#vulnerable code 
                                private Response singleDeviceOTA(ChannelHandlerContext ctx, String token, String path) {
        TokenValue tokenValue = tokenManager.getTokenValueByToken(token);

        if (tokenValue == null) {
            log.debug("Requested token {} not found.", token);
            return badRequest("Invalid token.");
        }

        User user = tokenValue.user;
        int dashId = tokenValue.dashId;
        int deviceId = tokenValue.deviceId;

        Session session = sessionDao.userSession.get(new UserKey(user));
        if (session == null) {
            log.debug("No session for user {}.", user.email);
            return badRequest("Device wasn't connected yet.");
        }

        String body = otaManager.buildOTAInitCommandBody(path);
        if (session.sendMessageToHardware(dashId, BLYNK_INTERNAL, 7777, body, deviceId)) {
            log.debug("No device in session.");
            return badRequest("No device in session.");
        }

        DashBoard dash = user.profile.getDashById(dashId);
        Device device = dash.getDeviceById(deviceId);

        User initiator = ctx.channel().attr(AuthHeadersBaseHttpHandler.USER).get();
        if (initiator != null) {
            device.updateOTAInfo(initiator.email);
        }

        return ok(path);
    } 
                            #location 26 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                private Response singleDeviceOTA(ChannelHandlerContext ctx, String token, String path) {
        TokenValue tokenValue = tokenManager.getTokenValueByToken(token);

        if (tokenValue == null) {
            log.debug("Requested token {} not found.", token);
            return badRequest("Invalid token.");
        }

        User user = tokenValue.user;
        int dashId = tokenValue.dash.id;
        int deviceId = tokenValue.deviceId;

        Session session = sessionDao.userSession.get(new UserKey(user));
        if (session == null) {
            log.debug("No session for user {}.", user.email);
            return badRequest("Device wasn't connected yet.");
        }

        String body = otaManager.buildOTAInitCommandBody(path);
        if (session.sendMessageToHardware(dashId, BLYNK_INTERNAL, 7777, body, deviceId)) {
            log.debug("No device in session.");
            return badRequest("No device in session.");
        }

        Device device = tokenValue.dash.getDeviceById(deviceId);

        User initiator = ctx.channel().attr(AuthHeadersBaseHttpHandler.USER).get();
        if (initiator != null) {
            device.updateOTAInfo(initiator.email);
        }

        return ok(path);
    }