!13 fix CVE-2021-35517 CVE-2021-35516 CVE-2021-35515 CVE-2021-36090

From: @houyingchao
Reviewed-by: @small_leek,@wangchong1995924
Signed-off-by: @wangchong1995924

0001-Remove-Brotli-compressor.patch

@@ -0,0 +1,37 @@
+From bba585e9e4fdfc67de3b53b58b8d60923e1ccd0c Mon Sep 17 00:00:00 2001
+From: Michael Simacek <msimacek@redhat.com>
+Date: Mon, 12 Feb 2018 10:53:48 +0100
+Subject: [PATCH 1/2] Remove Brotli compressor
+
+---
+ .../commons/compress/compressors/CompressorStreamFactory.java      | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
+index d730b9d..ab178a9 100644
+--- a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
++++ b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
+@@ -31,8 +31,6 @@ import java.util.Set;
+ import java.util.SortedMap;
+ import java.util.TreeMap;
+ 
+-import org.apache.commons.compress.compressors.brotli.BrotliCompressorInputStream;
+-import org.apache.commons.compress.compressors.brotli.BrotliUtils;
+ import org.apache.commons.compress.compressors.bzip2.BZip2CompressorInputStream;
+ import org.apache.commons.compress.compressors.bzip2.BZip2CompressorOutputStream;
+ import org.apache.commons.compress.compressors.deflate.DeflateCompressorInputStream;
+@@ -586,10 +584,7 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
+             }
+ 
+             if (BROTLI.equalsIgnoreCase(name)) {
+-                if (!BrotliUtils.isBrotliCompressionAvailable()) {
+-                    throw new CompressorException("Brotli compression is not available." + YOU_NEED_BROTLI_DEC);
+-                }
+-                return new BrotliCompressorInputStream(in);
++                throw new CompressorException("Brotli compression is not available in this build.");
+             }
+ 
+             if (XZ.equalsIgnoreCase(name)) {
+-- 
+2.14.3
+

0002-Remove-ZSTD-compressor.patch

@@ -0,0 +1,58 @@
+From bab91e014f73296a8ac9a3aef2aaa324a85e9b96 Mon Sep 17 00:00:00 2001
+From: Michael Simacek <msimacek@redhat.com>
+Date: Mon, 12 Feb 2018 10:59:55 +0100
+Subject: [PATCH 2/2] Remove ZSTD compressor
+
+---
+ .../compress/compressors/CompressorStreamFactory.java      | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
+index ab178a9..3817704 100644
+--- a/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
++++ b/src/main/java/org/apache/commons/compress/compressors/CompressorStreamFactory.java
+@@ -54,9 +54,6 @@ import org.apache.commons.compress.compressors.xz.XZCompressorInputStream;
+ import org.apache.commons.compress.compressors.xz.XZCompressorOutputStream;
+ import org.apache.commons.compress.compressors.xz.XZUtils;
+ import org.apache.commons.compress.compressors.z.ZCompressorInputStream;
+-import org.apache.commons.compress.compressors.zstandard.ZstdCompressorInputStream;
+-import org.apache.commons.compress.compressors.zstandard.ZstdCompressorOutputStream;
+-import org.apache.commons.compress.compressors.zstandard.ZstdUtils;
+ import org.apache.commons.compress.utils.IOUtils;
+ import org.apache.commons.compress.utils.Lists;
+ import org.apache.commons.compress.utils.ServiceLoaderIterator;
+@@ -516,10 +513,6 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
+             return LZ4_FRAMED;
+         }
+ 
+-        if (ZstdUtils.matches(signature, signatureLength)) {
+-            return ZSTANDARD;
+-        }
+-
+         throw new CompressorException("No Compressor found for the stream signature.");
+     }
+     /**
+@@ -595,10 +588,7 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
+             }
+ 
+             if (ZSTANDARD.equalsIgnoreCase(name)) {
+-                if (!ZstdUtils.isZstdCompressionAvailable()) {
+-                    throw new CompressorException("Zstandard compression is not available." + YOU_NEED_ZSTD_JNI);
+-                }
+-                return new ZstdCompressorInputStream(in);
++                throw new CompressorException("Zstandard compression is not available in this build.");
+             }
+ 
+             if (LZMA.equalsIgnoreCase(name)) {
+@@ -714,7 +704,7 @@ public class CompressorStreamFactory implements CompressorStreamProvider {
+             }
+ 
+             if (ZSTANDARD.equalsIgnoreCase(name)) {
+-                return new ZstdCompressorOutputStream(out);
++                throw new CompressorException("Zstandard compression is not available in this build.");
+             }
+         } catch (final IOException e) {
+             throw new CompressorException("Could not create CompressorOutputStream", e);
