This example works but I think that the memory leaks. Function used in the simple web server module and thus shared memory grows if you use this function.
One problem I can see is that if the replacement string contains the search string, you'll loop forever (until you run out of memory).
For example:
char *result = str_replace("abc", "a", "aa");
Also, doing another malloc/free every time you replace one instance is pretty expensive.
A better approach would be to do exactly 2 passes over the input string:
the first pass, count how many instances of the search string are present
now that you know how many matches, compute the length of your result & malloc once:
strlen(string) + matches*(strlen(replacement)-strlen(substr)) + 1
make a second pass through the source string, copying/replacing