ptr holds the address of one byte, but you still have room to add 2 bytes.I had a few questions regarding the way the program was posted by the op
ptr = (char*)malloc(2);
Now this allocates 2 bytes in memory but ptr can hold the address of only the first byte as its a char pointer.
Code:ptr = (char*)malloc(2); // Note that the cast to char* is not needed ptr[0] = 'a'; ptr[1] = 'b'; ptr[2] = 'c'; // BAD, you only have room for 2 chars -- not 3! or you can do... ptr = (char*)malloc(2); *ptr = 'a'; ptr++; *ptr = 'b';