+-- 
+2.14.3
+

apache-commons-compress-build.xml

@@ -0,0 +1,130 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+ <project name="commons-compress" default="package" basedir=".">
+
+  <!-- ====================================================================== -->
+  <!-- Build environment properties                                           -->
+  <!-- ====================================================================== -->
+
+  <property file="build.properties"/>
+
+  <property name="build.name" value="commons-compress"/>
+  <property name="build.version" value="1.21"/>
+  <property name="build.finalName" value="${build.name}-${build.version}"/>
+  <property name="build.dir" value="target"/>
+  <property name="build.javadocDir" value="${build.dir}/site/apidocs"/>
+  <property name="build.outputDir" value="${build.dir}/classes"/>
+  <property name="build.srcDir.0" value="src/main/java"/>
+  <property name="build.resourceDir.0" value="src/main/resources"/>
+  <property name="build.resourceDir.1" value="."/>
+
+  <property name="commons.osgi.dynamicImport" value=""/>
+  <property name="commons.osgi.excludeDependencies" value="true"/>
+  <property name="commons.osgi.export" value="org.apache.commons.compress;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.ar;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.arj;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.cpio;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.dump;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.examples;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.jar;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.sevenz;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.tar;version=&quot;${build.version}&quot;,org.apache.commons.compress.archivers.zip;version=&quot;${build.version}&quot;,org.apache.commons.compress.changes;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.bzip2;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.deflate;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.deflate64;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.gzip;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.lz4;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.lz77support;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.lzma;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.lzw;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.pack200;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.snappy;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.xz;version=&quot;${build.version}&quot;,org.apache.commons.compress.compressors.z;version=&quot;${build.version}&quot;,org.apache.commons.compress.harmony.archive.internal.nls;version=&quot;${build.version}&quot;,org.apache.commons.compress.harmony.pack200;version=&quot;${build.version}&quot;,org.apache.commons.compress.harmony.unpack200;version=&quot;${build.version}&quot;,org.apache.commons.compress.harmony.unpack200.bytecode;version=&quot;${build.version}&quot;,org.apache.commons.compress.harmony.unpack200.bytecode.forms;version=&quot;${build.version}&quot;,org.apache.commons.compress.java.util.jar;version=&quot;${build.version}&quot;,org.apache.commons.compress.parallel;version=&quot;${build.version}&quot;,org.apache.commons.compress.utils;version=&quot;${build.version}&quot;"/>
+  <property name="commons.osgi.import" value="org.tukaani.xz;resolution:=optional,org.objectweb.asm;resolution:=optional,javax.crypto;resolution:=optional,javax.crypto.spec;resolution:=optional"/>
+  <property name="commons.osgi.private" value=""/>
+  <property name="commons.osgi.symbolicName" value="org.apache.commons.compress"/>
+
+  <property name="compiler.source" value="1.8"/>
+  <property name="compiler.target" value="1.8"/>
+
+
+  <!-- ====================================================================== -->
+  <!-- Defining classpaths                                                    -->
+  <!-- ====================================================================== -->
+
+  <path id="build.classpath">
+    <fileset dir="lib">
+      <include name="**/*.jar">
+      </include>
+    </fileset>
+  </path>
+
+  <!-- ====================================================================== -->
+  <!-- Cleaning up target                                                     -->
+  <!-- ====================================================================== -->
+
+  <target name="clean" description="Clean the output directory">
