scanf is reading characters from stdin and storing them in the memory that n points to. You haven't initialized n to point to anything, so scanf is probably trying to store your input in some arbitrary location in memory. You're lucky that it crashed rather than quietly acting as if it were working correctly.
Returning a string from a C function is more complex than you might expect.
There are (at least) three general approaches:
Require the caller to pass in a pointer to (the first element of) an array into which the string is to be stored, along with another argument telling the function how big the array is. This can require error handling if the array isn't big enough to hold the result.
Declare a static array inside the function and return a pointer to it. (You can't return a pointer to a non-static local array, since the array ceases to exist when the function returns.) Problems: Multiple calls use the same storage space (particularly problematic in the presence of threading), and the allocated size is fixed.
Allocate the result inside the function using malloc(). This requires the caller to free() the result.
Recommended reading: the comp.lang.c FAQ. In particular, question 7.5b is nearly a direct answer to your question (and would have saved me some typing if I'd realized it earlier). (I don't usually link to individual questions because I like to encourage people to browse.)
EDIT: Also, scanf with an unqualified "%s" format is inherently unsafe. It will attempt to store however many characters are entered in the array; there's no way to avoid buffer overruns (say, if your cat sits on the keyboard). @Artefacto referred to this problem in the link in the comment.
scanf()(linked by @Artefacto), usefgets()instead ideone.com/oUAbk