output: #fixed code
                                  @Override
      public void messageReceived(ChannelHandlerContext ctx, MessageEvent me){
          if(!(me.getMessage() instanceof CoapMessage)){
              ctx.sendUpstream(me);
              return;
          }
  
          CoapMessage coapMessage = (CoapMessage) me.getMessage();
          if(coapMessage.getCode().isError() || coapMessage.getMessageType().equals(MsgType.RST)){
              errorMessageReceived(ctx, me);
              return;
          }
  
          if(me.getMessage() instanceof CoapResponse){
              CoapResponse response = (CoapResponse) me.getMessage();
  
              final byte[] token = response.getToken();
  
              BlockwiseTransfer transfer;
              //Add latest received payload to already received payload
              synchronized (incompleteResponseMonitor){
                  transfer = incompleteResponsePayload.get(new ByteArrayWrapper(token));
                  if(transfer != null){
                      try {
                          if(response.getBlockNumber(BLOCK_2) == transfer.getNextBlockNumber()){
                              log.debug("Received response (Token: " + (new ByteArrayWrapper(token).toHexString()) +
                                        " , Block: " + response.getBlockNumber(BLOCK_2) + "), ");
  
                              if (log.isDebugEnabled()){
                                  //Copy Payload
                                  ChannelBuffer payloadCopy = ChannelBuffers.copiedBuffer(response.getPayload());
                                  byte[] bytes = new byte[payloadCopy.readableBytes()];
                                  payloadCopy.getBytes(0, bytes);
                                  log.debug("Payload Hex: " + new ByteArrayWrapper(bytes).toHexString());
                              }
  
                              transfer.getPartialPayload()
                                      .writeBytes(response.getPayload(), 0, response.getPayload().readableBytes());
                              transfer.setNextBlockNumber(transfer.getNextBlockNumber() + 1);
                          }
                          else{
                              log.debug("Received unexpected response (Token: " + (new ByteArrayWrapper(token).toHexString()) +
                                     " , Block: " + response.getBlockNumber(BLOCK_2) + "). IGNORE!");
                              me.getFuture().setSuccess();
                              return;
                          }
                      }
                      catch (InvalidOptionException e) {
                          log.error("This should never happen!", e);
                      }
                  }
              }
  
              //Check whether payload of the response is complete
              if(transfer != null){
                  try {
                      if(response.isLastBlock(BLOCK_2)){
  
                          //Send response with complete payload to application
                          log.debug("Block " + response.getBlockNumber(BLOCK_2) + " for response with token " +
                                  new ByteArrayWrapper(token).toHexString() +
                                  "  received. Payload complete. Forward to client application.");
  
                          response.getOptionList().removeAllOptions(BLOCK_2);
  
                          response.setPayload(transfer.getPartialPayload());
                          MessageEvent event = new UpstreamMessageEvent(me.getChannel(), response, me.getRemoteAddress());
                          ctx.sendUpstream(event);
  
                          synchronized (incompleteResponseMonitor){
                              if(incompleteResponsePayload.remove(new ByteArrayWrapper(token)) == null){
                                  log.error("This should never happen! No incomplete payload found for token " +
                                      new ByteArrayWrapper(token).toHexString());
                              }
                              else{
                                  log.debug("Deleted not anymore incomplete payload for token " +
                                          new ByteArrayWrapper(token).toHexString() + " from list");
                              }
                          }
                          return;
  
                      }
                      else{
                          final long receivedBlockNumber = response.getBlockNumber(BLOCK_2);
  
                          log.debug("Block " + receivedBlockNumber + " for response with token " +
                                  new ByteArrayWrapper(token).toHexString() +
                                  "  received. Payload (still) incomplete.");
  
                          CoapRequest nextCoapRequest = (CoapRequest) transfer.getCoapMessage();
                          nextCoapRequest.setMessageID(-1);
                          nextCoapRequest.setBlockOption(BLOCK_2, receivedBlockNumber + 1,
                                                         false, response.getMaxBlocksizeForResponse());
  
  
                          ChannelFuture future = Channels.future(me.getChannel());
  
                          future.addListener(new ChannelFutureListener() {
                              @Override
                              public void operationComplete(ChannelFuture future) throws Exception {
                                  log.debug("Request for block " + (receivedBlockNumber + 1) + " for token " +
                                      new ByteArrayWrapper(token).toHexString() + " sent succesfully.");
  
                              }
                          });
                          MessageEvent event = new DownstreamMessageEvent(me.getChannel(),
                                  future, nextCoapRequest, me.getRemoteAddress());
  
                          log.debug("Send request for block " + (receivedBlockNumber + 1) + " for token " +
                                  new ByteArrayWrapper(token).toHexString() + ".");
  
