for (GhprbExtension ext : Ghprb.getJobExtensions(trigger, GhprbCommitStatus.class)) {
            if (ext instanceof GhprbCommitStatus) {
                try {
                    ((GhprbCommitStatus) ext).onBuildStart(build, listener, repo.getGitHubRepo());
                } catch (GhprbCommitStatusException e) {
                    repo.commentOnFailure(build, listener, e);
                }
            }
        }
        try {
            build.setDescription("<a title=\"" + c.getTitle() + "\" href=\"" + c.getUrl() + "\">PR #" + c.getPullID() + "</a>: " + c.getAbbreviatedTitle());
        } catch (IOException ex) {
            logger.println("Can't update build description");
            ex.printStackTrace(logger);
        }
    }
#vulnerable code 
                                public void onStarted(AbstractBuild<?, ?> build, TaskListener listener) {
        PrintStream logger = listener.getLogger();
        GhprbCause c = Ghprb.getCause(build);
        if (c == null) {
            return;
        }

        GhprbTrigger trigger = Ghprb.extractTrigger(build);

        ConcurrentMap<Integer, GhprbPullRequest> pulls = trigger.getDescriptor().getPullRequests(build.getProject().getFullName());

        GHPullRequest pr = pulls.get(c.getPullID()).getPullRequest();

        try {
            int counter = 0;
            Boolean isMergeable = pr.getMergeable();
            Boolean isMerged = pr.isMerged();
            while (isMergeable == null && !isMerged && counter++ < 60) {
                Thread.sleep(1000);
                isMergeable = pr.getMergeable();
                isMerged = pr.isMerged();
            }

            if (isMergeable != c.isMerged() || isMerged == true) {
                logger.println("!!! PR status has changed !!!  ");
                if (isMergeable == null) {
                    if (isMerged) {
                        logger.println("PR has already been merged");
                    } else {
                        logger.println("PR merge status couldn't be retrieved, GitHub maybe hasn't settled yet");
                    }
                } else if (isMergeable) {
                    logger.println("PR has NO merge conflicts");
                } else if (!isMergeable) {
                    logger.println("PR has merge conflicts!");
                }
            }
        } catch (Exception e) {
            logger.print("Unable to query GitHub for status of PullRequest");
            e.printStackTrace(logger);
        }

        for (GhprbExtension ext : Ghprb.getJobExtensions(trigger, GhprbCommitStatus.class)) {
            if (ext instanceof GhprbCommitStatus) {
                try {
                    ((GhprbCommitStatus) ext).onBuildStart(build, listener, repo.getGitHubRepo());
                } catch (GhprbCommitStatusException e) {
                    repo.commentOnFailure(build, listener, e);
                }
            }
        }
        try {
            build.setDescription("<a title=\"" + c.getTitle() + "\" href=\"" + c.getUrl() + "\">PR #" + c.getPullID() + "</a>: " + c.getAbbreviatedTitle());
        } catch (IOException ex) {
            logger.println("Can't update build description");
            ex.printStackTrace(logger);
        }
    } 
                            #location 24 
                            #vulnerability type NULL_DEREFERENCE