#vulnerable code 
                                @Override
    public BranchStatus branchRollback(BranchType branchType, String xid, long branchId, String resourceId,
                                       String applicationData) throws TransactionException {
        try {
            BranchRollbackRequest request = new BranchRollbackRequest();
            request.setXid(xid);
            request.setBranchId(branchId);
            request.setResourceId(resourceId);
            request.setApplicationData(applicationData);
            request.setBranchType(branchType);

            GlobalSession globalSession = SessionHolder.findGlobalSession(xid);
            if (globalSession == null) {
                return BranchStatus.PhaseTwo_Rollbacked;
            }

            if (BranchType.SAGA.equals(branchType)) {

                Map<String, Channel> channels = ChannelManager.getRmChannels();
                if (channels == null || channels.size() == 0) {
                    LOGGER.error(
                        "Failed to rollback SAGA global[" + globalSession.getXid() + ", RM channels is empty.");
                    return BranchStatus.PhaseTwo_RollbackFailed_Retryable;
                }
                String sagaResourceId = globalSession.getApplicationId() + "#" + globalSession
                    .getTransactionServiceGroup();
                Channel sagaChannel = channels.get(sagaResourceId);
                if (sagaChannel == null) {
                    LOGGER.error("Failed to rollback SAGA global[" + globalSession.getXid()
                        + ", cannot find channel by resourceId[" + sagaResourceId + "]");
                    return BranchStatus.PhaseTwo_RollbackFailed_Retryable;
                }
                BranchRollbackResponse response = (BranchRollbackResponse)messageSender.sendSyncRequest(sagaChannel,
                    request);
                return response.getBranchStatus();
            } else {

                BranchSession branchSession = globalSession.getBranch(branchId);

                BranchRollbackResponse response = (BranchRollbackResponse)messageSender.sendSyncRequest(resourceId,
                    branchSession.getClientId(), request);
                return response.getBranchStatus();
            }

        } catch (IOException | TimeoutException e) {
            throw new BranchTransactionException(FailedToSendBranchRollbackRequest,
                String.format("Send branch rollback failed, xid = %s branchId = %s", xid, branchId), e);
        }
    } 
                            #location 41 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                @Override
    public BranchStatus branchRollback(BranchType branchType, String xid, long branchId, String resourceId,
                                       String applicationData) throws TransactionException {
        try {
            BranchRollbackRequest request = new BranchRollbackRequest();
            request.setXid(xid);
            request.setBranchId(branchId);
            request.setResourceId(resourceId);
            request.setApplicationData(applicationData);
            request.setBranchType(branchType);

            GlobalSession globalSession = SessionHolder.findGlobalSession(xid);
            if (globalSession == null) {
                return BranchStatus.PhaseTwo_Rollbacked;
            }

            if (BranchType.SAGA.equals(branchType)) {

                Map<String, Channel> channels = ChannelManager.getRmChannels();
                if (channels == null || channels.size() == 0) {
                    LOGGER.error(
                        "Failed to rollback SAGA global[" + globalSession.getXid() + ", RM channels is empty.");
                    return BranchStatus.PhaseTwo_RollbackFailed_Retryable;
                }
                String sagaResourceId = globalSession.getApplicationId() + "#" + globalSession
                    .getTransactionServiceGroup();
                Channel sagaChannel = channels.get(sagaResourceId);
                if (sagaChannel == null) {
                    LOGGER.error("Failed to rollback SAGA global[" + globalSession.getXid()
                        + ", cannot find channel by resourceId[" + sagaResourceId + "]");
                    return BranchStatus.PhaseTwo_RollbackFailed_Retryable;
                }
                BranchRollbackResponse response = (BranchRollbackResponse) messageSender.sendSyncRequest(sagaChannel,
                    request);
                return response.getBranchStatus();
            } else {

                BranchSession branchSession = globalSession.getBranch(branchId);
                if (null != branchSession) {
                    BranchRollbackResponse response = (BranchRollbackResponse) messageSender.sendSyncRequest(resourceId,
                        branchSession.getClientId(), request);
                    return response.getBranchStatus();
                } else {
                    return BranchStatus.PhaseTwo_Rollbacked;
                }
            }

        } catch (IOException | TimeoutException e) {
            throw new BranchTransactionException(FailedToSendBranchRollbackRequest,
                String.format("Send branch rollback failed, xid = %s branchId = %s", xid, branchId), e);
        }
    }