centos7上毫無(wú)規(guī)律的出現(xiàn)錯(cuò)誤“Segmentation fault”？

int readLogDataFromRedis(char readKey[50], struct logObj *logP)
{
    printf("readkey=%s\n",readKey);
    int DataCount = 0;
    unsigned int j,n;

    struct timeval timeout = { 1, 500000 }; // 1.5 seconds
    redisContext* conn = redisConnectWithTimeout(redisServer, redisPort, timeout);
    if (conn->err) {
        printf("connection error:%s\n", conn->errstr);
        redisFree(conn);
        return 0;
    }
    redisReply* reply = (redisReply*)redisCommand(conn, readDB);
    if (NULL == reply) {
        redisFree(conn);
        return 0;
    }
    if (!(reply->type == REDIS_REPLY_STATUS && strcasecmp(reply->str, "OK") == 0)) {
        printf("Failed to execute command[%s].\n", readDB);
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }
    freeReplyObject(reply);

    char cmd[50] = {0};
    sprintf(cmd, "LRANGE %s 0 -1", readKey);
    reply = (redisReply*)redisCommand(conn, cmd);
    if (reply->type != REDIS_REPLY_ARRAY) {
        printf("Failed to execute command[%s].\n",cmd);
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }

    //string str;
    struct tempChar *tChar, *tCharBuf;
    tChar = (struct tempChar*)malloc(sizeof(struct tempChar)*logCount);
    memset(tChar, 0, sizeof(struct tempChar)*logCount);
    tCharBuf = tChar;
    
    for (j = 0; j < reply->elements; ++j) {
        redisReply* childReply = reply->element[j];
        if (childReply->type == REDIS_REPLY_STRING)
        {    
            char *x = childReply->str;
            
            //拼接原始數(shù)據(jù)，壓縮后導(dǎo)出
            strcat(tCharBuf[j].str, x);
            strcat(tCharBuf[j].str, "\r");

            int commasIndex = 0, commaeIndex = 0;
            int col = 0;
            strcat(x, "^");
            for (n = 0; x[n] != '\0'; ++n)
            {
                if ('^' == x[n] || '\r' == x[n])
                {
                    commaeIndex = n;
                    if (col == 0) strcpy(logP[DataCount].ev, subStr(x, commasIndex, commaeIndex));
                    if (col == 1) strcpy(logP[DataCount].cy, subStr(x, commasIndex, commaeIndex));
                    if (col == 2) logP[DataCount].v = atof(subStr(x, commasIndex, commaeIndex));
                    if (col == 3) strcpy(logP[DataCount].tp, subStr(x, commasIndex, commaeIndex));
                    if (col == 4) strcpy(logP[DataCount].ids, subStr(x, commasIndex, commaeIndex));
                    if (col == 5) logP[DataCount].cnt = atof(subStr(x, commasIndex, commaeIndex));
                    if (col == 6) strcpy(logP[DataCount].cg, subStr(x, commasIndex, commaeIndex));
                    if (col == 7) logP[DataCount].dt_fs = atof(subStr(x, commasIndex, commaeIndex));
                    if (col == 8) strcpy(logP[DataCount].wid, subStr(x, commasIndex, commaeIndex));
                    if (col == 9) strcpy(logP[DataCount].lp, subStr(x, commasIndex, commaeIndex));
                    if (col == 10) strcpy(logP[DataCount].ref, subStr(x, commasIndex, commaeIndex));
                    if (col == 11) logP[DataCount].sw = atoi(subStr(x, commasIndex, commaeIndex));
                    if (col == 12) logP[DataCount].sh = atoi(subStr(x, commasIndex, commaeIndex));
                    if (col == 13) strcpy(logP[DataCount].aid, subStr(x, commasIndex, commaeIndex));
                    if (col == 14) strcpy(logP[DataCount].agent, subStr(x, commasIndex, commaeIndex));
                    if (col == 15) strcpy(logP[DataCount].ga, subStr(x, commasIndex, commaeIndex));
                    if (col == 16) strcpy(logP[DataCount].sid, subStr(x, commasIndex, commaeIndex));
                    if (col == 17) strcpy(logP[DataCount].lid, subStr(x, commasIndex, commaeIndex));
                    if (col == 18) strcpy(logP[DataCount].gid, subStr(x, commasIndex, commaeIndex));
                    if (col == 19) strcpy(logP[DataCount].uid, subStr(x, commasIndex, commaeIndex));
                    if (col == 20) strcpy(logP[DataCount].gsid, subStr(x, commasIndex, commaeIndex));
                    if (col == 21) strcpy(logP[DataCount].ip, subStr(x, commasIndex, commaeIndex));
                    if (col == 22) logP[DataCount].dt = atof(subStr(x, commasIndex, commaeIndex));
                    commasIndex = n + 1;
                    col++;
                }
            }
            if (strlen(logP[DataCount].aid)>0)
                DataCount++;
            col = 0; commasIndex = 0; commaeIndex = 0;
        }
            
