The first one resides in the current function's call stack. The second one resides in the heap.
The first one goes out of scope when the function returns, the second persists until free()
is called on the address.
More differences, but I defer to the duplicate found by lethal-guitar instead of adding to my answer.