static PyObject *partial_setstate(partialobject *pto, PyObject *state){    PyObject *fn, *fnargs, *kw, *dict;    if (!PyArg_ParseTuple(state, "OOOO",                          &fn, &fnargs, &kw, &dict))        return NULL;    Py_XDECREF(pto->fn);    Py_XDECREF(pto->args);    Py_XDECREF(pto->kw);    Py_XDECREF(pto->dict);    pto->fn = fn;    pto->args = fnargs; //we control pto->args here`partial_setstate` performs no checks on the objectsit is passed as an argument.static PyObject *partial_call(partialobject *pto, PyObject *args, PyObject *kw){    PyObject *ret;    PyObject *argappl = NULL, *kwappl = NULL;    assert (PyCallable_Check(pto->fn));    assert (PyTuple_Check(pto->args)); //assume pto->args is a tuple                                       //assertion not present in release build    assert (pto->kw == Py_None  ||  PyDict_Check(pto->kw));    if (PyTuple_GET_SIZE(pto->args) == 0) {        argappl = args;        Py_INCREF(args);    } else if (PyTuple_GET_SIZE(args) == 0) {        argappl = pto->args; //partial function called with no arguments        Py_INCREF(pto->args);    } else {        argappl = PySequence_Concat(pto->args, args);        if (argappl == NULL)            return NULL;    }    if (pto->kw == Py_None) {        kwappl = kw;        Py_XINCREF(kw);    } else {        kwappl = PyDict_Copy(pto->kw);        if (kwappl == NULL) {            Py_DECREF(argappl);            return NULL;        }        if (kw != NULL) {            if (PyDict_Merge(kwappl, kw, 1) != 0) {                Py_DECREF(argappl);                Py_DECREF(kwappl);                return NULL;            }        }    }    ret = PyObject_Call(pto->fn, argappl, kwappl); //pto->fn called with non-tuple argapplWe can see that in the provided POC there is an increment on a user-controlled address (in this case, the literal refcount of a given "argument" is interpreted as a pointer), as `_PyEval_EvalCodeWithName` does not validate the type of `PyObject **args` either (I assume this is a fair assumption for `_PyEval_EvalCodeWithName`, and the bug simply lies in the unsafe partial code.vagrant@vagrant-ubuntu-wily-64:/vagrant/Python-3.5.1$ gdb -q ./python.exe...(gdb) r partialpoc2.pyStarting program: /vagrant/Python-3.5.1/python.exe partialpoc2.py...Program received signal SIGSEGV, Segmentation fault._PyEval_EvalCodeWithName (_co=0x7ffff7045ae0, globals=<optimized out>,locals=locals@entry=0x0,args=args@entry=0x7ffff6fbc520, argcount=1280,kws=kws@entry=0x0, kwcount=0, defs=0x0, defcount=0,    kwdefs=0x0, closure=0x0, name=0x0, qualname=0x0) atPython/ceval.c:37933793            Py_INCREF(x);(gdb) i rrax            0x9b4b6810177384rbx            0x7ffff6fbc520140737337083168rcx            0x11rdx            0x22rsi            0x5001280rdi            0x00rbp            0x00x0rsp            0x7fffffffdb300x7fffffffdb30r8             0x5001280r9             0x00r10            0x7ffff74a6c58140737342237784r11            0x9b4b4010177344r12            0x00r13            0x00r14            0x7ffff6fb91e0140737337070048r15            0x7ffff7e1a048140737352147016rip            0x4fc7710x4fc771 <_PyEval_EvalCodeWithName+961>eflags         0x10202[ IF RF ]cs             0x3351ss             0x2b43ds             0x00es             0x00fs             0x00gs             0x00(gdb) x/3i $pc=> 0x4fc771 <_PyEval_EvalCodeWithName+961>:addq   $0x1,(%rsi)   0x4fc775 <_PyEval_EvalCodeWithName+965>:cmp    %edx,%r8d   0x4fc778 <_PyEval_EvalCodeWithName+968>:mov    %rsi,0x18(%rax,%rcx,8)

There are other bugs in partial() that lead to crash, leak, or invalid behavior. Proposed patch fixes these bugs.

I didn't do a full review of the C code changes, but the new test cases look good to me, and the changes specifically to partial_setstate also look good.

This looks correct.

Thank you Nick and Raymond for your reviews.

New changeset542b5744ddc3 by Serhiy Storchaka in branch '3.5':Issue#25945: Fixed bugs in functools.partial.https://hg.python.org/cpython/rev/542b5744ddc3New changeset33109176538d by Serhiy Storchaka in branch 'default':Issue#25945: Fixed bugs in functools.partial.https://hg.python.org/cpython/rev/33109176538dNew changeset628ce2975e29 by Serhiy Storchaka in branch '2.7':Issue#25945: Fixed bugs in functools.partial.https://hg.python.org/cpython/rev/628ce2975e29