Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public void writeData(LPDataOutput output) throws IOException {
		super.writeData(output);

		if (inventory != null) {
			output.writeByte(STACK_MARKER);
			output.writeInt(inventory.getSizeInventory());
			for (int i = 0; i < inventory.getSizeInventory(); i++) {
				output.writeItemStack(inventory.getStackInSlot(i));
			}
		} else if (stackList != null) {
			output.writeByte(STACK_MARKER);
			output.writeCollection(stackList, LPDataOutput::writeItemStack);
		} else if (identList != null) {
			output.writeByte(IDENT_MARKER);
			output.writeCollection(identList, LPDataOutput::writeItemIdentifierStack);
		} else if (identSet != null) {
			output.writeByte(IDENT_MARKER);
			output.writeCollection(identSet, LPDataOutput::writeItemIdentifierStack);
		} else {
			throw new IllegalStateException("Wont send packet without content");
		}
	}