I had the habit for a while to call malloc on anything. Then it dawned to me if there’s no performance critical section of the code, why not use a couple of kilobytes more on an automatic and lose the accuracy of the amount of memory I need (potentially) of the malloc procedure? That way with no noticeable impact one can make much more readable code. e.g. copying temporarily a string for manipulating it in a function that is called very rarely.
Is my logic sound?
Local variables are stored on the stack, which is limited. malloc() allocates memory from the heap, which is also limited but contains far more memory.
I generally do not use malloc() unless the amount of memory would exceed what I could safely store on the stack.
For Windows development, the stacks are normally pretty large. You could store a buffer of up to a couple of hundred bytes without too much trouble (assuming the function would never be called recursively).
But, generally, if I need more than, say, 50 bytes, I would normally use malloc().