output: #fixed code
                                  public void forcedLog(String fqcn, Priority level, Object message, Throwable t) {
          org.apache.logging.log4j.Level lvl = org.apache.logging.log4j.Level.toLevel(level.toString());
          Message msg = message instanceof Message ? (ObjectMessage) message : new ObjectMessage(message);
          logger.log(null, fqcn, lvl, msg, t);
      }
input: #vulnerable code 
                                  public void forcedLog(String fqcn, Priority level, Object message, Throwable t) {
          org.apache.logging.log4j.Level lvl = org.apache.logging.log4j.Level.toLevel(level.toString());
          logger.log(null, fqcn, lvl, new ObjectMessage(message), t);
      } 
                              #location 3 
                              #vulnerability type NULL_DEREFERENCE