cleanup + fixed NPE vulnerability