Crashes when making XMLSchema from a WSDL

[Anentropic]

I had been running fine under Python 2.7.6 (OS X 10.9.5)

Today I decided to upgrade my Python to 2.7.9

```
Python : sys.version_info(major=2, minor=7, micro=9, releaselevel='final', serial=0)
lxml.etree : (3, 4, 1, 0)
libxml used : (2, 9, 0)
libxml compiled : (2, 9, 0)
libxslt used : (1, 1, 28)
libxslt compiled : (1, 1, 28)
```

Now I am getting random "Segmentation fault: 11" error on this code:

```
from lxml import etree
with open('/Users/anentropic/Desktop/ebaySvc.wsdl') as f:
    schema_tree = etree.parse(f)
schema_el = schema_tree.find(
    "{http://schemas.xmlsoap.org/wsdl/}types/"
    "{http://www.w3.org/2001/XMLSchema}schema"
)
schema = etree.XMLSchema(schema_el)
```

you can repeat my case by downloading ebaySvc.wsdl file from here:
http://developer.ebay.com/webservices/latest/ebaySvc.wsdl

If I run repeatedly by %cpaste into ipython console... more often than not I get the segfault but sometimes it works.

The times when it works, when I `exit` the ipython console I then see this output:

```
python2.7(24128,0x7fff76279310) malloc: *** error for object 0x7fff9042001c: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Abort trap: 6
```

I was not having this problem before upgrade to Python 2.7.9

However a similar code which does not segfault is below:

 ```
from lxml import etree
with open('/Users/anentropic/Desktop/ebaySvc.xsd') as f:
    schema = etree.XMLSchema(file=f)
```

the test file can be downloaded from here:
http://developer.ebay.com/webservices/latest/ebaySvc.xsd

[Anentropic (anentropic)]

Apologies, I have now installed Python 2.7.6 under pyenv and tested again... I get the same segfault, so must have been just luck I never noticed the problem before upgrading my Python. I have edited the bug title to reflect this.

```
Python : sys.version_info(major=2, minor=7, micro=6, releaselevel='final', serial=0)
lxml.etree : (3, 4, 1, 0)
libxml used : (2, 9, 0)
libxml compiled : (2, 9, 0)
libxslt used : (1, 1, 28)
libxslt compiled : (1, 1, 28)
```

```
$ python
Python 2.7.6 (default, Jan 29 2015, 13:20:57)
[GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.56)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from lxml import etree
>>> with open('/Users/anentropic/Desktop/ebaySvc.wsdl') as f:
... schema_tree = etree.parse(f)
...
>>> schema_el = schema_tree.find("{http://schemas.xmlsoap.org/wsdl/}types/{http://www.w3.org/2001/XMLSchema}schema")
>>> schema = etree.XMLSchema(schema_el)
Segmentation fault: 11
$
```

[Anentropic (anentropic)]

After some more testing, a minimal file which causes the segfault is reproduced below:

```
<?xml version="1.0" encoding="UTF-8"?>
<wsdl:definitions
 xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
 xmlns:xs="http://www.w3.org/2001/XMLSchema"
 xmlns="urn:ebay:apis:eBLBaseComponents"
 targetNamespace="urn:ebay:apis:eBLBaseComponents">
 <wsdl:types>
  <xs:schema targetNamespace="urn:ebay:apis:eBLBaseComponents"
  xmlns="urn:ebay:apis:eBLBaseComponents"
  xmlns:xs="http://www.w3.org/2001/XMLSchema">
  </xs:schema>
 </wsdl:types>
</wsdl:definitions>
```

[Anentropic (anentropic)]

Further info... pulling the `schema` element out into a new tree as root node doesn't help:

```
In [1]: from lxml import etree, objectify

In [2]: schema_tree = etree.parse('file:///Users/anentropic/Desktop/minimal.wsdl')

In [3]: schema_el = schema_tree.find("{http://schemas.xmlsoap.org/wsdl/}types/{http://www.w3.org/2001/XMLSchema}schema")

In [4]: newschema = etree.ElementTree(schema_el)

In [5]: schema_el = newschema.getroot()

In [6]: etree.XMLSchema(schema_el)
Out[6]: <lxml.etree.XMLSchema at 0x106968780>

In [7]: etree.XMLSchema(schema_el)
Segmentation fault: 11
```

[Anentropic (anentropic)]

even more minimal

```
<?xml version="1.0" encoding="UTF-8"?>
<wsdl:definitions
 xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
 xmlns:xs="http://www.w3.org/2001/XMLSchema">
 <wsdl:types>
  <xs:schema>
  </xs:schema>
 </wsdl:types>
</wsdl:definitions>
```

if I serialize the <xs:schema> node via `etree.tostring` and reparse it then it works no problem

[scoder (scoder)]

Thank you for coming up with a short test case. I can easily reproduce it. I'm working on a fix.

[scoder (scoder)]

https://github.com/lxml/lxml/commit/fa39e927e702e564485c6af7c97c1ed3a8230073

[scoder (scoder)]

Fix released in lxml 3.4.2.