sun.security.provider.certpath.OCSPResponse.<init>(byte[],PKIXParameters, X509Certificate):

   // Check whether the cert returned by the responder is trusted
if (x509Certs[0] != null) {

this should check if x509certs array is not null before dereferencing.