Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public void writeData(LPDataOutput output) throws IOException {
		super.writeData(output);
		if (getStack() != null) {
			output.writeInt(Item.getIdFromItem(getStack().getItem()));
			output.writeInt(getStack().stackSize);
			output.writeInt(getStack().getItemDamage());
			output.writeNBTTagCompound(getStack().getTagCompound());
		} else {
			output.writeInt(0);
		}
	}