+    <delete dir="${build.dir}"/>
+  </target>
+
+  <!-- ====================================================================== -->
+  <!-- Compilation target                                                     -->
+  <!-- ====================================================================== -->
+
+  <target name="compile" description="Compile the code">
+    <mkdir dir="${build.outputDir}"/>
+    <javac destdir="${build.outputDir}" 
+           encoding="iso-8859-1" 
+           nowarn="false" 
+           debug="true" 
+           optimize="false" 
+           deprecation="true" 
+           target="${compiler.target}" 
+           verbose="false" 
+           fork="false" 
+           source="${compiler.source}">
+      <src>
+        <pathelement location="${build.srcDir.0}"/>
+      </src>
+      <classpath refid="build.classpath"/>
+    </javac>
+    <mkdir dir="${build.outputDir}/META-INF"/>
+    <copy todir="${build.outputDir}/META-INF">
+      <fileset dir="${build.resourceDir.1}">
+        <include name="NOTICE.txt"/>
+        <include name="LICENSE.txt"/>
+      </fileset>
+    </copy>
+  </target>
+
+  <!-- ====================================================================== -->
+  <!-- Javadoc target                                                         -->
+  <!-- ====================================================================== -->
+
+  <target name="javadoc" description="Generates the Javadoc of the application">
+    <mkdir dir="${build.javadocDir}"/>
+    <javadoc sourcepath="${build.srcDir.0}" 
+             packagenames="*" 
+             destdir="${build.javadocDir}" 
+             access="protected" 
+             verbose="false" 
+             encoding="iso-8859-1" 
+             version="true" 
+             use="true" 
+             author="true" 
+             splitindex="false" 
+             nodeprecated="false" 
+             nodeprecatedlist="false" 
+             notree="false" 
+             noindex="false" 
+             nohelp="false" 
+             nonavbar="false" 
+             serialwarn="false" 
+             source="${compiler.source}" 
+             linksource="true" 
+             breakiterator="false">
+      <classpath refid="build.classpath"/>
+    </javadoc>
+  </target>
+
+  <!-- ====================================================================== -->
+  <!-- Package target                                                         -->
+  <!-- ====================================================================== -->
+
+  <target name="package" depends="compile" description="Package the application">
+    <jar jarfile="${build.dir}/${build.finalName}.jar" 
+         compress="true" 
+         index="false" 
+         basedir="${build.outputDir}" 
+         excludes="**/package.html">
+      <manifest>
+        <attribute name="Bundle-SymbolicName" value="${commons.osgi.symbolicName}"/>
+        <attribute name="Bundle-Version" value="${build.version}"/>
+		<attribute name="Export-Package" value="${commons.osgi.export}"/>
+		<attribute name="Import-Package" value="${commons.osgi.import}"/>
+      </manifest>
+    </jar>
+  </target>
+
+</project>

apache-commons-compress.spec

@@ -0,0 +1,88 @@
+Name:           apache-commons-compress
+Version:        1.21
+Release:        1
+Summary:        Java API for working with compressed files and archivers
+License:        ASL 2.0
+URL:            http://commons.apache.org/proper/commons-compress/
+BuildArch:      noarch
+Source0:        http://archive.apache.org/dist/commons/compress/source/commons-compress-%{version}-src.tar.gz
+Source1:        http://archive.apache.org/dist/commons/compress/source/commons-compress-%{version}-src.tar.gz.asc
+Source2:        %{name}-build.xml
+Patch0001:      0001-Remove-Brotli-compressor.patch
+Patch0002:      0002-Remove-ZSTD-compressor.patch
+Patch0003:      fix_java_8_compatibility.patch
+BuildRequires:  ant objectweb-asm3 fdupes java-devel >= 1.8 javapackages-local xz-java
+Provides:       commons-compress = %{version}-%{release}
+Obsoletes:      commons-compress < %{version}-%{release}
+Provides:       jakarta-commons-compress = %{version}-%{release}
+Obsoletes:      jakarta-commons-compress < %{version}-%{release}
+
+%description
+The Apache Commons Compress library defines an API for working with
+ar, cpio, Unix dump, tar, zip, gzip, XZ, Pack200 and bzip2 files.
+In version 1.14 read-only support for Brotli decompression has been added,
+but it has been removed from this package.
