patch 9.0.0690: buffer size for expanding tab not correctly computed

Problem:    Buffer size for expanding tab not correctly computed.
Solution:   Correctly use size of end character.
diff --git a/src/drawline.c b/src/drawline.c
index e7f9fab..cddb6ab 100644
--- a/src/drawline.c
+++ b/src/drawline.c
@@ -2805,9 +2805,10 @@
 			// If wlv.n_extra > 0, it gives the number of chars, to
 			// use for a tab, else we need to calculate the width
 			// for a tab.
-			len = (tab_len * mb_char2len(wp->w_lcs_chars.tab2));
+			int tab2_len = mb_char2len(wp->w_lcs_chars.tab2);
+			len = tab_len * tab2_len;
 			if (wp->w_lcs_chars.tab3)
-			    len += mb_char2len(wp->w_lcs_chars.tab3);
+			    len += mb_char2len(wp->w_lcs_chars.tab3) - tab2_len;
 			if (wlv.n_extra > 0)
 			    len += wlv.n_extra - tab_len;
 			c = wp->w_lcs_chars.tab1;