PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

Summary

When PhpSpreadsheet loads an OpenDocument Spreadsheet (.ods), Ods::processTableRow() reads the table:number-rows-repeated attribute of a <table:table-row> with an unchecked (int) cast, then materialises one cell per repeated row. This value is completely unbounded, so a single ~1.4 KB file can instruct the reader to create up to millions of cells, exhausting memory (fatal OOM). No authentication, no special configuration, and the default read filter are required - any application that loads a user-supplied .ods is affected.

---

Affected versions

The number-rows-repeated expansion has existed in the ODS reader since its inception (pre-dating the current release branches), so all maintained lines are affected.

Branch	Affected
1.x	≤ 1.30.6
2.0–2.1	≤ 2.1.18
2.2–2.4	≤ 2.4.7
3.x	≤ 3.10.7
4.x–5.x	≤ 5.9.0 (latest)

---

Root cause (source → sink)

src/PhpSpreadsheet/Reader/Ods.php:

// line 816 — row repeat, unchecked (int) cast
$rowRepeats = (int) $childNode->getAttributeNS($tableNs, 'number-rows-repeated');
...
// line 1151 — row materialisation loop: NO upper bound
for ($rowAdjust = 0; $rowAdjust < $rowRepeats; ++$rowAdjust) {
    $rID = $rowID + $rowAdjust;
    $cell = $spreadsheet->getActiveSheet()->getCell($columnID . $rID);  // allocates a Cell
    $cell->setValueExplicit($dataValue, $type);
    // ... no bounds check on $rowAdjust or $rID ...
}

Why columns are NOT vulnerable (already bounded):

The column-header loop at line 1326 shows the correct pattern with bounds checking:

// line 1326 (processTableColumnHeader): BOUNDED correctly
for ($rowRepeats2 = $rowRepeats; $rowRepeats2 > 0 && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT; --$rowRepeats2) {
    // HAS BOUNDS CHECK: && $tableColumnIndex2 <= AddressRange::MAX_COLUMN_INT
}

Additionally, the cell-data column loop at line 1141 calls getCell() which throws exception at Coordinate.php:448 when column exceeds MAX_COLUMN_INT (XFD / 16,384):