#fixed code
                             public Order orderQuery(IdQuery idQuery) throws WeixinException {
		Map<String, String> map = baseMap(idQuery);
		String sign = PayUtil.paysignMd5(map, weixinAccount.getPaySignKey());
		map.put("sign", sign);
		String param = XmlStream.map2xml(map);
		String orderquery_uri = getRequestUri("orderquery_v3_uri");
		WeixinResponse response = weixinClient.post(orderquery_uri, param);
		return ListsuffixResultDeserializer.deserialize(response.getAsString(),
				Order.class, "couponList");
	}
#vulnerable code 
                             public Order orderQuery(IdQuery idQuery) throws WeixinException {
		Map<String, String> map = baseMap(idQuery);
		String sign = PayUtil.paysignMd5(map, weixinAccount.getPaySignKey());
		map.put("sign", sign);
		String param = XmlStream.map2xml(map);
		String orderquery_uri = getRequestUri("orderquery_v3_uri");
		WeixinResponse response = weixinClient.post(orderquery_uri, param);
		return ListsuffixResultDeserializer.containCouponDeserialize(
				response.getAsString(), Order.class);
	} 
                            #location 8 
                            #vulnerability type NULL_DEREFERENCE