不定时重复出现的double free问题，有请大虾们解答

Question

如题，在Java以JNI形式调用.so库时，出错。下面是用到的.so库的部分源代码，调用这部分的时候出现如题错误，哪位大虾能指点一下这段代码怎么会出现double-free的问题呢？

JNIEXPORT jbyteArray JNICALL Java_com_interconnection_encrypt_Encrypt_encryptData
(JNIEnv *env, jclass clazz, jbyteArray encByteArr)
{
jbyte * mybyte =env->GetByteArrayElements(encByteArr,0);
addChsrc = addChsrc + '';
int length = UptoEight(addChsrc);

char * chSrc =new char[length + 1];

memset(chSrc,'',length);

memcpy(chSrc,addChsrc,strlen(addChsrc));

char *chDes = new char[length ];
memset(chDes,'',length);

int *chDes_len = new int[length];
int Enreturn = EncryptData (chSrc,chDes,chDes_len);

int chSrcLen = strlen(chSrc);
int chDesLen = strlen(chDes);

jbyteArray RtnArr = NULL;
if (Enreturn == 0){

jsize arrsize = (jsize)length;

RtnArr =env->NewByteArray(arrsize);
env->SetByteArrayRegion(RtnArr,0,length,(jbyte*)chDes);
}
env->ReleaseByteArrayElements(encByteArr,mybyte,0);

if (chDes){
delete []chDes;
chDes = NULL;}

if(chDes_len){
delete []chDes_len;
chDes_len = NULL;}

if(chSrc){
delete []chSrc;
chSrc = NULL;
}

return RtnArr;
}

所用系统为Redhat AS 4；gcc版本 3.4.4 ；glibc版本 2.3.4-2.13

问题是不定时出现，都不好定位是哪里抛出的错误。
编译时的makefile
g++ -g -fPIC -shared -oEncrypt.so Encrypt.cpp -lpthread -lDesencrypt
其中 Desencrypt为一静态库libDesencrypt.a，已添加到/usr/lib下面。

倾听各位的高见。

Answer 1

谢谢楼上的建议；【2】 试试在fprintf()函数上设置断点？程序无fprintf()函数，不明白楼上的具体意思。偶是Linux下的菜鸟，
下面是部分最后的strace文件，各位能否从中看出点端倪？

902  open("/usr/test/2006102089454.xml", O_RDONLY|O_LARGEFILE) = 32
6902  fstat64(0x20, 0xe55f8ec4)         = 0
6902  fstat64(0x20, 0xe55f8f54)         = 0
6902  read(32, "<?xml version="1.0" encoding="GB"..., 92 = 928
6902  semget(629127, 1, IPC_CREAT|IPC_EXCL|0666) = -1 EEXIST (File exists)
6902  gettimeofday({3450470512738062, 4294966816}, {4294966816, 16527768680314962956}) = 0
6902  select(12, NULL, [11], NULL, {42949672960, 16527768474156531724}) = 1 (out [11], left {4294967296000, 16527768474156531724})
6902  send(-1918974981077729269, 0x40c, 4449586119692, MSG_DONTROUTE|MSG_ERRQUEUE|MSG_DONTWAIT|MSG_CONFIRM|MSG_FIN|MSG_SYN|MSG_NOSIGNAL|0xe55e0000) = 1036
6902  gettimeofday({3452995953508110, 4294966816}, {4294966816, 16528050705767371850}) = 0
6902  select(12, [11], NULL, NULL, {40, 0}) = 1 (in [11], left {40, 0})
6902  gettimeofday({3456977388191502, 4294966816}, {4294966816, 16527768752882609772}) = 0
6902  select(12, [11], NULL, NULL, {0, 18311639534908489486}) = 1 (in [11], left {0, 18311639534908489486})
6902  recv(-1918974981077729269, 0xffff, 281470681808895, MSG_DONTROUTE|MSG_PROXY|MSG_ERRQUEUE|MSG_DONTWAIT|MSG_CONFIRM|MSG_FIN|MSG_SYN|MSG_NOSIGNAL|0xe55e0000) = 996
6902  gettimeofday({3460086944513806, 4294966816}, {4294966816, 16527768752882610768}) = 0
6902  select(12, [11], NULL, NULL, {0, 18311639534908489486}) = 0 (Timeout)
6902  open("/dev/tty", O_RDWR|O_NONBLOCK|O_NOCTTY) = -1 ENXIO (No such device or address)
6902  writev(2, [{0x1700b10c44, 141745523852}, {0x400b10c5d, 38207983340}, {0x500b10c63, 0}, {0x500b10c63, 49834698362293728}, {0x25, 0}], 5) = 73
6902  rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, = 0
6902  tgkill(6833, 6902, SIGABRT)       = 0
6902  --- SIGABRT (Aborted) @ 0 (0) ---
6871  <... futex resumed> )             = -1 EINTR (Interrupted system call)
6855  <... futex resumed> )             = -1 EINTR (Interrupted system call)

Answer 2

【1】 设法把这段代码剥离到一个C的应用程序里调试，和JVM混在一起不好调试

【2】 试试在fprintf()函数上设置断点，这样在出现double free提示信息的时候可以看到这个信息是哪里跑出来的

Answer 3

从烂到不烂是需要个过程的：），只是这样为什么会出现Double free 的问题呢？

Answer 4

谁写的代码？比较烂。