#vulnerable code 
                                @SuppressWarnings("unchecked")
    private static <T extends LwM2mNode> T parseTlv(Tlv[] tlvs, LwM2mPath path, LwM2mModel model, Class<T> nodeClass)
            throws CodecException {
        LOG.trace("Parsing TLV content for path {}: {}", path, tlvs);

        // Object
        if (nodeClass == LwM2mObject.class) {
            Map<Integer, LwM2mObjectInstance> instances = new HashMap<>(tlvs.length);

            // is it an array of TLV resources?
            if (tlvs.length > 0 && //
                    (tlvs[0].getType() == TlvType.MULTIPLE_RESOURCE || tlvs[0].getType() == TlvType.RESOURCE_VALUE)) {

                ObjectModel oModel = model.getObjectModel(path.getObjectId());
                if (oModel == null) {
                    LOG.warn("No model for object {}. The tlv is decoded assuming this is a single instance object",
                            path.getObjectId());
                    instances.put(0, parseObjectInstanceTlv(tlvs, path.getObjectId(), 0, model));
                } else if (!oModel.multiple) {
                    instances.put(0, parseObjectInstanceTlv(tlvs, path.getObjectId(), 0, model));
                } else {
                    throw new CodecException("Object instance TLV is mandatory for multiple instances object [path:%s]",
                            path);
                }

            } else {
                for (Tlv tlv : tlvs) {
                    if (tlv.getType() != TlvType.OBJECT_INSTANCE)
                        throw new CodecException("Expected TLV of type OBJECT_INSTANCE but was %s  [path:%s]",
                                tlv.getType().name(), path);

                    LwM2mObjectInstance objectInstance = parseObjectInstanceTlv(tlv.getChildren(), path.getObjectId(),
                            tlv.getIdentifier(), model);
                    LwM2mObjectInstance previousObjectInstance = instances.put(objectInstance.getId(), objectInstance);
                    if (previousObjectInstance != null) {
                        throw new CodecException(
                                "2 OBJECT_INSTANCE nodes (%s,%s) with the same identifier %d for path %s",
                                previousObjectInstance, objectInstance, objectInstance.getId(), path);
                    }
                }
            }
            return (T) new LwM2mObject(path.getObjectId(), instances.values());
        }

        // Object instance
        else if (nodeClass == LwM2mObjectInstance.class) {

            if (tlvs.length == 1 && tlvs[0].getType() == TlvType.OBJECT_INSTANCE) {
                if (path.isObjectInstance() && tlvs[0].getIdentifier() != path.getObjectInstanceId()) {
                    throw new CodecException("Id conflict between path [%s] and instance TLV [%d]", path,
                            tlvs[0].getIdentifier());
                }
                // object instance TLV
                return (T) parseObjectInstanceTlv(tlvs[0].getChildren(), path.getObjectId(), tlvs[0].getIdentifier(),
                        model);
            } else {
                // array of TLV resources
                // try to retrieve the instanceId from the path or the model
                Integer instanceId = path.getObjectInstanceId();
                if (instanceId == null) {
                    // single instance object?
                    ObjectModel oModel = model.getObjectModel(path.getObjectId());
                    if (oModel != null && !oModel.multiple) {
                        instanceId = 0;
                    } else {
                        instanceId = LwM2mObjectInstance.UNDEFINED;
                    }
                }
                return (T) parseObjectInstanceTlv(tlvs, path.getObjectId(), instanceId, model);
            }
        }

        // Resource
        else if (nodeClass == LwM2mResource.class) {
            ResourceModel resourceModel = model.getResourceModel(path.getObjectId(), path.getResourceId());
            if (tlvs.length == 0 && resourceModel != null && !resourceModel.multiple) {
                // If there is no TlV value and we know that this resource is a single resource we raise an exception
                // else we consider this is a multi-instance resource
                throw new CodecException("TLV payload is mandatory for single resource %s", path);

            } else if (tlvs.length == 1 && tlvs[0].getType() != TlvType.RESOURCE_INSTANCE) {
                if (path.isResource() && path.getResourceId() != tlvs[0].getIdentifier()) {
                    throw new CodecException("Id conflict between path [%s] and resource TLV [%s]", path,
                            tlvs[0].getIdentifier());
                }
                LwM2mPath resourcePath = new LwM2mPath(path.getObjectId(), path.getObjectInstanceId(),
                        tlvs[0].getIdentifier());
                return (T) parseResourceTlv(tlvs[0], resourcePath, model);
            } else {
                Type expectedRscType = getResourceType(path, model);
                return (T) LwM2mMultipleResource.newResource(path.getResourceId(),
                        parseTlvValues(tlvs, expectedRscType, path), expectedRscType);
            }
        } else {
            throw new IllegalArgumentException("invalid node class: " + nodeClass);
        }

    } 
                            #location 86 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @SuppressWarnings("unchecked")
    private static <T extends LwM2mNode> T parseTlv(Tlv[] tlvs, LwM2mPath path, LwM2mModel model, Class<T> nodeClass)
            throws CodecException {
        LOG.trace("Parsing TLV content for path {}: {}", path, tlvs);

