apart from several smaller bugs (sum is not initialized with zeroes, string is missing 1 byte for the nul-terminator), there is a more fundamental flaw in your approach: you split the strink into separate chunks with strtok(), and return one of those substrings. this means the returned pointer cannot be passed to free(), because it is no longer the original pointer that was allocated. this is why the code crashes.

char *ptr = malloc(100);
free(ptr + 1);

is undefined behavior, you must pass the original pointer

You can find some suggestions here.