#fixed code
                                public void forcedLog(String fqcn, Priority level, Object message, Throwable t) {
        org.apache.logging.log4j.Level lvl = org.apache.logging.log4j.Level.toLevel(level.toString());
        Message msg = message instanceof Message ? (ObjectMessage) message : new ObjectMessage(message);
        logger.log(null, fqcn, lvl, msg, t);
    }
#vulnerable code 
                                public void forcedLog(String fqcn, Priority level, Object message, Throwable t) {
        org.apache.logging.log4j.Level lvl = org.apache.logging.log4j.Level.toLevel(level.toString());
        logger.log(null, fqcn, lvl, new ObjectMessage(message), t);
    } 
                            #location 3 
                            #vulnerability type NULL_DEREFERENCE