<p>I have a dll that must be useable from C etc, so I cant use string objects etc as a normal would, but I'm not sure on how to do this safely..</p>

<pre><code>const char *GetString()
{
    std::stringstream ss;
    ss &lt;&lt; "The random number is: " &lt;&lt; rand();
    return ss.str().c_str();
}
</code></pre>

<p>could the c string be destroyed when ss falls off the stack? I'm  assuming so...</p>

<p>Another option may be to create a new string on the heap, but what is going to deallocate that?</p>

<pre><code>const char *GetString()
{
    std::stringstream ss;
    ss &lt;&lt; "The random number is: " &lt;&lt; rand();
    char *out = new char[ss.str().size()];
    strcpy(ss.str().c_str(), out);
    return out;//is out ever deleted?
}
</code></pre>

<p>The same goes for pointers to other things as well as strings.</p>

The first would actually not work because the stringstream deallocates it's space on destruction. So if you try to de-reference that pointer there is a good chance that your program would crash.
The second option you mention is how it's usually done and the user of the function is required to deallocate the space. IIf this is a C program which uses the function make sure you allocate with malloc() and free with free()
Another option is to return an address of a static char array. This is relevant if you know in advance a good upper bound to the length. More importantly this should be used ONLY if there is no chance that the function is going to be called from two different threads at the same time because using a static array essentially makes your function non-
reentrant
.