#vulnerable code 
                                private Object getCollectionProperty(Object ctx, String prop) throws Exception {
        if (prop.length() != 0) {
            ctx = getBeanProperty(ctx, prop);
        }

        int start = ++cursor;

        whiteSpaceSkip();

        if (cursor == length)
            throw new PropertyAccessException("unterminated '['");

        Object item;

        if (scanTo(']'))
            throw new PropertyAccessException("unterminated '['");

        // String ex = new String(property, start, cursor++ - start);
        item = eval(new String(property, start, cursor++ - start), ctx, variableFactory);

        if (ctx instanceof Map) {
            return ((Map) ctx).get(item);
        }
        else if (ctx instanceof List) {
            return ((List) ctx).get((Integer) item);
        }
        else if (ctx instanceof Collection) {
            int count = (Integer) item;
            if (count > ((Collection) ctx).size())
                throw new PropertyAccessException("index [" + count + "] out of bounds on collections");

            Iterator iter = ((Collection) ctx).iterator();
            for (int i = 0; i < count; i++) iter.next();
            return iter.next();
        }
        else if (ctx.getClass().isArray()) {
            return Array.get(ctx, (Integer) item);
        }
        else if (ctx instanceof CharSequence) {
            return ((CharSequence) ctx).charAt((Integer) item);
        }
        else {
            throw new PropertyAccessException("illegal use of []: unknown type: " + (ctx == null ? null : ctx.getClass().getName()));
        }
    } 
                            #location 40 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                private Object getCollectionProperty(Object ctx, String prop) throws Exception {
        if (prop.length() != 0) {
            ctx = getBeanProperty(ctx, prop);
        }

        int start = ++cursor;
        whiteSpaceSkip();

        if (cursor == length || scanTo(']'))
            throw new PropertyAccessException("unterminated '['");

        prop = new String(property, start, cursor++ - start);

        if (ctx instanceof Map) {
            return ((Map) ctx).get(eval(prop, ctx, variableFactory));
        }
        else if (ctx instanceof List) {
            return ((List) ctx).get((Integer) eval(prop, ctx, variableFactory));
        }
        else if (ctx instanceof Collection) {
            int count = (Integer) eval(prop, ctx, variableFactory);
            if (count > ((Collection) ctx).size())
                throw new PropertyAccessException("index [" + count + "] out of bounds on collections");

            Iterator iter = ((Collection) ctx).iterator();
            for (int i = 0; i < count; i++) iter.next();
            return iter.next();
        }
        else if (ctx.getClass().isArray()) {
            return Array.get(ctx, (Integer) eval(prop, ctx, variableFactory));
        }
        else if (ctx instanceof CharSequence) {
            return ((CharSequence) ctx).charAt((Integer) eval(prop, ctx, variableFactory));
        }
        else {
            throw new PropertyAccessException("illegal use of []: unknown type: " + (ctx == null ? null : ctx.getClass().getName()));
        }
    }