A Pointer-Ownership Model for C Inspired by Rust