If you are interested, you can see PoC of my idea here: https://www.codewars.com/kata/reviews/5e072bf6bb26620001ec1da9/groups/5f458d53e0be5a0001d0e55d

I also agree about leaving the allocating to the caller - but this is not (?) realizable within this Kata.

Unfortunately, not.

I am not a professional C developer, nor embedded developer, but I do not like your approach either. First of all, length of resulting string can be calculated exactly, going once over the string. Just use newLen = strlen(input) - count('#') (handling #s close to the beginnig of the string appropriately). If, for some reason, you want to really avoid over-allocations, then calculate length of the result first, and fill in the buffer later. Nothing gets wasted this way, on no stage of the operation. Your solution needs twice as much memory at some point, because for short time it keeps initially allocated "too long" string, and later allocates a buffer of "appropriate" length, having two buffers. You can avoid it by expense of precalculating the required length.

Other thing is that allocating the buffer inside of solution is not that good in itself. I think it would be better to make allocation responsibility of the caller (after all, caller becomes the owner of the buffer anyway), and caller could even use some kind of preallocated memory pool to keep the result and avoid necessity of freeing it, or avoid problems with memory fragmentation, etc.