I had a few questions regarding the way the program was posted by the op

ptr = (char*)malloc(2);

Now this allocates 2 bytes in memory but ptr can hold the address of only the first byte as its a char pointer.
ptr holds the address of one byte, but you still have room to add 2 bytes.
Code:
ptr = (char*)malloc(2); // Note that the cast to char* is not needed
ptr[0] = 'a';
ptr[1] = 'b';
ptr[2] = 'c'; // BAD, you only have room for 2 chars -- not 3! 

or you can do...

ptr = (char*)malloc(2);
*ptr = 'a';
ptr++;
*ptr = 'b';