Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
		public void run() {
			while (true) {
				try {
					synchronized (clientList) {
						if (!pause && clientList.size() > 0) {
							clientBuffer = LPDataIOWrapper.collectData(output -> {
								output.writeBytes(clientBuffer);
								clearLock.lock();
								try {
									for (ModernPacket packet : clientList) {
										output.writeShort(packet.getId());
										output.writeInt(packet.getDebugId());
										packet.writeData(output);
									}
								} finally {
									clientList.clear();
									clearLock.unlock();
								}
							});
						}
					}
					//Send Content
					if (clientBuffer.length > 0) {
						while (clientBuffer.length > 1024 * 32) {
							byte[] sendbuffer = Arrays.copyOf(clientBuffer, 1024 * 32);
							clientBuffer = Arrays.copyOfRange(clientBuffer, 1024 * 32, clientBuffer.length);
							byte[] compressed = ClientPacketBufferHandlerThread.compress(sendbuffer);
							MainProxy.sendPacketToServer(PacketHandler.getPacket(BufferTransfer.class).setContent(compressed));
						}
						byte[] sendbuffer = clientBuffer;
						clientBuffer = new byte[] {};
						byte[] compressed = ClientPacketBufferHandlerThread.compress(sendbuffer);
						MainProxy.sendPacketToServer(PacketHandler.getPacket(BufferTransfer.class).setContent(compressed));
					}
				} catch (IOException e) {
					e.printStackTrace();
				}
				synchronized (clientList) {
					while (pause || clientList.size() == 0) {
						try {
							clientList.wait();
						} catch (InterruptedException e) {}
					}
				}
				if (clear) {
					clear = false;
					clientBuffer = new byte[] {};
				}
			}
		}