Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public void writeData(LPDataOutput output) throws IOException {
		output.writeInt(windowID);
		output.writeCollection(status, new IWriteListObject<StatusEntry>() {

			@Override
			public void writeObject(LPDataOutput output, StatusEntry entry) throws IOException {
				output.writeUTF(entry.name);
				output.writeBoolean(entry.subEntry != null);
				if (entry.subEntry != null) {
					output.writeCollection(entry.subEntry, this);
				}
			}
		});
	}