Polymorphism with overrides and base calls simulating an employee
There is one thing I don't line about Employee: you are leaking memory.

Person super; should be a pointer, not the object. You are creating the
object with malloc, by doing

    employee-&gt;super = *Person_new(first, last);


you are leaking memory because you lose the reference of the pointer returned
by malloc and you cannot free it when you destroy the object. And you are not
checking if malloc is returning 0. So I'd change it to:

typedef struct Employee Employee;
struct Employee {
    Person super;
    char* company;
    int salary;
    Person *super_ref;
};

Person* Employee_new(char* first, char* last, char* company, int salary) {
    Employee* employee = malloc(sizeof(Employee));
    if(employee == NULL)
        return NULL;

    employee-&gt;super_ref = *Person_new(first, last);
    if(employee-&gt;super_ref == NULL)
    {
        free(employee);
        return NULL;
    }

    employee-&gt;super = *employee-&gt;super_ref;
    employee-&gt;super.display = display; // override

    employee-&gt;company = company;
    employee-&gt;salary = salary;

    return (Person *)employee;
}


so now the destroy method can do free(obj-&gt;super_ref); to free the memory of
the base object.

edit

An alternative is that you create a init function for Person objects that gets
an object as an argument and does not allocate memory by itself. I'd do:

int Person_init(Person *self, char* first, char* last))
{
    if(self == NULL || first == NULL || last == NULL)
        return NULL;

    self-&gt;first = first;
    self-&gt;last = last;
    self-&gt;display = display;

    self-&gt;base = self; // assigning reference to self to retain original functions in case they get overriden

    return 1;
}

Person* Person_new(char* first, char* last) {
    Person* self = malloc(sizeof *self);

    if(self == NULL)
        return NULL;

    if(Person_init(self, first, last) == 0)
    {
        free(self);
        return NULL;
    }

    return self;
}


and for the Employee class

Person* Employee_new(char* first, char* last, char* company, int salary) {
    if(first == NULL || last == NULL || company == NULL)
        return NULL;

    Employee* employee = malloc(sizeof *employee);
    if(employee == NULL)
        return NULL;

    if(Person_init(&amp;employee-&gt;super, first, last) == 0)
    {
        free(employee);
        return NULL;
    }
    employee-&gt;super.display = display; // override

    employee-&gt;company = company;
    employee-&gt;salary = salary;

    return (Person *)employee;
}


Then you don't have to worry about freeing the base object.



edit2

*OP said in the comments**


  I'm wondering what's wrong with the freeing the base pointer, I'm assigning it right away to the new value free(&amp;employee-&gt;super); employee-&gt;super = *super;


Sorry, it seem to me you don't have a real understanding of memory managment and
what the * dereferencing operator does.

First of all, you have no guarantee that after free(ptr) you can access
the contents of ptr. After the free, ptr points to an invalid location and
accessing/dereferencing it is undefined behaviour.

Secondly

employee-&gt;super = *Person_new(first, last);


is the same as doing

Person *tmp = Person_new(first, last);
employee-&gt;super = *tmp;


*tmp is dereferencing tmp, the type is Person not Person*. In C when you
do an assigment with struct objects (not pointers) you are copying bit by bit
the bit pattern into a new object. That means that the bit pattern of
employee-&gt;super is the same as the bit pattern of *tmp, but they are not
the sam object, the reside at different places in memory.

You can only call free(ptr) when ptr stores the address returned by either
malloc or realloc. If you do free(&amp;employee-&gt;super) you are passing a
completely different address to that one that malloc returned in Person_new,
this is undefined behaviour, you cannot do that.

There is no other way for you, you have to store the original pointer in the
struct, that's the reason why I added the Person *super_ref in the struct, so
that the original pointer is not lost.


