I'm wondering if part of your problem has to do with "returns address of local variable"...anyway, if you know that your string is not going to exceed a certain size, rather than returning a malloc'd pointer, you can pass the string in as an argument instead. Even with with malloc, this may be easier since then string will be allocated and free'd in the same place:
Code:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void substring (char *string, char *substr, int numchars) {
strncpy(substr,string,numchars);
substr[numchars+1]='\0';
}
int main() {
char string[]="ciao mondo sergio", sub[6],
*sub2=malloc(7);
substring(&string[11],sub,6); // without malloc
printf("%s\n",sub);
substring(&string[5],sub2,5); // with malloc...
printf("%s\n",sub2);
free(sub2); // ...free when finished
return 0;
}
Output:
Notice the string is passed in starting with the address of the first character of the substring, rather than using int start (a possibility).
Of course in my example, function substring() ends up being an anagram of strncpy, but hopefully there's something here you can use.