Fix a bug when there was a newline in the string expandtabs was called on.

This also catches another condition that can overflow.

Will backport.

diff --git a/Lib/test/string_tests.py b/Lib/test/string_tests.py
index 3570ef102fd4e9eb52b6946121269fedccebb9ef..d38e4a98dd70e81e90320fbcbdab91881e173461 100644 (file)
--- a/Lib/test/string_tests.py
+++ b/Lib/test/string_tests.py
@@ -247,8 +247,13 @@ class CommonTest(unittest.TestCase):
         self.checkequal('abc\rab      def\ng       hi', 'abc\rab\tdef\ng\thi', 'expandtabs')
         self.checkequal('abc\rab      def\ng       hi', 'abc\rab\tdef\ng\thi', 'expandtabs', 8)
         self.checkequal('abc\r\nab\r\ndef\ng\r\nhi', 'abc\r\nab\r\ndef\ng\r\nhi', 'expandtabs', 4)
+        self.checkequal('  a\n b', ' \ta\n\tb', 'expandtabs', 1)
 
         self.checkraises(TypeError, 'hello', 'expandtabs', 42, 42)
+        # This test is only valid when sizeof(int) == sizeof(void*) == 4.
+        if sys.maxint < (1 << 32) and struct.calcsize('P') == 4:
+            self.checkraises(OverflowError,
+                             '\ta\n\tb', 'expandtabs', sys.maxint)
 
     def test_split(self):
         self.checkequal(['this', 'is', 'the', 'split', 'function'],

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index d7ad5ccb51d5ca3a5f03416856d420dd7ed03ebf..387034385c78faed1edd111b8b7b179d590d8464 100644 (file)
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -3322,7 +3322,8 @@ string_expandtabs(PyStringObject *self, PyObject *args)
            if (tabsize > 0) {
                j += tabsize - (j % tabsize);
                if (old_j > j) {
-                   PyErr_SetString(PyExc_OverflowError, "new string is too long");
+                   PyErr_SetString(PyExc_OverflowError,
+                                   "new string is too long");
                    return NULL;
                }
                old_j = j;
@@ -3332,7 +3333,12 @@ string_expandtabs(PyStringObject *self, PyObject *args)
             j++;
             if (*p == '\n' || *p == '\r') {
                 i += j;
-                j = 0;
+                old_j = j = 0;
+                if (i < 0) {
+                    PyErr_SetString(PyExc_OverflowError,
+                                    "new string is too long");
+                    return NULL;
+                }
             }
         }
 

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 3481d191699ec57e58e059d0603ed2cea11ccda7..ad33b8e110f149801f2955fa3b7a0374c18fea60 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -5705,7 +5705,8 @@ unicode_expandtabs(PyUnicodeObject *self, PyObject *args)
            if (tabsize > 0) {
                j += tabsize - (j % tabsize);
                if (old_j > j) {
-                   PyErr_SetString(PyExc_OverflowError, "new string is too long");
+                   PyErr_SetString(PyExc_OverflowError,
+                                   "new string is too long");
                    return NULL;
                }
                old_j = j;
@@ -5715,7 +5716,12 @@ unicode_expandtabs(PyUnicodeObject *self, PyObject *args)
             j++;
             if (*p == '\n' || *p == '\r') {
                 i += j;
-                j = 0;
+                old_j = j = 0;
+                if (i < 0) {
+                    PyErr_SetString(PyExc_OverflowError,
+                                    "new string is too long");
+                    return NULL;
+                }
             }
         }