The last strncat at line 44 (which copy the remainder of the string after all replacement has been applied) should be:
strncat(result, pos, strlen(pos));
instead of the current one:
strncat(result, pos, (str - pos));
where size always evaluate to a negative value (since pos >= str) which when casted to size_t (unsigned) results in a big number, leading to unpredictable strncat behaviour.
The last strncat at line 44 (which copy the remainder of the string after all replacement has been applied) should be:
strncat(result, pos, strlen(pos));instead of the current one:
strncat(result, pos, (str - pos));where size always evaluate to a negative value (since pos >= str) which when casted to size_t (unsigned) results in a big number, leading to unpredictable strncat behaviour.