Why do we use zero length array instead of pointers?

It's said that zero length array is for variable length structure, which I can understand. But what puzzle me is why we don't simply use a pointer, we can dereference and allocate a different size structure in the same way.

EDIT - Added example from comments

Assuming:

struct p
{
    char ch;
    int *arr;
};

We can use this:

struct p *p = malloc(sizeof(*p) + (sizeof(int) * n));

p->arr = (struct p*)(p + 1);

To get a contiguous chunk of memory. However, I seemed to forget the space p->arr occupies and it seems to be a disparate thing from the zero size array method.

Solution

These are various forms of the so-called "struct hack", discussed in question 2.6 of the comp.lang.c FAQ.

Defining an array of size 0 is actually illegal in C, and has been at least since the 1989 ANSI standard. Some compilers permit it as an extension, but relying on that leads to non-portable code.

A more portable way to implement this is to use an array of length 1, for example:

struct foo {
    size_t len;
    char str[1];
};

You could allocate more than sizeof (struct foo) bytes, using len to keep track of the allocated size, and then access str[N] to get the Nth element of the array. Since C compilers typically don't do array bounds checking, this would generally "work". But, strictly speaking, the behavior is undefined.

The 1999 ISO standard added a feature called "flexible array members", intended to replace this usage:

struct foo {
    size_t len;
    char str[];
};

You can deal with these in the same way as the older struct hack, but the behavior is well defined. But you have to do all the bookkeeping yourself; sizeof (struct foo) still doesn't include the size of the array, for example.

You can, of course, use a pointer instead:

struct bar {
    size_t len;
    char *ptr;
};

And this is a perfectly good approach, but it has different semantics. The main advantage of the "struct hack", or of flexible array members, is that the array is allocated contiguously with the rest of the structure, and you can copy the array along with the structure using memcpy (as long as the target has been properly allocated). With a pointer, the array is allocated separately -- which may or may not be exactly what you want.