+
+%package help
+Summary:        API documentation for apache-commons-compress
+
+Provides:       %{name}-javadoc = %{version}-%{release}
+Obsoletes:      %{name}-javadoc < %{version}-%{release}
+
+%description help
+This package provides API documentation for apache-commons-compress.
+
+%prep
+%autosetup -n commons-compress-%{version}-src -p1
+cp %{SOURCE2} build.xml
+%pom_remove_dep org.brotli:dec
+rm -r src/{main,test}/java/org/apache/commons/compress/compressors/brotli
+%pom_remove_dep :zstd-jni
+rm -r src/{main,test}/java/org/apache/commons/compress/compressors/zstandard
+rm src/test/java/org/apache/commons/compress/compressors/DetectCompressorTestCase.java
+%pom_remove_plugin :maven-javadoc-plugin
+%pom_xpath_remove "pom:profiles/pom:profile[pom:id[text()='java9+']]"
+%pom_remove_parent .
+%pom_xpath_inject "pom:project" "<groupId>org.apache.commons</groupId>" .
+
+%build
+mkdir -p lib
+build-jar-repository -s lib xz-java objectweb-asm3
+%{ant} package javadoc
+
+%install
+install -dm 0755 %{buildroot}%{_javadir}
+install -pm 0644 target/commons-compress-%{version}.jar %{buildroot}%{_javadir}/commons-compress.jar
+ln -sf commons-compress.jar %{buildroot}%{_javadir}/%{name}.jar
+install -dm 0755 %{buildroot}%{_mavenpomdir}
+install -pm 0644 pom.xml %{buildroot}%{_mavenpomdir}/commons-compress.pom
+%add_maven_depmap commons-compress.pom commons-compress.jar -a commons:commons-compress,commons-compress:commons-compress
+install -dm 0755 %{buildroot}%{_javadocdir}/%{name}
+cp -pr target/site/apidocs/* %{buildroot}%{_javadocdir}/%{name}
+%fdupes -s %{buildroot}%{_javadocdir}
+
+%files -f .mfiles
+%{_javadir}/%{name}.jar
+%license LICENSE.txt
+%doc NOTICE.txt
+
+%files help
+%{_javadocdir}/%{name}
+%license LICENSE.txt
+%doc NOTICE.txt
+
+%changelog
+* Tue Aug 3 2021 houyingchao <houyingchao@huawei.com> - 1.21-1
+- Upgrade to 1.21
+
+* Sat Sep 12 2020 leiju <leiju4@huawei.com> - 1.17-4.h2
+- Avoid use of internal Mockito API
+
+* Thu Dec 26 2019 Senlin Xia <xiasenlin1@huawei.com> - 1.17-4.h1
+- Type:cves
+- ID:CVE-2019-12402
+- SUG:restart
+- DESC:fix bug with CVE-2019-12402
+
+* Wed Dec 4 2019 Tianfei <tianfei16@huawei.com> - 1.17-4
+- Package init

commons-compress-1.21-src.tar.gz.asc

@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHEEABEKADEWIQTOgHWiUVR77iSbwVGiEVrhX2uLcgUCYOiAPBMcYm9kZXdpZ0Bh
+cGFjaGUub3JnAAoJEKIRWuFfa4tyyNwAn1RAMciW7Os/lbwCiQ/RJ64GL+LSAKDB
+7ZWg3nXsSSAnuN7K/3doWvLkLQ==
+=iHWA
+-----END PGP SIGNATURE-----

fix_java_8_compatibility.patch

@@ -0,0 +1,441 @@
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/sevenz/BoundedSeekableByteChannelInputStream.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/sevenz/BoundedSeekableByteChannelInputStream.java	2021-07-19 16:32:46.529020782 +0200
+@@ -19,6 +19,7 @@
+ 
+ import java.io.IOException;
+ import java.io.InputStream;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.channels.SeekableByteChannel;
+ 
+@@ -83,7 +84,7 @@
+         } else {
+             buf = ByteBuffer.allocate(bytesToRead);
+             bytesRead = channel.read(buf);
+-            buf.flip();
++            ((Buffer)buf).flip();
+         }
+         if (bytesRead >= 0) {
+             buf.get(b, off, bytesRead);
+@@ -93,9 +94,9 @@
+     }
+ 
+     private int read(final int len) throws IOException {
+-        buffer.rewind().limit(len);
++        ((Buffer)buffer).rewind().limit(len);
+         final int read = channel.read(buffer);
+-        buffer.flip();
++        ((Buffer)buffer).flip();
+         return read;
+     }
+ 
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/sevenz/SevenZFile.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/sevenz/SevenZFile.java	2021-07-19 16:20:02.675782684 +0200
+@@ -26,6 +26,7 @@
+ import java.io.FilterInputStream;