  We have a major problem, this implementation is causing recursion at 


I made small changes to your code, I don't have this problem:

#include &lt;stdlib.h&gt;
#include &lt;stdio.h&gt;
#include &lt;stddef.h&gt;

typedef struct Person Person;
typedef struct Person {
    Person *base; // reference to itself to retain reference to original function
    char* first;
    char* last;
    void (*display)(const Person *self);
    void (*destroy)(Person *self);
} Person;
Person* Person_new(char* first, char* last);

static void display(const Person *self) {
    printf("First: %s\n", self-&gt;first);
    printf("Last: %s\n", self-&gt;last);
}

static void destroy_person(Person *self)
{
    if(self == NULL)
        return;

    free(self);
}

Person* Person_new(char* first, char* last) {
    Person* self = malloc(sizeof(Person));
    self-&gt;first = first;
    self-&gt;last = last;
    self-&gt;display = display;
    self-&gt;destroy = destroy_person;

    self-&gt;base = self; // assigning reference to self to retain original functions in case they get overriden

    return self;
}

typedef struct Employee Employee;
struct Employee {
    Person super;
    char* company;
    int salary;
};
Person* Employee_new(char* first, char* last, char* company, int salary);

static void display2(const Person* self) {
    self-&gt;base-&gt;display(self-&gt;base);

    Employee *e = (Employee*) self;

    printf("Company: %s\n", e-&gt;company);
    printf("Salary: %d\n", e-&gt;salary);
}

static void destroy_employee(Person *self)
{
    if(self == NULL)
        return;

    if(self-&gt;base)
        self-&gt;base-&gt;destroy(self-&gt;base);

    free(self);
}

Person* Employee_new(char* first, char* last, char* company, int salary) {
    Employee* employee = malloc(sizeof(Employee));

    employee-&gt;super = *Person_new(first, last);
    employee-&gt;super.display = display2; // override
    employee-&gt;super.destroy = destroy_employee; // override


    employee-&gt;company = company;
    employee-&gt;salary = salary;

    return (Person*) employee;
}


int main(void)
{
    Person* person = Person_new("John", "Doe");
    Person* employee = Employee_new("Jane", "Doe", "Acme", 40000);
    person-&gt;display(person); 
    puts("---");
    employee-&gt;display(employee);

    person-&gt;destroy(person);
    employee-&gt;destroy(employee);

}


It prints

$ ./b 
First: John
Last: Doe
---
First: Jane
Last: Doe
Company: Acme
Salary: 40000


edit3

The fact that my little changes do not have the problem of endless recursion in
display2 kept me thinking about it and I've been running the code with the
debugger to see why I didn't have the problem as well. And now I understand why
my code does not have that problem, and your's shouldn't have that as well. In
fact, I realized that there is a way of freeing the memory correctly without
have a separate member like super_ref.

Let me explain:

In Employee_new you do:

employee-&gt;super = *Person_new(first, last);
employee-&gt;super.display = display2; // override


I told you that you would be leaking memory because you lose the original
pointer that malloc returns. And that is true, however I failed to realize
that you have in fact a pointer pointing to the original address that malloc
returns: the base member of the Person struct. In Person_new you do

self-&gt;base = self;


and this solves the problem with the overloading and the freeing, even though we
both didn't realize it at the time.

So again, when you do

employee-&gt;super = *Person_new(first, last);


you are dereferencing the pointer returned by malloc and making a copy of the
object into another object. But I failed to realize is that
employee-&gt;super-&gt;base points to the original location returned by malloc.
So when you do

employee-&gt;super.display = display2; // override


you are indeed setting a new value to employee-&gt;super.display, but because
employee-&gt;super is just a copy, the original does not change and with
employee-&gt;super-&gt;base you get the orginal object.

That's why 

static void display2(const Person* self) {
    self-&gt;base-&gt;display(self-&gt;base);
    ...
}


shouldn't do end in a recursion, because self-&gt;display points to display2,
but self-&gt;base-&gt;display is still unchanged and points to display.

And now you can use the same behaviour for destroying the Employee object.
Let's say you have destroy function pointer in Person which points to the
destroy function:

void destroy_person(Person *person)
{
    if(person == NULL)
        return NULL;

    free(person);
}


and in Person_new you add:

self-&gt;destroy = destroy_person;


Now you can destroy a person object by doing person-&gt;destroy(person);.

The destroy for Employee will look similar to display2:

void destroy_employee(Person *self)
{
    if(self == NULL)
        return;

    if(self-&gt;base)
        self-&gt;base-&gt;destroy(self-&gt;base);

    free(self);
}


because self-&gt;base is still pointing to the original object,
self-&gt;base-&gt;destroy points to destroy_person. Now in
Employee_new you have to add

employee-&gt;super.display = display2; // override
employee-&gt;super.destroy = destroy_employee; // override


and in main you just do person-&gt;destroy(person) and
employee-&gt;destroy(employee);. I've checked the code above (I've updated with
the destroy functions) with valgrind and it told me that everything was freed
correctly.