                          ctx.sendDownstream(event);
                          return;
                      }
                  }
                  catch (InvalidOptionException e) {
                      log.error("This should never happen!", e);
                  }
                  catch (MessageDoesNotAllowPayloadException e) {
                      log.error("This should never happen!", e);
                  }
                  catch (ToManyOptionsException e){
                      log.error("This should never happen!", e);
                  }
                  catch (InvalidHeaderException e) {
                      log.error("This should never happen!", e);
                  }
              }
          }
  
          ctx.sendUpstream(me);
      }
input: #vulnerable code 
                                  @Override
      public void messageReceived(ChannelHandlerContext ctx, MessageEvent me){
          if(!(me.getMessage() instanceof CoapMessage)){
              ctx.sendUpstream(me);
              return;
          }
  
          if(me.getMessage() instanceof CoapResponse){
              CoapResponse response = (CoapResponse) me.getMessage();
  
              if(response.getMaxBlocksizeForResponse() != null){
                  final byte[] token = response.getToken();
  
                  //Add latest received payload to already received payload
                  BlockwiseTransfer transfer;
                  synchronized (incompleteResponseMonitor){
                      transfer = incompleteResponsePayload.get(new ByteArrayWrapper(token));
  
                      try {
                          if(response.getBlockNumber(BLOCK_2) == transfer.getNextBlockNumber()){
                              log.debug("Received response (Token: " + (new ByteArrayWrapper(token).toHexString()) +
                                        " , Block: " + response.getBlockNumber(BLOCK_2) + "), ");
  
                              //Copy Payload
                              ChannelBuffer payloadCopy = ChannelBuffers.copiedBuffer(response.getPayload());
                              byte[] bytes = new byte[payloadCopy.readableBytes()];
                              payloadCopy.getBytes(0, bytes);
                              log.debug("Payload Hex: " + new ByteArrayWrapper(bytes).toHexString());
                              //**********************************************
  
                              transfer.getPartialPayload()
                                      .writeBytes(response.getPayload(), 0, response.getPayload().readableBytes());
                              transfer.setNextBlockNumber(transfer.getNextBlockNumber() + 1);
                          }
                          else{
                              log.debug("Received duplicate response (Token: " + (new ByteArrayWrapper(token).toHexString()) +
                                      " , Block: " + response.getBlockNumber(BLOCK_2) + "). IGNORE!");
  
                              me.getFuture().setSuccess();
                              return;
                          }
                      }
                      catch (InvalidOptionException e) {
                          log.error("This should never happen!", e);
                      }
                  }
  
                  //Check whether payload of the response is complete
                  try {
                      if(response.isLastBlock(BLOCK_2)){
  
                          //Send response with complete payload to application
                          log.debug("Block " + response.getBlockNumber(BLOCK_2) + " for response with token " +
                                  new ByteArrayWrapper(token).toHexString() +
                                  "  received. Payload complete. Forward to client application.");
  
                          response.getOptionList().removeAllOptions(BLOCK_2);
  
                          response.setPayload(transfer.getPartialPayload());
                          MessageEvent event = new UpstreamMessageEvent(me.getChannel(), response, me.getRemoteAddress());
                          ctx.sendUpstream(event);
  
                          synchronized (incompleteResponseMonitor){
                              if(incompleteResponsePayload.remove(new ByteArrayWrapper(token)) == null){
                                  log.error("This should never happen! No incomplete payload found for token " +
                                      new ByteArrayWrapper(token).toHexString());
                              }
                              else{
                                  log.debug("Deleted not anymore incomplete payload for token " +
                                          new ByteArrayWrapper(token).toHexString() + " from list");
                              }
                          }
                          //End the original ChannelFuture
                          me.getFuture().isSuccess();
                          return;
  
                      }
                      else{
                          final long receivedBlockNumber = response.getBlockNumber(BLOCK_2);
  
                          log.debug("Block " + receivedBlockNumber + " for response with token " +
                                  new ByteArrayWrapper(token).toHexString() +
                                  "  received. Payload (still) incomplete.");
  
                          CoapRequest nextCoapRequest = (CoapRequest) transfer.getCoapMessage();
                          nextCoapRequest.setMessageID(-1);
                          nextCoapRequest.setBlockOption(BLOCK_2, receivedBlockNumber + 1,
                                                         false, response.getMaxBlocksizeForResponse());
  
  
                          ChannelFuture future = Channels.future(me.getChannel());
  
                          future.addListener(new ChannelFutureListener() {
                              @Override
                              public void operationComplete(ChannelFuture future) throws Exception {
                                  log.debug("Request for block " + (receivedBlockNumber + 1) + " for token " +
                                      new ByteArrayWrapper(token).toHexString() + " sent succesfully.");
  
                              }
                          });
                          MessageEvent event = new DownstreamMessageEvent(me.getChannel(),
                                  future, nextCoapRequest, me.getRemoteAddress());
  
                          log.debug("Send request for block " + (receivedBlockNumber + 1) + " for token " +
                                  new ByteArrayWrapper(token).toHexString() + ".");
  
                          ctx.sendDownstream(event);
                          return;
                      }
                  }
                  catch (InvalidOptionException e) {
                      log.error("This should never happen!", e);
                  }
                  catch (MessageDoesNotAllowPayloadException e) {
                      log.error("This should never happen!", e);
                  }
                  catch (ToManyOptionsException e) {
                      log.error("This should never happen!", e);
                  } catch (InvalidHeaderException e) {
                      log.error("This should never happen!", e);
                  }
              }
              ctx.sendUpstream(me);
          }
  
      } 
                              #location 20 
                              #vulnerability type NULL_DEREFERENCE