Fix a bug when there was a newline in the string expandtabs was called on.

This also catches another condition that can overflow.

Will backport.

1 files changed, 8 insertions, 2 deletions

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 3481d19169..ad33b8e110 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -5705,7 +5705,8 @@ unicode_expandtabs(PyUnicodeObject *self, PyObject *args)
 	    if (tabsize > 0) {
 		j += tabsize - (j % tabsize);
 		if (old_j > j) {
-		    PyErr_SetString(PyExc_OverflowError, "new string is too long");
+		    PyErr_SetString(PyExc_OverflowError,
+				    "new string is too long");
 		    return NULL;
 		}
 		old_j = j;
@@ -5715,7 +5716,12 @@ unicode_expandtabs(PyUnicodeObject *self, PyObject *args)
             j++;
             if (*p == '\n' || *p == '\r') {
                 i += j;
-                j = 0;
+                old_j = j = 0;
+                if (i < 0) {
+                    PyErr_SetString(PyExc_OverflowError,
+                                    "new string is too long");
+                    return NULL;
+                }
             }
         }