#vulnerable code 
                                public void messageReceived(ChannelHandlerContext ctx, User user, StringMessage message) {
        String[] split = StringUtils.split2(message.body);

        int dashId = ParseUtil.parseInt(split[0]);
        int deviceId = 0;

        //new value for multi devices
        if (split.length == 2) {
            deviceId = ParseUtil.parseInt(split[1]);
        }

        DashBoard dashBoard = user.profile.getDashByIdOrThrow(dashId);
        Device device = dashBoard.getDeviceById(deviceId);

        String token = device.token;

        if (token == null) {
            throw new IllegalCommandBodyException("Wrong device id.");
        }

        String to = user.name;
        String dashName = dashBoard.name == null ? "New Project" : dashBoard.name;
        String deviceName = device.name == null ? "" : device.name;
        String subj = "Auth Token for " + dashName + " project and device " + deviceName;
        String body = String.format(BODY, dashName, token);

        log.trace("Sending Mail for user {}, with token : '{}'.", user.name, token);
        mail(ctx.channel(), user.name, to, subj, body, message.id);
    } 
                            #location 15 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public void messageReceived(ChannelHandlerContext ctx, User user, StringMessage message) {
        String[] split = StringUtils.split2(message.body);

        int dashId = ParseUtil.parseInt(split[0]);
        DashBoard dash = user.profile.getDashByIdOrThrow(dashId);

        if (split.length == 2) {
            int deviceId = ParseUtil.parseInt(split[1]);
            Device device = dash.getDeviceById(deviceId);

            if (device == null || device.token == null) {
                throw new IllegalCommandBodyException("Wrong device id.");
            }

            makeSingleTokenEmail(ctx, dash, device, user.name, message.id);
        } else {
            if (dash.devices.length == 1) {
                makeSingleTokenEmail(ctx, dash, dash.devices[0], user.name, message.id);
            } else {
                sendMultiTokenEmail(ctx, dash, user.name, message.id);
            }

        }
    }