The s pointer itself is on the stack.
Everything else is on the heap.

And s->c = 'a'; is a bug.