+ import java.io.IOException;
+ import java.io.InputStream;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.ByteOrder;
+ import java.nio.CharBuffer;
+@@ -499,7 +500,7 @@
+         while (pos > minPos) {
+             pos--;
+             channel.position(pos);
+-            nidBuf.rewind();
++            ((Buffer)nidBuf).rewind();
+             if (channel.read(nidBuf) < 1) {
+                 throw new EOFException();
+             }
+@@ -2016,9 +2017,9 @@
+     }
+ 
+     private void readFully(final ByteBuffer buf) throws IOException {
+-        buf.rewind();
++        ((Buffer)buf).rewind();
+         IOUtils.readFully(channel, buf);
+-        buf.flip();
++        ((Buffer)buf).flip();
+     }
+ 
+     @Override
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/sevenz/SevenZOutputFile.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/sevenz/SevenZOutputFile.java	2021-07-19 16:14:03.565317437 +0200
+@@ -26,6 +26,7 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.ByteOrder;
+ import java.nio.channels.SeekableByteChannel;
+@@ -341,7 +342,7 @@
+         crc32.reset();
+         crc32.update(bb.array(), SevenZFile.sevenZSignature.length + 6, 20);
+         bb.putInt(SevenZFile.sevenZSignature.length + 2, (int) crc32.getValue());
+-        bb.flip();
++        ((Buffer)bb).flip();
+         channel.write(bb);
+     }
+ 
+@@ -826,7 +827,7 @@
+         private final ByteBuffer buffer = ByteBuffer.allocate(BUF_SIZE);
+         @Override
+         public void write(final int b) throws IOException {
+-            buffer.clear();
++            ((Buffer)buffer).clear();
+             buffer.put((byte) b).flip();
+             channel.write(buffer);
+             compressedCrc32.update(b);
+@@ -844,7 +845,7 @@
+             if (len > BUF_SIZE) {
+                 channel.write(ByteBuffer.wrap(b, off, len));
+             } else {
+-                buffer.clear();
++                ((Buffer)buffer).clear();
+                 buffer.put(b, off, len).flip();
+                 channel.write(buffer);
+             }
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java	2021-07-19 16:14:03.565317437 +0200
+@@ -20,6 +20,7 @@
+ package org.apache.commons.compress.archivers.zip;
+ 
+ import java.io.IOException;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.CharBuffer;
+ import java.nio.charset.Charset;
+@@ -121,8 +122,8 @@
+         enc.encode(cb, out, true);
+         // may have caused underflow, but that's been ignored traditionally
+ 
+-        out.limit(out.position());
+-        out.rewind();
++        ((Buffer)out).limit(out.position());
++        ((Buffer)out).rewind();
+         return out;
+     }
+ 
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/ZipArchiveInputStream.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/ZipArchiveInputStream.java	2021-07-19 16:14:03.565317437 +0200
+@@ -25,6 +25,7 @@
+ import java.io.InputStream;
+ import java.io.PushbackInputStream;
+ import java.math.BigInteger;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.util.Arrays;
+ import java.util.zip.CRC32;
+@@ -256,7 +257,7 @@
+             allowStoredEntriesWithDataDescriptor;
+         this.skipSplitSig = skipSplitSig;
+         // haven't read anything so far
+-        buf.limit(0);
++        ((Buffer)buf).limit(0);
+     }
+ 
+     public ZipArchiveEntry getNextZipEntry() throws IOException {
+@@ -596,13 +597,13 @@
+         }
+ 
+         if (buf.position() >= buf.limit()) {
+-            buf.position(0);
++            ((Buffer)buf).position(0);
+             final int l = in.read(buf.array());
+             if (l == -1) {
+-                buf.limit(0);
++                ((Buffer)buf).limit(0);
+                 throw new IOException("Truncated ZIP file");
+             }
