#vulnerable code 
                             @Override
	public String visitSelect_list_elem(VerdictSQLParser.Select_list_elemContext ctx) {
		select_list_elem_num++;
		String newSelectListElem = null;
		Pair<String, Alias> colName2Alias = null;
		
		if (ctx.getText().equals("*")) {
			// TODO: replace * with all columns in the (joined) source table.
			newSelectListElem = "*";
		} else {
			StringBuilder elem = new StringBuilder();
			elem.append(visit(ctx.expression()));
			
			SelectStatementBaseRewriter baseRewriter = new SelectStatementBaseRewriter(queryString);
			String colName = baseRewriter.visit(ctx.expression());
			
			if (ctx.column_alias() != null) {
				Alias alias = new Alias(colName, ctx.column_alias().getText());
				elem.append(String.format(" AS %s", alias));
				colName2Alias = Pair.of(colName, alias);
			} else {
				// We add a pseudo column alias
				Alias alias = Alias.genAlias(depth, colName);
				elem.append(String.format(" AS %s", alias));
				colName2Alias = Pair.of(baseRewriter.visit(ctx.expression()), alias);
			}
			
			newSelectListElem = elem.toString();
		}
		
		colName2Aliases.add(Pair.of(colName2Alias.getKey(), colName2Alias.getValue()));
		return newSelectListElem;
	} 
                            #location 31 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @Override
	public String visitSelect_list_elem(VerdictSQLParser.Select_list_elemContext ctx) {
		select_list_elem_num++;
		String newSelectListElem = null;
		Pair<String, Alias> colName2Alias = null;
		
		if (ctx.getText().equals("*")) {
			// TODO: replace * with all columns in the (joined) source table.
			newSelectListElem = "*";
		} else {
			StringBuilder elem = new StringBuilder();
			
			// We use a baseRewriter to prevent that "COUNT(*)" is rewritten to "COUNT(*) * (1/sample_ratio)"
			SelectStatementBaseRewriter baseRewriter = new SelectStatementBaseRewriter(queryString);
			String tabColName = baseRewriter.visit(ctx.expression());
			String tabName = NameHelpers.tabNameOfColName(tabColName);
			TableUniqueName tabUniqueName = NameHelpers.tabUniqueNameOfColName(vc, tabColName);
			String colName = NameHelpers.colNameOfColName(tabColName);
			
			// if a table name is specified, we change it to its alias name.
			if (tableAliases.containsKey(tabUniqueName)) {
				tabName = tableAliases.get(tabUniqueName).toString();
			}
			
			// if there was derived table(s), we may need to substitute aliased name for the colName.
			for (Map.Entry<String, Map<String, Alias>> e : derivedTableColName2Aliases.entrySet()) {
				String derivedTabName = e.getKey();
				
				if (tabName.length() > 0 && !tabName.equals(derivedTabName)) {
					// this is the case where there are more than one derived tables, and a user specifically referencing
					// a column in one of those derived tables.
					continue;
				}
				if (e.getValue().containsKey(colName)) {
					Alias alias = e.getValue().get(colName);
					if (alias.autoGenerated()) {
						colName = alias.toString();
					}
				}
			}
			
			if (tabName.length() > 0) {
				elem.append(String.format("%s.%s", tabName, colName));
			} else {
				elem.append(colName);
			}
			
			if (ctx.column_alias() != null) {
				Alias alias = new Alias(colName, ctx.column_alias().getText());
				elem.append(String.format(" AS %s", alias));
				colName2Alias = Pair.of(colName, alias);
			} else {
				// We add a pseudo column alias
				Alias alias = Alias.genAlias(depth, colName);
				elem.append(String.format(" AS %s", alias));
				colName2Alias = Pair.of(baseRewriter.visit(ctx.expression()), alias);
			}
			
			newSelectListElem = elem.toString();
		}
		
		colName2Aliases.add(Pair.of(colName2Alias.getKey(), colName2Alias.getValue()));
		return newSelectListElem;
	}