        // Object
        if (nodeClass == LwM2mObject.class) {
            Map<Integer, LwM2mObjectInstance> instances = new HashMap<>(tlvs.length);

            // is it an array of TLV resources?
            if (tlvs.length > 0 && //
                    (tlvs[0].getType() == TlvType.MULTIPLE_RESOURCE || tlvs[0].getType() == TlvType.RESOURCE_VALUE)) {

                ObjectModel oModel = model.getObjectModel(path.getObjectId());
                if (oModel == null) {
                    LOG.warn("No model for object {}. The tlv is decoded assuming this is a single instance object",
                            path.getObjectId());
                    instances.put(0, parseObjectInstanceTlv(tlvs, path.getObjectId(), 0, model));
                } else if (!oModel.multiple) {
                    instances.put(0, parseObjectInstanceTlv(tlvs, path.getObjectId(), 0, model));
                } else {
                    throw new CodecException("Object instance TLV is mandatory for multiple instances object [path:%s]",
                            path);
                }

            } else {
                for (Tlv tlv : tlvs) {
                    if (tlv.getType() != TlvType.OBJECT_INSTANCE)
                        throw new CodecException("Expected TLV of type OBJECT_INSTANCE but was %s  [path:%s]",
                                tlv.getType().name(), path);

                    LwM2mObjectInstance objectInstance = parseObjectInstanceTlv(tlv.getChildren(), path.getObjectId(),
                            tlv.getIdentifier(), model);
                    LwM2mObjectInstance previousObjectInstance = instances.put(objectInstance.getId(), objectInstance);
                    if (previousObjectInstance != null) {
                        throw new CodecException(
                                "2 OBJECT_INSTANCE nodes (%s,%s) with the same identifier %d for path %s",
                                previousObjectInstance, objectInstance, objectInstance.getId(), path);
                    }
                }
            }
            return (T) new LwM2mObject(path.getObjectId(), instances.values());
        }

        // Object instance
        else if (nodeClass == LwM2mObjectInstance.class) {

            if (tlvs.length == 1 && tlvs[0].getType() == TlvType.OBJECT_INSTANCE) {
                if (path.isObjectInstance() && tlvs[0].getIdentifier() != path.getObjectInstanceId()) {
                    throw new CodecException("Id conflict between path [%s] and instance TLV [object instance id=%d]",
                            path, tlvs[0].getIdentifier());
                }
                // object instance TLV
                return (T) parseObjectInstanceTlv(tlvs[0].getChildren(), path.getObjectId(), tlvs[0].getIdentifier(),
                        model);
            } else {
                // array of TLV resources
                // try to retrieve the instanceId from the path or the model
                Integer instanceId = path.getObjectInstanceId();
                if (instanceId == null) {
                    // single instance object?
                    ObjectModel oModel = model.getObjectModel(path.getObjectId());
                    if (oModel != null && !oModel.multiple) {
                        instanceId = 0;
                    } else {
                        instanceId = LwM2mObjectInstance.UNDEFINED;
                    }
                }
                return (T) parseObjectInstanceTlv(tlvs, path.getObjectId(), instanceId, model);
            }
        }

        // Resource
        else if (nodeClass == LwM2mResource.class) {
            // The object instance level should not be here, but if it is provided and consistent we tolerate it
            if (tlvs.length == 1 && tlvs[0].getType() == TlvType.OBJECT_INSTANCE) {
                if (tlvs[0].getIdentifier() != path.getObjectInstanceId()) {
                    throw new CodecException("Id conflict between path [%s] and instance TLV [object instance id=%d]",
                            path, tlvs[0].getIdentifier());
                }
                tlvs = tlvs[0].getChildren();
            }

            ResourceModel resourceModel = model.getResourceModel(path.getObjectId(), path.getResourceId());
            if (tlvs.length == 0 && resourceModel != null && !resourceModel.multiple) {
                // If there is no TlV value and we know that this resource is a single resource we raise an exception
                // else we consider this is a multi-instance resource
                throw new CodecException("TLV payload is mandatory for single resource %s", path);
            } else if (tlvs.length == 1 && tlvs[0].getType() != TlvType.RESOURCE_INSTANCE) {
                Tlv tlv = tlvs[0];
                if (tlv.getType() != TlvType.RESOURCE_VALUE && tlv.getType() != TlvType.MULTIPLE_RESOURCE) {
                    throw new CodecException(
                            "Expected TLV of type RESOURCE_VALUE or MUlTIPLE_RESOURCE but was %s [path:%s]",
                            tlv.getType().name(), path);
                }
                if (path.isResource() && path.getResourceId() != tlv.getIdentifier()) {
                    throw new CodecException("Id conflict between path [%s] and resource TLV [resource id=%s]", path,
                            tlv.getIdentifier());
                }
                return (T) parseResourceTlv(tlv, path, model);
            } else {
                Type expectedRscType = getResourceType(path, model);
                return (T) LwM2mMultipleResource.newResource(path.getResourceId(),
                        parseTlvValues(tlvs, expectedRscType, path), expectedRscType);
            }
        } else {
            throw new IllegalArgumentException("invalid node class: " + nodeClass);
        }

    }