+-            buf.limit(l);
++            ((Buffer)buf).limit(l);
+ 
+             count(l);
+             current.bytesReadFromStream += l;
+@@ -795,7 +796,7 @@
+         }
+ 
+         inf.reset();
+-        buf.clear().flip();
++        ((Buffer)buf).clear().flip();
+         current = null;
+         lastStoredEntry = null;
+     }
+@@ -860,7 +861,7 @@
+         }
+         final int length = in.read(buf.array());
+         if (length > 0) {
+-            buf.limit(length);
++            ((Buffer)buf).limit(length);
+             count(buf.limit());
+             inf.setInput(buf.array(), 0, buf.limit());
+         }
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/ZipEncodingHelper.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/ZipEncodingHelper.java	2021-07-19 16:29:53.519835167 +0200
+@@ -18,6 +18,7 @@
+ 
+ package org.apache.commons.compress.archivers.zip;
+ 
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.charset.Charset;
+ import java.nio.charset.StandardCharsets;
+@@ -85,8 +86,8 @@
+     }
+ 
+     static ByteBuffer growBufferBy(final ByteBuffer buffer, final int increment) {
+-        buffer.limit(buffer.position());
+-        buffer.rewind();
++        ((Buffer)buffer).limit(buffer.position());
++        ((Buffer)buffer).rewind();
+ 
+         final ByteBuffer on = ByteBuffer.allocate(buffer.capacity() + increment);
+ 
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/ZipFile.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/archivers/zip/ZipFile.java	2021-07-19 16:28:13.175147502 +0200
+@@ -25,6 +25,7 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.SequenceInputStream;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.channels.FileChannel;
+ import java.nio.channels.SeekableByteChannel;
+@@ -713,7 +714,7 @@
+         positionAtCentralDirectory();
+         centralDirectoryStartOffset = archive.position();
+ 
+-        wordBbuf.rewind();
++        ((Buffer)wordBbuf).rewind();
+         IOUtils.readFully(archive, wordBbuf);
+         long sig = ZipLong.getValue(wordBuf);
+ 
+@@ -724,7 +725,7 @@
+ 
+         while (sig == CFH_SIG) {
+             readCentralDirectoryEntry(noUTF8Flag);
+-            wordBbuf.rewind();
++            ((Buffer)wordBbuf).rewind();
+             IOUtils.readFully(archive, wordBbuf);
+             sig = ZipLong.getValue(wordBuf);
+         }
+@@ -743,7 +744,7 @@
+     private void
+         readCentralDirectoryEntry(final Map<ZipArchiveEntry, NameAndComment> noUTF8Flag)
+         throws IOException {
+-        cfhBbuf.rewind();
++        ((Buffer)cfhBbuf).rewind();
+         IOUtils.readFully(archive, cfhBbuf);
+         int off = 0;
+         final Entry ze = new Entry();
+@@ -1100,7 +1101,7 @@
+             archive.position() > ZIP64_EOCDL_LENGTH;
+         if (searchedForZip64EOCD) {
+             archive.position(archive.position() - ZIP64_EOCDL_LENGTH);
+-            wordBbuf.rewind();
++            ((Buffer)wordBbuf).rewind();
+             IOUtils.readFully(archive, wordBbuf);
+             found = Arrays.equals(ZipArchiveOutputStream.ZIP64_EOCD_LOC_SIG,
+                                   wordBuf);
+@@ -1128,11 +1129,11 @@
+     private void positionAtCentralDirectory64()
+         throws IOException {
+         if (isSplitZipArchive) {
+-            wordBbuf.rewind();
++            ((Buffer)wordBbuf).rewind();
+             IOUtils.readFully(archive, wordBbuf);
+             final long diskNumberOfEOCD = ZipLong.getValue(wordBuf);
+ 
+-            dwordBbuf.rewind();
++            ((Buffer)dwordBbuf).rewind();
+             IOUtils.readFully(archive, dwordBbuf);
+             final long relativeOffsetOfEOCD = ZipEightByteInteger.getLongValue(dwordBuf);
+             ((ZipSplitReadOnlySeekableByteChannel) archive)
+@@ -1140,12 +1141,12 @@
