#vulnerable code 
                                private Object parseIterable(final StartElement iterableEvent, final SerIterable iterable) throws Exception {
        Attribute rowsAttr = iterableEvent.getAttributeByName(ROWS_QNAME);
        Attribute columnsAttr = iterableEvent.getAttributeByName(COLS_QNAME);
        if (rowsAttr != null && columnsAttr != null) {
            iterable.dimensions(new int[] {Integer.parseInt(rowsAttr.getValue()), Integer.parseInt(columnsAttr.getValue())});
        }
        XMLEvent event = nextEvent(">iter ");
        while (event.isEndElement() == false) {
            if (event.isStartElement()) {
                StartElement start = event.asStartElement();
                QName expectedType = iterable.category() == SerCategory.MAP ? ENTRY_QNAME : ITEM_QNAME;
                if (start.getName().equals(expectedType) == false) {
                    throw new IllegalArgumentException("Expected '" + expectedType.getLocalPart() + "' but found '" + start.getName() + "'");
                }
                int count = 1;
                Object key = null;
                Object column = null;
                Object value = null;
                if (iterable.category() == SerCategory.COUNTED) {
                    Attribute countAttr = start.getAttributeByName(COUNT_QNAME);
                    if (countAttr != null) {
                        count = Integer.parseInt(countAttr.getValue());
                    }
                    value = parseValue(iterable, start);
                    
                } else if (iterable.category() == SerCategory.TABLE || iterable.category() == SerCategory.GRID) {
                    Attribute rowAttr = start.getAttributeByName(ROW_QNAME);
                    Attribute colAttr = start.getAttributeByName(COL_QNAME);
                    if (rowAttr == null || colAttr == null) {
                        throw new IllegalArgumentException("Unable to read table as row/col attribute missing");
                    }
                    String rowStr = rowAttr.getValue();
                    if (iterable.keyType() != null) {
                        key = settings.getConverter().convertFromString(iterable.keyType(), rowStr);
                    } else {
                        key = rowStr;
                    }
                    String colStr = colAttr.getValue();
                    if (iterable.columnType() != null) {
                        column = settings.getConverter().convertFromString(iterable.columnType(), colStr);
                    } else {
                        column = colStr;
                    }
                    value = parseValue(iterable, start);
                    
                } else if (iterable.category() == SerCategory.MAP) {
                    Attribute keyAttr = start.getAttributeByName(KEY_QNAME);
                    if (keyAttr != null) {
                        // item is value with a key attribute
                        String keyStr = keyAttr.getValue();
                        if (iterable.keyType() != null) {
                            key = settings.getConverter().convertFromString(iterable.keyType(), keyStr);
                        } else {
                            key = keyStr;
                        }
                        value = parseValue(iterable, start);
                        
                    } else {
                        // two items nested in this entry
                        if (Bean.class.isAssignableFrom(iterable.keyType()) == false) {
                            throw new IllegalArgumentException("Unable to read map as declared key type is neither a bean nor a simple type: " + iterable.keyType().getName());
                        }
                        event = nextEvent(">>map ");
                        int loop = 0;
                        while (event.isEndElement() == false) {
                            if (event.isStartElement()) {
                                start = event.asStartElement();
                                if (start.getName().equals(ITEM_QNAME) == false) {
                                    throw new IllegalArgumentException("Expected 'item' but found '" + start.getName() + "'");
                                }
                                if (key == null) {
                                    key = parseKey(iterable, start);
                                } else {
                                    value = parseValue(iterable, start);
                                }
                                loop++;
                            }
                            event = nextEvent("..map ");
                        }
                        if (loop != 2) {
                            throw new IllegalArgumentException("Expected 2 'item's but found " + loop);
                        }
                    }                    
                    
                } else {  // COLLECTION
                    value = parseValue(iterable, start);
                }
                iterable.add(key, column, value, count);
            }
            event = nextEvent(".iter ");
        }
        return iterable.build();
    } 
                            #location 61 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                private Object parseIterable(final StartElement iterableEvent, final SerIterable iterable) throws Exception {
        Attribute rowsAttr = iterableEvent.getAttributeByName(ROWS_QNAME);
        Attribute columnsAttr = iterableEvent.getAttributeByName(COLS_QNAME);
        if (rowsAttr != null && columnsAttr != null) {
            iterable.dimensions(new int[] {Integer.parseInt(rowsAttr.getValue()), Integer.parseInt(columnsAttr.getValue())});
        }
        XMLEvent event = nextEvent(">iter ");
        while (event.isEndElement() == false) {
            if (event.isStartElement()) {
                StartElement start = event.asStartElement();
                QName expectedType = iterable.category() == SerCategory.MAP ? ENTRY_QNAME : ITEM_QNAME;
                if (start.getName().equals(expectedType) == false) {
                    throw new IllegalArgumentException("Expected '" + expectedType.getLocalPart() + "' but found '" + start.getName() + "'");
                }
                int count = 1;
                Object key = null;
                Object column = null;
                Object value = null;
                if (iterable.category() == SerCategory.COUNTED) {
                    Attribute countAttr = start.getAttributeByName(COUNT_QNAME);
                    if (countAttr != null) {
                        count = Integer.parseInt(countAttr.getValue());
                    }
                    value = parseValue(iterable, start);
                    
                } else if (iterable.category() == SerCategory.TABLE || iterable.category() == SerCategory.GRID) {
                    Attribute rowAttr = start.getAttributeByName(ROW_QNAME);
                    Attribute colAttr = start.getAttributeByName(COL_QNAME);
                    if (rowAttr == null || colAttr == null) {
                        throw new IllegalArgumentException("Unable to read table as row/col attribute missing");
                    }
                    String rowStr = rowAttr.getValue();
                    if (iterable.keyType() != null) {
                        key = settings.getConverter().convertFromString(iterable.keyType(), rowStr);
                    } else {
                        key = rowStr;
                    }
                    String colStr = colAttr.getValue();
                    if (iterable.columnType() != null) {
                        column = settings.getConverter().convertFromString(iterable.columnType(), colStr);
                    } else {
                        column = colStr;
                    }
                    value = parseValue(iterable, start);
                    
                } else if (iterable.category() == SerCategory.MAP) {
                    Attribute keyAttr = start.getAttributeByName(KEY_QNAME);
                    if (keyAttr != null) {
                        // item is value with a key attribute
                        String keyStr = keyAttr.getValue();
                        if (iterable.keyType() != null) {
                            key = settings.getConverter().convertFromString(iterable.keyType(), keyStr);
                        } else {
                            key = keyStr;
                        }
                        value = parseValue(iterable, start);
                        
                    } else {
                        // two items nested in this entry
                        event = nextEvent(">>map ");
                        int loop = 0;
                        while (event.isEndElement() == false) {
                            if (event.isStartElement()) {
                                start = event.asStartElement();
                                if (start.getName().equals(ITEM_QNAME) == false) {
                                    throw new IllegalArgumentException("Expected 'item' but found '" + start.getName() + "'");
                                }
                                if (key == null) {
                                    key = parseKey(iterable, start);
                                } else {
                                    value = parseValue(iterable, start);
                                }
                                loop++;
                            }
                            event = nextEvent("..map ");
                        }
                        if (loop != 2) {
                            throw new IllegalArgumentException("Expected 2 'item's but found " + loop);
                        }
                    }                    
                    
                } else {  // COLLECTION
                    value = parseValue(iterable, start);
                }
                iterable.add(key, column, value, count);
            }
            event = nextEvent(".iter ");
        }
        return iterable.build();
    }