#fixed code
                                @Override
    public void visit(final UpdateRequest request) {
        coapRequest = Request.newPut();
        buildRequestSettings();
        coapRequest.getOptions().setUriPath(request.getRegistrationId());

        Long lifetime = request.getLifeTimeInSec();
        if (lifetime != null)
            coapRequest.getOptions().addUriQuery("lt=" + lifetime);

        String smsNumber = request.getSmsNumber();
        if (smsNumber != null)
            coapRequest.getOptions().addUriQuery("sms=" + smsNumber);

        BindingMode bindingMode = request.getBindingMode();
        if (bindingMode != null)
            coapRequest.getOptions().addUriQuery("b=" + bindingMode.toString());

        LinkObject[] linkObjects = request.getObjectLinks();
        if (linkObjects != null)
            coapRequest.setPayload(LinkObject.serialyse(linkObjects));
    }
#vulnerable code 
                                @Override
    public void visit(final UpdateRequest request) {
        coapRequest = Request.newPut();
        buildRequestSettings();
        coapRequest.getOptions().setUriPath(request.getRegistrationId());

        Long lifetime = request.getLifeTimeInSec();
        if (lifetime != null)
            coapRequest.getOptions().addUriQuery("lt=" + lifetime);

        String smsNumber = request.getSmsNumber();
        if (smsNumber != null)
            coapRequest.getOptions().addUriQuery("sms=" + smsNumber);

        BindingMode bindingMode = request.getBindingMode();
        if (bindingMode != null)
            coapRequest.getOptions().addUriQuery("b=" + bindingMode.toString());

        LinkObject[] linkObjects = request.getObjectLinks();
        if (linkObjects == null)
            coapRequest.setPayload(LinkObject.serialyse(linkObjects));
    } 
                            #location 21 
                            #vulnerability type NULL_DEREFERENCE