centos7上毫无规律的出现错误“Segmentation fault”？

Question

int readLogDataFromRedis(char readKey[50], struct logObj *logP)
{
    printf("readkey=%s\n",readKey);
    int DataCount = 0;
    unsigned int j,n;

    struct timeval timeout = { 1, 500000 }; // 1.5 seconds
    redisContext* conn = redisConnectWithTimeout(redisServer, redisPort, timeout);
    if (conn->err) {
        printf("connection error:%s\n", conn->errstr);
        redisFree(conn);
        return 0;
    }
    redisReply* reply = (redisReply*)redisCommand(conn, readDB);
    if (NULL == reply) {
        redisFree(conn);
        return 0;
    }
    if (!(reply->type == REDIS_REPLY_STATUS && strcasecmp(reply->str, "OK") == 0)) {
        printf("Failed to execute command[%s].\n", readDB);
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }
    freeReplyObject(reply);

    char cmd[50] = {0};
    sprintf(cmd, "LRANGE %s 0 -1", readKey);
    reply = (redisReply*)redisCommand(conn, cmd);
    if (reply->type != REDIS_REPLY_ARRAY) {
        printf("Failed to execute command[%s].\n",cmd);
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }

    //string str;
    struct tempChar *tChar, *tCharBuf;
    tChar = (struct tempChar*)malloc(sizeof(struct tempChar)*logCount);
    memset(tChar, 0, sizeof(struct tempChar)*logCount);
    tCharBuf = tChar;
    
    for (j = 0; j < reply->elements; ++j) {
        redisReply* childReply = reply->element[j];
        if (childReply->type == REDIS_REPLY_STRING)
        {    
            char *x = childReply->str;
            
            //拼接原始数据，压缩后导出
            strcat(tCharBuf[j].str, x);
            strcat(tCharBuf[j].str, "\r");

            int commasIndex = 0, commaeIndex = 0;
            int col = 0;
            strcat(x, "^");
            for (n = 0; x[n] != '\0'; ++n)
            {
                if ('^' == x[n] || '\r' == x[n])
                {
                    commaeIndex = n;
                    if (col == 0) strcpy(logP[DataCount].ev, subStr(x, commasIndex, commaeIndex));
                    if (col == 1) strcpy(logP[DataCount].cy, subStr(x, commasIndex, commaeIndex));
                    if (col == 2) logP[DataCount].v = atof(subStr(x, commasIndex, commaeIndex));
                    if (col == 3) strcpy(logP[DataCount].tp, subStr(x, commasIndex, commaeIndex));
                    if (col == 4) strcpy(logP[DataCount].ids, subStr(x, commasIndex, commaeIndex));
                    if (col == 5) logP[DataCount].cnt = atof(subStr(x, commasIndex, commaeIndex));
                    if (col == 6) strcpy(logP[DataCount].cg, subStr(x, commasIndex, commaeIndex));
                    if (col == 7) logP[DataCount].dt_fs = atof(subStr(x, commasIndex, commaeIndex));
                    if (col == 8) strcpy(logP[DataCount].wid, subStr(x, commasIndex, commaeIndex));
                    if (col == 9) strcpy(logP[DataCount].lp, subStr(x, commasIndex, commaeIndex));
                    if (col == 10) strcpy(logP[DataCount].ref, subStr(x, commasIndex, commaeIndex));
                    if (col == 11) logP[DataCount].sw = atoi(subStr(x, commasIndex, commaeIndex));
                    if (col == 12) logP[DataCount].sh = atoi(subStr(x, commasIndex, commaeIndex));
                    if (col == 13) strcpy(logP[DataCount].aid, subStr(x, commasIndex, commaeIndex));
                    if (col == 14) strcpy(logP[DataCount].agent, subStr(x, commasIndex, commaeIndex));
                    if (col == 15) strcpy(logP[DataCount].ga, subStr(x, commasIndex, commaeIndex));
                    if (col == 16) strcpy(logP[DataCount].sid, subStr(x, commasIndex, commaeIndex));
                    if (col == 17) strcpy(logP[DataCount].lid, subStr(x, commasIndex, commaeIndex));
                    if (col == 18) strcpy(logP[DataCount].gid, subStr(x, commasIndex, commaeIndex));
                    if (col == 19) strcpy(logP[DataCount].uid, subStr(x, commasIndex, commaeIndex));
                    if (col == 20) strcpy(logP[DataCount].gsid, subStr(x, commasIndex, commaeIndex));
                    if (col == 21) strcpy(logP[DataCount].ip, subStr(x, commasIndex, commaeIndex));
                    if (col == 22) logP[DataCount].dt = atof(subStr(x, commasIndex, commaeIndex));
                    commasIndex = n + 1;
                    col++;
                }
            }
            if (strlen(logP[DataCount].aid)>0)
                DataCount++;
            col = 0; commasIndex = 0; commaeIndex = 0;
        }
            
    }
    freeReplyObject(reply);

    //转换
    char *src, *dst;
    src = (char*)malloc(singleLen * logCount);
    memset(src, 0, singleLen * logCount);
    charAppendToStr(tCharBuf, logCount, src);
    *(src - 1) = '\0';

    //压缩
    char fileName[100] = {0};
    sprintf(fileName, "%s/%s", filePath, readKey);
    FILE *ofile = fopen(fileName, "wb");
    qlz_state_compress *state_compress = (qlz_state_compress *)malloc(sizeof(qlz_state_compress));
    int len, len2;
    len = strlen(src);
    dst = (char*)malloc(len + 400);

    //写压缩结果
    len2 = qlz_compress(src, dst, len, state_compress);
    fwrite(dst, len2, 1, ofile);
    fclose(ofile);
    printf("len2=%d,compress success!",len2);

    
    reply = (redisReply*)redisCommand(conn, writeDB);
    if (!(reply->type == REDIS_REPLY_STATUS && strcasecmp(reply->str, "OK") == 0)) {
        printf("Failed to execute command[%s].\n", writeDB);
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }
    freeReplyObject(reply);
    
    reply = (redisReply*)redisCommand(conn, "RPUSH toBeUpload_compress %s", readKey);
    if (!(reply->type == REDIS_REPLY_INTEGER)) {
        printf("Failed to execute command[%s].\n", "RPUSH toBeUpload_compress");
        freeReplyObject(reply);
        redisFree(conn);
        return 0;
    }
    freeReplyObject(reply);
    
    ////删除当前key的数据
    //reply = (redisReply*)redisCommand(conn, "del %s", readKey);
    //freeReplyObject(reply);
    
    if(src!=NULL){
        free(src);
        src=NULL;
    }
    if(dst!=NULL){
        free(dst);
        dst=NULL;
    }
    if(tChar!=NULL){
        free(tChar);
        tChar=NULL;
    }
    redisFree(conn);
    return DataCount;
}

上面这段代码之前是在windows上写的，运行起来没有任何问题，现在环境改到centos7上面，重新编译过了，运行起来各种问题，经常出现 “double free”或者“Segmentation fault”段错误，仔细检查了这段代码，没发现啥问题，而且“Segmentation fault”这个错误出现的一点规律都没有，同样的数据跑几次可能其中一两次会出现问题，并且出现这个错误问题的位置还不一样，有没有大神解解惑的？

Answer 1

内存问题可以使用valgrind定位。
“double free”或者“Segmentation fault” 要给出具体异常信息，光给个代码片段没什么用