strange problem - char* method return

I am playing with hardware serial functions. Now I am stuck with a strange phenomena, relating to char array's and returning them in a method.

code:

const char CP_MARK = '

explanation to the serial dump:
available shows the queue length of the Serial Object.
the text after the ! sign is the same that i sent in the console (where i added $ marks at start + end)

output:

Sender ready
available:6
FOUND-START.....FOUND-END!asdf
aÀ
available:17
FOUND-START................FOUND-END!qwerqweqwerqwer
qwerqweqwer
available:10
FOUND-START.........FOUND-END!qwerqwer
qwer
available:6
FOUND-START.....FOUND-END!qwer
qÀ
available:3
FOUND-START..FOUND-END!q
q

why does a return of a char[] into a char* only work partially??;
const int CP_TIMEOUT = 100; //ms

char* received;
byte pos = 0;

void setup() {
 Serial.begin(9600);
 Serial.println("Sender ready");
}

void loop(){
 delay(1000);
 int a = Serial.available();
 if(a > 0){
   Serial.print("available:");
   Serial.println(a);
   received = receiveString(a);
   Serial.println(received);
 }
}

char* receiveString(byte length){
 char stringIn[length+1];
 char charIn;
 int i = 0;
 stringIn[i] = '\0';

unsigned long timeout = millis() + CP_TIMEOUT;

if(Serial.available() > 0) {
   charIn = Serial.read();
   if (charIn == CP_MARK){
     Serial.print("FOUND-START");
     while((millis() < timeout) && (i < length)) {
       if(Serial.available() > 0){
         Serial.print(".");
         charIn = Serial.read();
         if (charIn == CP_MARK){
           Serial.print("FOUND-END");
           break;
         }
         else {
           stringIn[i++] = charIn;
           stringIn[i] = '\0';
         }
       }
     }
   }
 }

// empty buffer
 while(Serial.available() > 0){
   Serial.read();
 }

Serial.print("!");
 Serial.println(stringIn);
 return stringIn;
}


explanation to the serial dump:
available shows the queue length of the Serial Object.
the text after the ! sign is the same that i sent in the console (where i added $ marks at start + end)

output:

§DISCOURSE_HOISTED_CODE_1§


why does a return of a char[] into a char* only work partially??

In the function, receiveString, stringIn is a local variable. It goes out of scope when the function ends. You return a pointer to memory that no longer is reserved. While the memory is still there, it is not reserved, so it is available for other functions to use and overwrite.

In a normal C function, you'd use malloc to reserve space, and return a pointer to that space. The reserved space does not go out of scope at the end of the function, so the pointer remains valid.

In C++, you'd use new to accomplish the same objective.

On the Arduino, while it is programmed in C++, the easiest solution is to use a global variable that does not go out of scope, and not have the function return a value.