#vulnerable code 
                                @Override
    public void verify(final UChannel channel,String extension, final ISDKVerifyListener callback) {

        try{

            JSONObject json = JSONObject.fromObject(extension);
            final String ts = json.getString("ts");
            final String playerId = json.getString("playerId");
            final String accessToken = json.getString("accessToken");
            final String nickname = json.getString("nickName");

            StringBuilder sb = new StringBuilder();
            sb.append(channel.getCpAppID()).append(ts).append(playerId);

            boolean ok = RSAUtil.verify(sb.toString().getBytes("UTF-8"), LOGIN_RSA_PUBLIC, accessToken);
            if(ok){

                SDKVerifyResult vResult = new SDKVerifyResult(true, playerId, "", nickname);

                callback.onSuccess(vResult);
            }else{
                callback.onFailed(channel.getMaster().getSdkName() + " verify failed.");
            }


        }catch (Exception e){
            e.printStackTrace();
            callback.onFailed(channel.getMaster().getSdkName() + " verify execute failed. the exception is "+e.getMessage());
        }


    } 
                            #location 22 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    public void verify(final UChannel channel,String extension, final ISDKVerifyListener callback) {

        try{

            JSONObject json = JSONObject.fromObject(extension);
            final String ts = json.getString("ts");
            final String playerId = json.getString("playerId");
            final String accessToken = json.getString("accessToken");
            final String nickname = json.getString("nickName");

            SDKVerifyResult vResult = new SDKVerifyResult(true, playerId, "", "");

            callback.onSuccess(vResult);

            ///2016-10-27 华为这版本流程这里，分为两步，这里不便服务器端做验证，注释下面这些
//            StringBuilder sb = new StringBuilder();
//            sb.append(channel.getCpAppID()).append(ts).append(playerId);

//            boolean ok = RSAUtil.verify(sb.toString().getBytes("UTF-8"), LOGIN_RSA_PUBLIC, accessToken);
//            if(ok){
//
//                SDKVerifyResult vResult = new SDKVerifyResult(true, playerId, "", nickname);
//
//                callback.onSuccess(vResult);
//            }else{
//                callback.onFailed(channel.getMaster().getSdkName() + " verify failed.");
//            }


        }catch (Exception e){
            e.printStackTrace();
            callback.onFailed(channel.getMaster().getSdkName() + " verify execute failed. the exception is "+e.getMessage());
        }


    }