how to create a substring without using malloc()

How can I implement a substring function such as the following that returns the substring but without using malloc() in the process so I don't have to worry about freeing the associated memory elsewhere in my code using the free() function. Is this even possible?

const char *substring(const char *string, int position, int length)
{
    char *pointer;
    int c;

    pointer = malloc(length+1);

    if (pointer == NULL)
    {
        printf("Unable to allocate memory.\n");
        exit(EXIT_FAILURE);
    }

    for (c = 0 ; c < position -1 ; c++)
        string++;

    for (c = 0 ; c < length ; c++)
    {
        *(pointer+c) = *string;
        string++;
    }

    *(pointer+c) = '\0';

    return substr;
}

UPDATE: 30 DEC 2012

Having considered all the answers and comments it's clear that essentially what I'm trying to do is create a dynamically sized array (i.e. the substring) and that is not possible in C without somewhere along the way having to use some kind of malloc() function and a subsequent free() call on the substring pointer or without the aid of a garbage collector. I attempted to integrate the libgc garbage collector as kindly suggested by @elhadi but so far have not been able to get this to work in my Xcode project. So I have opted to stick with using the following code with malloc() and free().

char * subStr(const char* srcString, const int offset, const int len)
{
    char * sub = (char*)malloc(len+1);
    memcpy(sub, srcString + offset, len);
    sub[len] = 0;
    return sub;
}

int main()
{    
    const char * message = "hello universe";
    char * sub = subStr( message, 6, 8 );
    printf( "substring: [%s]", sub );
    free(sub);
}

Solution

Use a local buffer (an auto array) and a function like this:

void substr(char *dst, const char *src, size_t loc, size_t len)
{
    memcpy(dst, src + loc, len);
    dst[len] = 0;
}

Call it like this:

const size_t size = 3;
char buf[size + 1]; // this is an auto array, it will be "freed" at the end of the scope
substr(buf, "abcdFOObar", 4, size);

Always ensure the buffer is at least len + 1 bytes long to avoid buffer overflow errors.