    }
    freeReplyObject(reply);

    //轉(zhuǎn)換
    char *src, *dst;
    src = (char*)malloc(singleLen * logCount);
    memset(src, 0, singleLen * logCount);
    charAppendToStr(tCharBuf, logCount, src);
    *(src - 1) = '\0';

    //壓縮
    char fileName[100] = {0};
    sprintf(fileName, "%s/%s", filePath, readKey);
    FILE *ofile = fopen(fileName, "wb");
    qlz_state_compress *state_compress = (qlz_state_compress *)malloc(sizeof(qlz_state_compress));
    int len, len2;
    len = strlen(src);
    dst = (char*)malloc(len + 400);

    //寫(xiě)壓縮結(jié)果
    len2 = qlz_compress(src, dst, len, state_compress);
    fwrite(dst, len2, 1, ofile);
    fclose(ofile);
    printf("len2=%d,compress success!",len2);

    
    reply = (redisReply*)redisCommand(conn, writeDB);
    if (!(reply->type == REDIS_REPLY_STATUS && strcasecmp(reply->str, "OK") == 0)) {
        printf("Failed to execute command[%s].\n", writeDB);
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }
    freeReplyObject(reply);
    
    reply = (redisReply*)redisCommand(conn, "RPUSH toBeUpload_compress %s", readKey);
    if (!(reply->type == REDIS_REPLY_INTEGER)) {
        printf("Failed to execute command[%s].\n", "RPUSH toBeUpload_compress");
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }
    freeReplyObject(reply);
    
    ////刪除當(dāng)前key的數(shù)據(jù)
    //reply = (redisReply*)redisCommand(conn, "del %s", readKey);
    //freeReplyObject(reply);
    
    if(src!=NULL){
        free(src);
        src=NULL;
    }
    if(dst!=NULL){
        free(dst);
        dst=NULL;
    }
    if(tChar!=NULL){
        free(tChar);
        tChar=NULL;
    }
    redisFree(conn);
    return DataCount;
}

上面這段代碼之前是在windows上寫(xiě)的，運(yùn)行起來(lái)沒(méi)有任何問(wèn)題，現(xiàn)在環(huán)境改到centos7上面，重新編譯過(guò)了，運(yùn)行起來(lái)各種問(wèn)題，經(jīng)常出現(xiàn) “double free”或者“Segmentation fault”段錯(cuò)誤，仔細(xì)檢查了這段代碼，沒(méi)發(fā)現(xiàn)啥問(wèn)題，而且“Segmentation fault”這個(gè)錯(cuò)誤出現(xiàn)的一點(diǎn)規(guī)律都沒(méi)有，同樣的數(shù)據(jù)跑幾次可能其中一兩次會(huì)出現(xiàn)問(wèn)題，并且出現(xiàn)這個(gè)錯(cuò)誤問(wèn)題的位置還不一樣，有沒(méi)有大神解解惑的？