+         } else {
+             skipBytes(ZIP64_EOCDL_LOCATOR_OFFSET
+                     - WORD /* signature has already been read */);
+-            dwordBbuf.rewind();
++        ((Buffer)dwordBbuf).rewind();
+             IOUtils.readFully(archive, dwordBbuf);
+             archive.position(ZipEightByteInteger.getLongValue(dwordBuf));
+         }
+ 
+-        wordBbuf.rewind();
++        ((Buffer)wordBbuf).rewind();
+         IOUtils.readFully(archive, wordBbuf);
+         if (!Arrays.equals(wordBuf, ZipArchiveOutputStream.ZIP64_EOCD_SIG)) {
+             throw new ZipException("Archive's ZIP64 end of central "
+@@ -1155,13 +1156,13 @@
+         if (isSplitZipArchive) {
+             skipBytes(ZIP64_EOCD_CFD_DISK_OFFSET
+                     - WORD /* signature has already been read */);
+-            wordBbuf.rewind();
++            ((Buffer)wordBbuf).rewind();
+             IOUtils.readFully(archive, wordBbuf);
+             centralDirectoryStartDiskNumber = ZipLong.getValue(wordBuf);
+ 
+             skipBytes(ZIP64_EOCD_CFD_LOCATOR_RELATIVE_OFFSET);
+ 
+-            dwordBbuf.rewind();
++            ((Buffer)dwordBbuf).rewind();
+             IOUtils.readFully(archive, dwordBbuf);
+             centralDirectoryStartRelativeOffset = ZipEightByteInteger.getLongValue(dwordBuf);
+             ((ZipSplitReadOnlySeekableByteChannel) archive)
+@@ -1169,7 +1170,7 @@
+         } else {
+             skipBytes(ZIP64_EOCD_CFD_LOCATOR_OFFSET
+                     - WORD /* signature has already been read */);
+-            dwordBbuf.rewind();
++            ((Buffer)dwordBbuf).rewind();
+             IOUtils.readFully(archive, dwordBbuf);
+             centralDirectoryStartDiskNumber = 0;
+             centralDirectoryStartRelativeOffset = ZipEightByteInteger.getLongValue(dwordBuf);
+@@ -1188,20 +1189,20 @@
+         throws IOException {
+         if (isSplitZipArchive) {
+             skipBytes(CFD_DISK_OFFSET);
+-            shortBbuf.rewind();
++            ((Buffer)shortBbuf).rewind();
+             IOUtils.readFully(archive, shortBbuf);
+             centralDirectoryStartDiskNumber = ZipShort.getValue(shortBuf);
+ 
+             skipBytes(CFD_LOCATOR_RELATIVE_OFFSET);
+ 
+-            wordBbuf.rewind();
++            ((Buffer)wordBbuf).rewind();
+             IOUtils.readFully(archive, wordBbuf);
+             centralDirectoryStartRelativeOffset = ZipLong.getValue(wordBuf);
+             ((ZipSplitReadOnlySeekableByteChannel) archive)
+                 .position(centralDirectoryStartDiskNumber, centralDirectoryStartRelativeOffset);
+         } else {
+             skipBytes(CFD_LOCATOR_OFFSET);
+-            wordBbuf.rewind();
++        ((Buffer)wordBbuf).rewind();
+             IOUtils.readFully(archive, wordBbuf);
+             centralDirectoryStartDiskNumber = 0;
+             centralDirectoryStartRelativeOffset = ZipLong.getValue(wordBuf);
+@@ -1238,9 +1239,9 @@
+             for (; off >= stopSearching; off--) {
+                 archive.position(off);
+                 try {
+-                    wordBbuf.rewind();
++                    ((Buffer)wordBbuf).rewind();
+                     IOUtils.readFully(archive, wordBbuf);
+-                    wordBbuf.flip();
++                    ((Buffer)wordBbuf).flip();
+                 } catch (final EOFException ex) { // NOSONAR
+                     break;
+                 }
+@@ -1352,9 +1353,9 @@
+         } else {
+             archive.position(offset + LFH_OFFSET_FOR_FILENAME_LENGTH);
+         }
+-        wordBbuf.rewind();
++        ((Buffer)wordBbuf).rewind();
+         IOUtils.readFully(archive, wordBbuf);
+-        wordBbuf.flip();
++        ((Buffer)wordBbuf).flip();
+         wordBbuf.get(shortBuf);
+         final int fileNameLen = ZipShort.getValue(shortBuf);
