Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public void readData(LPDataInput input) throws IOException {
		super.readData(input);

		final int itemID = input.readInt();
		if (itemID != 0) {
			int stackSize = input.readInt();
			int damage = input.readInt();
			setStack(new ItemStack(Item.getItemById(itemID), stackSize, damage));
			getStack().setTagCompound(input.readNBTTagCompound());
		} else {
			setStack(null);
		}
	}