How do I write a C function that returns a variable-length string?

You can try like this:

char *myFunction(void)
{
    char *word;
    word = malloc (sizeof (some_random_length));
    //add some random characters

    return word;
}

You can also refer related thread: best practice for returning a variable length string in c

The typical way to do this in C, is not to return anything at all:

void func (char* buf, size_t buf_size, size_t* length);

Where buf is a pointer to the buffer which will hold the string, allocated by the caller. buf_size is the size of that buffer. And length is how much of that buffer that the function used.

You could return a pointer to buf as done by for example strcpy. But this doesn't make much sense, since the same pointer already exists in one of the parameters. It adds nothing but confusion.

(Don't use strcpy, strcat etc functions as some role model for how to write functions. Many C standard library functions have obscure prototypes, because they are so terribly old, from a time when good programming practice wasn't invented, or at least not known by Dennis Ritchie.)

There are two common approaches:

One is to have a fixed size buffer to store the result:

int makeFullPath(char *buffer,size_t max_size,...)
{
    int actual_size = snprintf(buffer,max_size,...);
    return actual_size;
}

Examples of standard functions which use this approach are strncpy() and snprintf(). This approach has the advantage that no dynamic memory allocation is needed, which will give better performance for time-critical functions. The downside is that it puts more responsibility on the caller to be able to determine the largest possible result size in advance or be ready to reallocate if a larger size is necessary.

The second common approach is to calculate how big of a buffer to use and allocate that many bytes internally:

// Caller eventually needs to free() the result.
char* makeFullPath(...)
{
    size_t max_size = calculateFullPathSize(...);
    char *buffer = malloc(max_size);
    if (!buffer) return NULL;
    int actual_size = snprintf(buffer,max_size,...);
    assert(actual_size<max_size);
    return buffer;
}

An example of a standard function that uses this approach is strdup(). The advantage is that the caller no longer needs to worry about the size, but they now need to make sure that they free the result. For a kernel module, you would use kmalloc() and kfree() instead of malloc() and free().

A less common approach is to have a static buffer:

const char *makeFullPath(char *buffer,size_t max_size,...)
{
    static char buffer[MAX_PATH];
    int actual_size = snprintf(buffer,MAX_PATH,...);
    return buffer;
}

This avoids the caller having to worry about the size or freeing the result, and it is also efficient, but it has the downside that the caller now has to make sure that they don't call the function a second time while the result of the first call is still being used.

char *result1 = makeFullPath(...);
char *result2 = makeFullPath(...);

printf("%s",result1);
printf("%s",result2); /* oops! */

Here, the caller probably meant to print two separate strings, but they'll actually just get the second string twice. This is also problematic in multi-threaded code, and probably unusable for kernel code.

For example:

char * fn( int file_id )
{
  static char res[MAX_PATH];

  // fill res[]
  return res;
}

/*
let do it the BSTR way (BasicString of VB)
*/
char * CopyString(char *str){
    unsigned short len;
    char *buff;
    len=lstrlen(str);
    buff=malloc(sizeof(short)+len+1);
    if(buff){
        ((short*)buff)[0]=len+1;
        buff=&((short*)buff)[1];
        strcpy(buff,str);
    }

    return buff;

}

#define len_of_string(s)    ((short*)s)[-1])
#define free_string(s)        free(&((short*)s)[-1]))

int main(){
    char *buff=CopyString("full_path_name");
    if(buff){
        printf("len of string= %d\n",len_of_string(buff));
        free_string(buff);
    }else{
        printf("Error: malloc failed\n");
    }
    return 0;

}

/*
    now you can imagine how to reallocate the string to a new size
*/