Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack

How it was found

See my official writeups here:

http://bugs.python.org/issue25944 http://bugs.python.org/issue25945

The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that is controlled reliably by the user. I've uploaded that case here as well.