Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public ItemStack readItemStack() throws IOException {
		final int itemId = readInt();
		if (itemId == 0) {
			return null;
		}

		int stackSize = readInt();
		int damage = readInt();
		ItemStack stack = new ItemStack(Item.getItemById(itemId), stackSize, damage);
		stack.setTagCompound(readNBTTagCompound());
		return stack;
	}