+         wordBbuf.get(shortBuf);
+@@ -1382,7 +1383,7 @@
+      */
+     private boolean startsWithLocalFileHeader() throws IOException {
+         archive.position(0);
+-        wordBbuf.rewind();
++        ((Buffer)wordBbuf).rewind();
+         IOUtils.readFully(archive, wordBbuf);
+         return Arrays.equals(wordBuf, ZipArchiveOutputStream.LFH_SIG);
+     }
+@@ -1418,7 +1419,7 @@
+         @Override
+         protected int read(final long pos, final ByteBuffer buf) throws IOException {
+             final int read = archive.read(buf, pos);
+-            buf.flip();
++            ((Buffer)buf).flip();
+             return read;
+         }
+     }
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/utils/FixedLengthBlockOutputStream.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/utils/FixedLengthBlockOutputStream.java	2021-07-19 16:16:51.850472686 +0200
+@@ -21,6 +21,7 @@
+ import java.io.FileOutputStream;
+ import java.io.IOException;
+ import java.io.OutputStream;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.ByteOrder;
+ import java.nio.channels.ClosedChannelException;
+@@ -88,7 +89,7 @@
+     }
+ 
+     private void writeBlock() throws IOException {
+-        buffer.flip();
++        ((Buffer)buffer).flip();
+         final int i = out.write(buffer);
+         final boolean hasRemaining = buffer.hasRemaining();
+         if (i != blockSize || hasRemaining) {
+@@ -97,7 +98,7 @@
+                     blockSize, i);
+             throw new IOException(msg);
+         }
+-        buffer.clear();
++        ((Buffer)buffer).clear();
+     }
+ 
+     @Override
+@@ -142,7 +143,7 @@
+             // fill up the reset of buffer and write the block.
+             if (buffer.position() != 0) {
+                 final int n = buffer.remaining();
+-                src.limit(src.position() + n);
++                ((Buffer)src).limit(src.position() + n);
+                 buffer.put(src);
+                 writeBlock();
+                 srcLeft -= n;
+@@ -150,12 +151,12 @@
+             // whilst we have enough bytes in src for complete blocks,
+             // write them directly from src without copying them to buffer
+             while (srcLeft >= blockSize) {
+-                src.limit(src.position() + blockSize);
++                ((Buffer)src).limit(src.position() + blockSize);
+                 out.write(src);
+                 srcLeft -= blockSize;
+             }
+             // copy any remaining bytes into buffer
+-            src.limit(savedLimit);
++            ((Buffer)src).limit(savedLimit);
+             buffer.put(src);
+         }
+         return srcRemaining;
+@@ -242,7 +243,7 @@
+                 final int pos = buffer.position();
+                 final int len = buffer.limit() - pos;
+                 out.write(buffer.array(), buffer.arrayOffset() + pos, len);
+-                buffer.position(buffer.limit());
++                ((Buffer)buffer).position(buffer.limit());
+                 return len;
+             } catch (final IOException e) {
+                 try {
+--- commons-compress-1.21-src/src/main/java/org/apache/commons/compress/utils/IOUtils.java	2020-01-22 16:10:15.000000000 +0100
++++ commons-compress-1.21-src/src/main/java/org/apache/commons/compress/utils/IOUtils.java	2021-07-19 17:09:11.659891748 +0200
+@@ -25,6 +25,7 @@
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.nio.Buffer;
+ import java.nio.ByteBuffer;
+ import java.nio.channels.ReadableByteChannel;
+ import java.nio.file.Files;
+@@ -372,7 +373,7 @@
+                 break;
+             }
+             output.write(b.array(), 0, readNow);
+-            b.rewind();
++            ((Buffer)b).rewind();
+             read += readNow;
+         }
+         return output.toByteArray();