PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

An attacker can exhaust PHP memory and cause a denial of service if your application loads a user-supplied .ods spreadsheet. The ODS reader does not limit repeated rows, so even a small file can make it create millions of cells. No authentication or special configuration is needed, and the default read filter does not prevent it.

Find phpoffice/phpspreadsheet and its version in composer.lock. Affected versions are 4.0.0 to 5.9.0, 3.3.0 to 3.10.7, 2.2.0 to 2.4.7, 2.0.0 to 2.1.18, and 1.30.6 or earlier, all inclusive. If your version is affected, check whether your application loads user-supplied .ods files through PhpSpreadsheet's ODS reader. No special configuration is needed; the default read filter is affected.

Summary

When PhpSpreadsheet loads an OpenDocument Spreadsheet (.ods), Ods::processTableRow() reads the table:number-rows-repeated attribute of a <table:table-row> with an unchecked (int) cast, then materialises one cell per repeated row. This value is completely unbounded, so a single ~1.4 KB file can instruct the reader to create up to millions of cells, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter are required - any application that loads a user-supplied .ods is affected.

Affected versions

The number-rows-repeated expansion has existed in the ODS reader since its inception (pre-dating the current release branches), so all maintained lines are affected.

Root cause (source → sink)

src/PhpSpreadsheet/Reader/Ods.php:

// line 816 — row repeat, unchecked (int) cast
$rowRepeats = (int) $childNode->getAttributeNS($tableNs, 'number-rows-repeated');
...
// line 1151 — row materialisation loop: NO upper bound
for ($rowAdjust = 0; $rowAdjust < $rowRepeats; ++$rowAdjust) {
    $rID = $rowID + $rowAdjust;
    $cell = $spreadsheet->getActiveSheet()->getCell($columnID . $rID);  // allocates a Cell
    $cell->setValueExplicit($dataValue, $type);
    // ... no bounds check on $rowAdjust or $rID ...
}

Why columns are NOT vulnerable (already bounded):

The column-header loop at line 1326 shows the correct pattern with bounds checking:

// line 1326 (processTableColumnHeader): BOUNDED correctly
for ($rowRepeats2 = $rowRepeats; $rowRepeats2 > 0 && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT; --$rowRepeats2) {
    // HAS BOUNDS CHECK: && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT
}

Additionally, the cell-data column loop at line 1141 calls getCell() which throws exception at Coordinate.php:448 when column exceeds MAX_COLUMN_INT (XFD / 16,384):

// Coordinate.php line 448
if ($columnIndex > self::MAX_COLUMN_INT) {
    throw new Exception('Column string index can not be beyond XFD');
}

Result: Columns are capped at 16,384. Only rows are unbounded.

Impact

Memory exhaustion (single valued cell, repeated many rows):
A non-null cell value with a huge number-rows-repeated attribute materialises millions of Cell objects → PHP fatal Allowed memory size ... exhausted.

Example:

• Payload: <table:table-row table:number-rows-repeated="5000000"> (5 million rows)
• File size: 1.4 KB
• Memory consumed: ~256 MB (one Cell object per row)
• Result: OOM at default memory limit

Reproduction

Vulnerable payload (causes OOM):

<table:table table:name="Sheet1">
 <table:table-row table:number-rows-repeated="5000000">
  <table:table-cell office:value-type="float" office:value="1">
   <text:p>1</text:p>
  </table:table-cell>
 </table:table-row>
</table:table>

Not vulnerable (for reference - throws exception):

<table:table table:name="Sheet1">
 <table:table-row>
  <table:table-cell office:value-type="float" office:value="1"
      table:number-columns-repeated="1000000000">
   <text:p>1</text:p>
  </table:table-cell>
 </table:table-row>
</table:table>

This column-repeat example throws Column string index can not be beyond XFD exception (bounded defense, already in place).