equivilent of _msize() for a pointer not dynamically allocated

I am making a find and replace function for strings, and need to make a temporary buffer within the function. I want someone calling this function to be able to send in any wchar_t pointer, as long as it has enough space to hold the result of the replacing.

Id like a caller to be able to use it like this if they want.

wchar_t mbuff [1024];
wchar_t * msrc = mbuff;
wcscpy (msrc,L"Text to replace some words in.");
wcsrpl (msrc,L"some",L"any");

//3 parameter UNICODE version of find and replace (requires src to be allocated via malloc)
wchar_t * wcsrpl (wchar_t * src //source
,const wchar_t * fnd //find
,const wchar_t * rpl //replace
)
{
wchar_t *dp = (wchar_t *) src;
wchar_t *nsrc,*cp;
wchar_t *s1, *s2, *s3;
nsrc = ( wchar_t * ) malloc ( _msize ( src ) );
cp = nsrc;
wcscpy (cp,src); //copy the source into a temp buffer, now the buffer will
//serve as the source and src will become our destination
while (*cp) // loop through the source text until null termination
{
s1 = cp;
s2 = (wchar_t *) fnd;
while ( *s1 && *s2 && !(*s1-*s2) ) //check for possible match of find word
s1++,s2++;
if (!*s2) //if the whole find word was found
{ //process replacing
s3 = (wchar_t *) rpl;
s2 = (wchar_t *) fnd;
while (*s3)
*dp++ = *s3++; //copy the replace word into destination
while (*s2)
cp++,s2++; //advance the source pointer past the find word
}
else //if find word was not found
{
*dp++ = *cp++; //copy source into destination
}
}
*dp = L'\0'; //null terminate the destination
free (nsrc); //free temporary buffer
return src;
}