I think this solution is flawed with two mistakes:

• r and s are allocated with length x, which is strlen(z) and it does not include terminating NULL character,
• s is not freed, resulting in memory leak.