Source:
<code>private byte[] processRequest(StunRequest request, InetSocketAddress localPeer, InetSocketAddress remotePeer) throws IOException { TransportAddress transportAddress = new TransportAddress(remotePeer.getAddress(), remotePeer.getPort(), TransportProtocol.UDP); StunResponse response = StunMessageFactory.createBindingResponse(request, transportAddress); byte[] transactionID = request.getTransactionId(); try { response.setTransactionID(transactionID); } catch (StunException e) { throw new IOException("Illegal STUN Transaction ID: " + new String(transactionID), e); } UsernameAttribute remoteUnameAttribute; String remoteUsername; try { remoteUnameAttribute = (UsernameAttribute) request.getAttribute(StunAttribute.USERNAME); remoteUsername = new String(remoteUnameAttribute.getUsername()); } <START> catch(NullPointerException nullPointer) { <END> response.setMessageType(StunMessage.BINDING_ERROR_RESPONSE); response.addAttribute(StunAttributeFactory.createErrorCodeAttribute(ErrorCodeAttribute.BAD_REQUEST, ErrorCodeAttribute.getDefaultReasonPhrase(ErrorCodeAttribute.BAD_REQUEST))); return response.encode(); } if(!this.iceAuthenticator.validateUsername(remoteUsername)) { throw new IOException("Invalid username "+ remoteUsername); } int colon = remoteUsername.indexOf(":"); String localUFrag = remoteUsername.substring(0, colon); String remoteUfrag = remoteUsername.substring(colon); long priority = extractPriority(request); String localUsername = remoteUfrag.concat(":").concat(localUFrag); StunAttribute unameAttribute = StunAttributeFactory.createUsernameAttribute(localUsername); response.addAttribute(unameAttribute); byte[] localKey = this.iceAuthenticator.getLocalKey(localUFrag); MessageIntegrityAttribute messageIntegrityAttribute = StunAttributeFactory.createMessageIntegrityAttribute(remoteUsername, localKey); response.addAttribute(messageIntegrityAttribute); if (request.containsAttribute(StunAttribute.USE_CANDIDATE)) { fireStunBindingEvent(localPeer, remotePeer); } return response.encode(); }</code><technical_language>@farwaakhtar preferred do a null-check if(remoteUnameAttribute == null) instead of catching NPE this</technical_language>

Target:
private byte[] processRequest(StunRequest request, InetSocketAddress localPeer, InetSocketAddress remotePeer) throws IOException, StunException { byte[] transactionID = request.getTransactionId(); UsernameAttribute remoteUnameAttribute = (UsernameAttribute) request.getAttribute(StunAttribute.USERNAME); if (remoteUnameAttribute == null) { StunResponse errorResponse = new StunResponse(); errorResponse.setTransactionID(transactionID); errorResponse.setMessageType(StunMessage.BINDING_ERROR_RESPONSE); errorResponse.addAttribute(StunAttributeFactory.createErrorCodeAttribute(ErrorCodeAttribute.BAD_REQUEST, ErrorCodeAttribute.getDefaultReasonPhrase(ErrorCodeAttribute.BAD_REQUEST))); return errorResponse.encode(); } String remoteUsername = new String(remoteUnameAttribute.getUsername()); if(!this.iceAuthenticator.validateUsername(remoteUsername)) { throw new IOException("Invalid username "+ remoteUsername); } int colon = remoteUsername.indexOf(":"); String localUFrag = remoteUsername.substring(0, colon); String remoteUfrag = remoteUsername.substring(colon); long priority = extractPriority(request); TransportAddress transportAddress = new TransportAddress(remotePeer.getAddress(), remotePeer.getPort(), TransportProtocol.UDP); StunResponse response = StunMessageFactory.createBindingResponse(request, transportAddress); try { response.setTransactionID(transactionID); } catch (StunException e) { throw new IOException("Illegal STUN Transaction ID: " + new String(transactionID), e); } String localUsername = remoteUfrag.concat(":").concat(localUFrag); StunAttribute unameAttribute = StunAttributeFactory.createUsernameAttribute(localUsername); response.addAttribute(unameAttribute); byte[] localKey = this.iceAuthenticator.getLocalKey(localUFrag); MessageIntegrityAttribute messageIntegrityAttribute = StunAttributeFactory.createMessageIntegrityAttribute(remoteUsername, localKey); response.addAttribute(messageIntegrityAttribute); if (request.containsAttribute(StunAttribute.USE_CANDIDATE)) { fireStunBindingEvent(localPeer, remotePeer); } return response.encode(); }