Deserialization of untrusted data