#vulnerable code 
                             @Override
	protected SearchRequestBuilder _explain() throws SqlParseException {

		BoolFilterBuilder boolFilter = null;
		// set where
		Where where = select.getWhere();

		AggregationBuilder<?> lastAgg = null;
		FilterAggregationBuilder filter = null;

		if (where != null) {
			boolFilter = FilterMaker.explan(where);
			request.setQuery(QueryBuilders.filteredQuery(null, boolFilter));
		}

		//
		if (select.getGroupBys().size() > 0) {
			Field field = select.getGroupBys().get(0);
			lastAgg = aggMaker.makeGroupAgg(field);
			

			if (lastAgg != null && lastAgg instanceof TermsBuilder) {
				((TermsBuilder) lastAgg).size(select.getRowCount());
			}
			
			if (filter != null) {
				filter.subAggregation(lastAgg);
			} else {
				request.addAggregation(lastAgg);
			}
			for (int i = 1; i < select.getGroupBys().size(); i++) {
				field = select.getGroupBys().get(i);
				AggregationBuilder<?> subAgg = aggMaker.makeGroupAgg(field);
				if(subAgg instanceof TermsBuilder){
					((TermsBuilder)subAgg).size(0) ;
				}
				
				lastAgg.subAggregation(subAgg);
				lastAgg = subAgg;
			}
		}

		Map<String, KVValue> groupMap = aggMaker.getGroupMap();
		// add field
		if (select.getFields().size() > 0) {
			explanFields(request, select.getFields(), lastAgg, filter);
		}

		// add order
		if (lastAgg != null && select.getOrderBys().size() > 0) {
			KVValue temp = null;
			TermsBuilder termsBuilder = null;
			for (Order order : select.getOrderBys()) {
				temp = groupMap.get(order.getName());
				termsBuilder = (TermsBuilder) temp.value;
				switch (temp.key) {
				case "COUNT":
					termsBuilder.order(Terms.Order.count(isASC(order)));
					break;
				case "KEY":
					termsBuilder.order(Terms.Order.term(isASC(order)));
					break;
				case "FIELD":
					termsBuilder.order(Terms.Order.aggregation(order.getName(), isASC(order)));
					break;
				default:
					throw new SqlParseException(order.getName() + " can not to order");
				}
			}
		}
		request.setSize(0);
		request.setSearchType(SearchType.DEFAULT);
		return request;
	} 
                            #location 38 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                             @Override
	protected SearchRequestBuilder _explain() throws SqlParseException {
		setWhere(select.getWhere());
		AggregationBuilder<?> lastAgg = null;

		if (select.getGroupBys().size() > 0) {
			Field field = select.getGroupBys().get(0);
			lastAgg = aggMaker.makeGroupAgg(field);
			

			if (lastAgg != null && lastAgg instanceof TermsBuilder) {
				((TermsBuilder) lastAgg).size(select.getRowCount());
			}

			request.addAggregation(lastAgg);

			for (int i = 1; i < select.getGroupBys().size(); i++) {
				field = select.getGroupBys().get(i);
				AggregationBuilder<?> subAgg = aggMaker.makeGroupAgg(field);
				if(subAgg instanceof TermsBuilder){
					((TermsBuilder)subAgg).size(0) ;
				}
				
				lastAgg.subAggregation(subAgg);
				lastAgg = subAgg;
			}
		}

		Map<String, KVValue> groupMap = aggMaker.getGroupMap();
		// add field
		if (select.getFields().size() > 0) {
			explanFields(request, select.getFields(), lastAgg);
		}

		// add order
		if (lastAgg != null && select.getOrderBys().size() > 0) {
			KVValue temp = null;
			TermsBuilder termsBuilder = null;
			for (Order order : select.getOrderBys()) {
				temp = groupMap.get(order.getName());
				termsBuilder = (TermsBuilder) temp.value;
				switch (temp.key) {
				case "COUNT":
					termsBuilder.order(Terms.Order.count(isASC(order)));
					break;
				case "KEY":
					termsBuilder.order(Terms.Order.term(isASC(order)));
					break;
				case "FIELD":
					termsBuilder.order(Terms.Order.aggregation(order.getName(), isASC(order)));
					break;
				default:
					throw new SqlParseException(order.getName() + " can not to order");
				}
			}
		}
		request.setSize(0);
		request.setSearchType(SearchType.DEFAULT);
		return request;
	}