求助，关于_lock_file访问位置冲突

[疯狂儿的程序员]

各位哥哥姐姐，小弟分不多所以没法给太多，但是在这里还是要诚心求助！
一个C/S模式的应用程序。
有两个功能，一个上传图片到相册，一个查看相册。对相册查看时会将图片缓冲到客户端本地。
如果不上传图片则查看相册并没有问题，如果上传图片后查看相册则出现

void __cdecl _lock_file (
        void *pf
        )
{
        /*
         * The way the FILE (pointed to by pf) is locked depends on whether
         * it is part of _iob[] or not
         */
        if ( (pf >= (void *)_iob) && (pf <= (void *)(&_iob[_IOB_ENTRIES-1])) )
            /*
             * FILE lies in _iob[] so the lock lies in _locktable[].
             */
            _lock( _STREAM_LOCKS + (int)((FILE *)pf - _iob) );
        else
            /*
             * Not part of _iob[]. Therefore, *pf is a _FILEX and the
             * lock field of the struct is an initialized critical
             * section.
             */
            EnterCriticalSection( &(((_FILEX *)pf)->lock) );
}//0x7c921010 处未处理的异常: 0xC0000005: 读取位置 0x00000034 时发生访问冲突 。

经过对程序进行DEBUG跟踪，发现问题出现在fwrite函数。

//上传代码如下：
while(photoNum>i)
	{	FILE *picFileA=NULL;
		picFileA=fopen(pPathArr->photoName,"rb");//打开图片
		ImageSize=_filelength(_fileno(picFileA));//获取图片大小
		char *pSendPic = new char[ImageSize];//创建图片发送缓冲区
		fread(pSendPic,sizeof(char),ImageSize,picFileA);//将图片读到缓冲区中
		SENDPICINFO picInfo;
		picInfo.photoSize=ImageSize;
		CString strTime;
		GetCurTime(strTime);
		strcpy(picInfo.sendTime,strTime);
		dataleft=sizeof(SENDPICINFO);
		char *pPicInfo=(char*)&picInfo;
		rst=0;
		while(dataleft>0)//发送图片信息头
		{
			rst=send(sock,pPicInfo,dataleft,0);
			dataleft-=rst;
			pPicInfo+=rst;
		}
		
		CMDPACKAGE package2;
		memset(&package2,0,sizeof(CMDPACKAGE));
		strcpy(package2.head,"RECVHEAD");
		dataleft=sizeof(CMDPACKAGE);
		char *pPackage2=(char*)&package2;
		rst=0;
		while(dataleft>0)
		{
			rst=recv(sock,pPackage2,dataleft,0);
			dataleft-=rst;
			pPackage2+=rst;
		}

		dataleft=ImageSize;
		rst=0;
		while(dataleft>0) //发送图片
		{
			rst=send(sock,pSendPic,ImageSize,0);
			dataleft-=rst;
			//pSendPic+=rst;
		}

		fclose(picFileA);
		i++;
		//pPathArr++;
		//for(int memIndex=0;memIndex<ImageSize;memIndex++)//正确释放为图片申请的动态缓冲空间
		//{
		//	pSendPic[memIndex]=0;
		//}
		CMDPACKAGE package3;
		memset(&package3,0,sizeof(CMDPACKAGE));
		strcpy(package3.head,"RECVPIC");
		dataleft=sizeof(CMDPACKAGE);
		char *pPackage3=(char*)&package3;
		rst=0;
		while(dataleft>0)
		{
			rst=recv(sock,pPackage3,dataleft,0);
			dataleft-=rst;
			pPackage3+=rst;
		}
		delete [] pSendPic;
	}

//查看相册代码如下：
while(invariable+1>picNameIndex)
	{
		SENDPICINFO picInfo;
		memset(&picInfo,0,sizeof(picInfo));
		int dataleft=sizeof(picInfo);
		char *pPicInfo=(char*)&picInfo;
		int rst=0;
		while(dataleft>0)
		{
			rst=recv(sock,pPicInfo,dataleft,0);
			dataleft-=rst;
			pPicInfo+=rst;
		}
		if(picInfo.photoSize==0)
		{
			//不会有图片传来，退出接收
			break;
		}
		CMDPACKAGE package3;
		memset(&package3,0,sizeof(CMDPACKAGE));
		strcpy(package3.head,"RECVPICHEAD");
		dataleft=sizeof(CMDPACKAGE);
		char *pPackage3=(char*)&package3;
		rst=0;
		while(dataleft>0)
		{
			rst=send(sock,pPackage3,dataleft,0);
			dataleft-=rst;
			pPackage3+=rst;
		}
		FILE *picFile=NULL;
		char *picBuff = new char[picInfo.photoSize];
		photoFullPath.Format(".\\TempData\\picData\\%d%d.jpg",curPage,picNameIndex);
		fileName+=photoFullPath;
		fileName=fileName+"?";

		picFile=fopen(photoFullPath,"w+b");
		
		dataleft=picInfo.photoSize;
		rst=0;
		char *pBeginAddr=picBuff;
		while(dataleft>0)
		{
			rst=recv(sock,picBuff,dataleft,0);
			dataleft-=rst;
			//picBuff+=rst;
		}
		fwrite(pBeginAddr,sizeof(char),picInfo.photoSize,picFile);
		
		CMDPACKAGE package2;
		dataleft=sizeof(CMDPACKAGE);
		memset(&package2,0,sizeof(CMDPACKAGE));
		strcpy(package2.head,"RECV");
		char *pPackage2=(char*)&package2;
		rst=0;
		while(dataleft>0)
		{
			rst=send(sock,pPackage2,dataleft,0);
			dataleft-=rst;
			pPackage2+=rst;
		}
		delete [] picBuff;
		pBeginAddr=NULL;
		picNameIndex++;
		fclose(picFile);
	}

有劳了，苦等各位解释原因。。。