#fixed code
                             private void putDecimal(String fieldName, BigDecimal bd) throws EncodingException{
		ExtensionObject eo = EncoderUtils.decimalToExtensionObject(bd);
		putExtensionObject(fieldName, eo);
	}
#vulnerable code 
                             private void putDecimal(String fieldName, BigDecimal bd) throws EncodingException{
		int scaleInt = bd.scale();
		if(scaleInt > Short.MAX_VALUE) {
			throw new EncodingException("Decimal scale overflow Short max value: "+scaleInt);
		}
		if(scaleInt < Short.MIN_VALUE) {
			throw new EncodingException("Decimal scale underflow Short min value: "+scaleInt);
		}
		short scale = (short)scaleInt;
		ByteBuffer bb = ByteBuffer.allocate(2);
		bb.order(ByteOrder.LITTLE_ENDIAN);
		bb.putShort(scale);
		byte[] scalebytes = bb.array();
		
		//NOTE BigInteger uses big-endian, and UA Decimal encoding uses little-endian
		byte[] valuebytes = EncoderUtils.reverse(bd.unscaledValue().toByteArray());
		byte[] combined = EncoderUtils.concat(scalebytes, valuebytes);
		
		ExpandedNodeId id = new ExpandedNodeId(NamespaceTable.OPCUA_NAMESPACE, Identifiers.Decimal.getValue());
		ExtensionObject eo = new ExtensionObject(id, combined);
		putExtensionObject(fieldName, eo);
	} 
                            #location 17 
                            #vulnerability type NULL_DEREFERENCE