Q:

how to create a substring without using malloc()

How can I implement a substring function such as the following that returns the substring but without using malloc() in the process so I don't have to worry about freeing the associated memory elsewhere in my code using the free() function.  Is this even possible?
const char *substring(const char *string, int position, int length)
{
    char *pointer;
    int c;

    pointer = malloc(length+1);

    if (pointer == NULL)
    {
        printf("Unable to allocate memory.\n");
        exit(EXIT_FAILURE);
    }

    for (c = 0 ; c < position -1 ; c++)
        string++;

    for (c = 0 ; c < length ; c++)
    {
        *(pointer+c) = *string;
        string++;
    }

    *(pointer+c) = '\0';

    return substr;
}

UPDATE: 30 DEC 2012
Having considered all the answers and comments it's clear that essentially what I'm trying to do is create a dynamically sized array (i.e. the substring) and that is not possible in C without somewhere along the way having to use some kind of malloc() function and a subsequent free() call on the substring pointer or without the aid of a garbage collector.  I attempted to integrate the libgc garbage collector as kindly suggested by @elhadi but so far have not been able to get this to work in my Xcode project.  So I have opted to stick with using the following code with malloc() and free(). 
char * subStr(const char* srcString, const int offset, const int len)
{
    char * sub = (char*)malloc(len+1);
    memcpy(sub, srcString + offset, len);
    sub[len] = 0;
    return sub;
}

int main()
{    
    const char * message = "hello universe";
    char * sub = subStr( message, 6, 8 );
    printf( "substring: [%s]", sub );
    free(sub);
}

A:

I see two options:
If you can destroy the source string (usually a bad thing):
{
    string[ position + length] = 0;
    return & string[ position ];
}

Note: (see Cole Johnsons note: free no longer works on the returned pointer!)
If you can't modify the source string:
Modify your methods signature so that the caller has to worry about it:
const char *substring(const char *source, char* destination, int position, int length)

And put the modified string into destination (and return it).
And do not even think about this:
const char *substring(const char *string, int position, int length)
{
    char *pointer;
    int c;
    static char modifiedString[256];
 ...
    return modifiedString;
}

Using a static variable inside the function for the modified results...
(This is not thread-safe (not re-entrant!) )

A:

Use a local buffer (an auto array) and a function like this:
void substr(char *dst, const char *src, size_t loc, size_t len)
{
    memcpy(dst, src + loc, len);
    dst[len] = 0;
}

Call it like this:
const size_t size = 3;
char buf[size + 1]; // this is an auto array, it will be "freed" at the end of the scope
substr(buf, "abcdFOObar", 4, size);

Always ensure the buffer is at least len + 1 bytes long to avoid buffer overflow errors.

