#vulnerable code 
                             @Test
	public void track1Test() {
		EmvCard card = new EmvCard();
		boolean ret = TrackUtils
				.extractTrack1Data(
						card,
						BytesUtils
								.fromString("70 75 9F 6C 02 00 01 9F 62 06 00 00 00 38 00 00 9F 63 06 00 00 00 00 E0 E0 56 34 42343131313131313131313131313131313f305e202f5e31373032323031313030333f313030313030303030303030303030303f30303030 9F 64 01 03 9F 65 02 1C 00 9F 66 02 03 F0 9F 6B 13 5566887766556677 D1 81 02 01 00 00 00 00 00 10 0F 9F 67 01 03 90 00"));

		Assertions.assertThat(ret).isTrue();
		Assertions.assertThat(card).isNotNull();
		Assertions.assertThat(card.getCardNumber()).isEqualTo("4111111111111111");
		SimpleDateFormat sdf = new SimpleDateFormat("MM/yyyy");
		Assertions.assertThat(sdf.format(card.getExpireDate())).isEqualTo("02/2017");
		Assertions.assertThat(card.getTrack1()).isNotNull();
		Assertions.assertThat(card.getTrack1().getService()).isNotNull();
		Assertions.assertThat(card.getTrack1().getService().getServiceCode1()).isEqualTo(ServiceCode1Enum.INTERNATIONNAL_ICC);
		Assertions.assertThat(card.getTrack1().getService().getServiceCode1().getInterchange()).isNotNull();
		Assertions.assertThat(card.getTrack1().getService().getServiceCode1().getTechnology()).isNotNull();
		Assertions.assertThat(card.getTrack1().getService().getServiceCode2()).isEqualTo(ServiceCode2Enum.NORMAL);
		Assertions.assertThat(card.getTrack1().getService().getServiceCode2().getAuthorizationProcessing()).isNotNull();
		Assertions.assertThat(card.getTrack1().getService().getServiceCode3()).isEqualTo(ServiceCode3Enum.NO_RESTRICTION);
		Assertions.assertThat(card.getTrack1().getService().getServiceCode3().getAllowedServices()).isNotNull();
		Assertions.assertThat(card.getTrack1().getService().getServiceCode3().getPinRequirements()).isNotNull();
	} 
                            #location 16 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @Test
	public void track1Test() {
		EmvTrack1 track1 = TrackUtils
				.extractTrack1Data(
						BytesUtils
								.fromString("42343131313131313131313131313131313F305E202F5E31373032323031313030333F313030313030303030303030303030303F"));

		Assertions.assertThat(track1).isNotNull();
		Assertions.assertThat(track1.getCardNumber()).isEqualTo("4111111111111111");
		SimpleDateFormat sdf = new SimpleDateFormat("MM/yyyy");
		Assertions.assertThat(sdf.format(track1.getExpireDate())).isEqualTo("02/2017");
		Assertions.assertThat(track1).isNotNull();
		Assertions.assertThat(track1.getService()).isNotNull();
		Assertions.assertThat(track1.getService().getServiceCode1()).isEqualTo(ServiceCode1Enum.INTERNATIONNAL_ICC);
		Assertions.assertThat(track1.getService().getServiceCode1().getInterchange()).isNotNull();
		Assertions.assertThat(track1.getService().getServiceCode1().getTechnology()).isNotNull();
		Assertions.assertThat(track1.getService().getServiceCode2()).isEqualTo(ServiceCode2Enum.NORMAL);
		Assertions.assertThat(track1.getService().getServiceCode2().getAuthorizationProcessing()).isNotNull();
		Assertions.assertThat(track1.getService().getServiceCode3()).isEqualTo(ServiceCode3Enum.NO_RESTRICTION);
		Assertions.assertThat(track1.getService().getServiceCode3().getAllowedServices()).isNotNull();
		Assertions.assertThat(track1.getService().getServiceCode3().getPinRequirements()).isNotNull();
	}