#fixed code
                                private static void initDocBuilder() throws ParserConfigurationException {
        DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();
        docBuilderFactory.setIgnoringComments(true);

        docBuilder = docBuilderFactory.newDocumentBuilder();
	docBuilder.setEntityResolver(new EntityResolver() {
		public InputSource resolveEntity(String publicId, String systemId) {
		    if (publicId.equals("-//Apple Computer//DTD PLIST 1.0//EN") || // older publicId
			publicId.equals("-//Apple//DTD PLIST 1.0//EN")) { // newer publicId
			// return a dummy, zero length DTD so we don't have to fetch
			// it from the network.
			return new InputSource(new ByteArrayInputStream(new byte[0]));
		    }
		    return null;
		}
	    });
    }
#vulnerable code 
                                private static void initDocBuilder() throws ParserConfigurationException {
        boolean offline = false;
        try {
            URL dtdUrl = new URL("http://www.apple.com/DTDs/PropertyList-1.0.dtd");
            InputStream dtdIs = dtdUrl.openStream();
            dtdIs.read();
            dtdIs.close();
            //If we came this far the DTD is accessible
        } catch (Exception ex) {
            System.out.println("DTD is not accessible: "+ex.getLocalizedMessage());
            System.out.println("Switching to offline parsing");
            offline = true;
        }
        DocumentBuilderFactory docBuilderFactory = DocumentBuilderFactory.newInstance();

        if(System.getProperty("java.vendor").toLowerCase().contains("android")) {
            //The Android parser works differently
            //See discussion around issue 13 (https://code.google.com/p/plist/issues/detail?id=13)
            docBuilderFactory.setValidating(false);
            skipTextNodes = true;
        } else {
            if(offline) {
                docBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
                docBuilderFactory.setValidating(false);
                skipTextNodes = true;
            } else {
                docBuilderFactory.setValidating(true);
                docBuilderFactory.setIgnoringElementContentWhitespace(true);
                skipTextNodes = false;
            }
        }
        

        docBuilderFactory.setIgnoringComments(true);

        docBuilder = docBuilderFactory.newDocumentBuilder();
    } 
                            #location 16 
                            #vulnerability type NULL_DEREFERENCE