Language: Java
Label: vulnerable
CWE: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Code:
	public LinkedLogisticsOrderList readLinkedLogisticsOrderList() throws IOException {
		LinkedLogisticsOrderList list = new LinkedLogisticsOrderList();

		List<IOrderInfoProvider> orderInfoProviders = readArrayList(LPDataInput::readOrderInfo);
		if (orderInfoProviders == null) {
			throw new IOException("Expected order info provider list");
		}
		list.addAll(orderInfoProviders);

		List<LinkedLogisticsOrderList> orderLists = readArrayList(LPDataInput::readLinkedLogisticsOrderList);
		if (orderLists == null) {
			throw new IOException("Expected logistics order list");
		}
		list.getSubOrders().addAll(orderLists);

		return list;
	}