为什么不能访问函数外的结构指针

描述问题:

任何尝试访问*(缓冲区+在此插入一些索引)->malloc函数之外的数据会导致以下错误

mem* demo = malloc(2);
if(*(demo+1)->data == 0x00) {
... do some stuff here 
}

kernel.c:96:21: error: invalid type argument of '->' (have 'int')
   96 |         if(*(demo+1)->data == 0x00) {

//Licensed under public domain
//also please note there is no standart library this is on a embedded system

typedef struct{
    _Bool allocated;
    unsigned char data;
} mem;
mem memory[1000];

mem* malloc(size_t size){
    mem* buffer[size];
    unsigned int successfulCounts = 0;
    unsigned int bufferCounter = 0;
    for(unsigned int i = 0; i < sizeof(memory); i++){
        //Hey that's available memory for us
        if(memory[i].allocated == 0){
            //because buffer is 16 4 items in memory (16*4)-15*4 can be found like this
            if(successfulCounts < sizeof(buffer)-sizeof(buffer-1)){
                *(buffer+successfulCounts) = &memory[i];
                successfulCounts++;
                memory[i].allocated = 1;
            }else{
                break;
            }
        }
    }
    return buffer;    
}


//... some more code that implements stuff like free() and calloc()

当函数中的mem*更改为无符号字符并返回时 *(buffer+1) 我可以出于某种奇怪的原因访问数据,我可以得到与我推送的数据完全相同的数据。没有任何东西像我预期的那样由于某种奇怪的原因而损坏