Passing the address of a dereferenced pointer to a string offset

Assuming there is a function like this

int foo (char** str, int x)
{
    char* p = *str + x;

    foo2(&p); // declared as int foo2 (char** );
}

(oversimplified of course, the real function is recursive and much more complicated)

I've tried to do this:

int foo (char** str, int x)
{    
    foo2(&(*str + x));
}

But the compiler failed with error:

error: lvalue required as unary '&' operand

Why did the compiler shoot out with this error and how do I pass the pointer to a pointer to string x-byte(s) forwards, without declaring a variable and use its own address?

EDIT

Seems like there is some misunderstanding so I will post a complete simulation of what I want to achieve.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char* string = "This is a sample string.";
char* ptr;
int randomizer;

int receive_string (char* buffer, int size) // recv
{
    int i = 0;

    if(ptr == NULL)
        ptr = string;

    for(i = 0; *ptr != '\0' && i < size; ptr++)
    {
        if(randomizer == 2)
        {
            randomizer++;

            break;
        }

        buffer[i] = *ptr;

        i++;

        randomizer++;
    }

    if(*ptr == '\0')
    {
        buffer[i] = *ptr;

        i++;
    }

    return i;
}

int read_string (char* *buffer, int size, int alloc)
{
    int bytes = 0;

    printf("Reading string..\n");

    if(*buffer == NULL && alloc == 1)
    {
        printf("Allocating buffer..\n");

        *buffer = calloc(size, sizeof(char));
    }

    bytes = receive_string(*buffer, size);

    if(bytes == (-1))
    {
        return(-1);
    }
    if(bytes == 0)
    {    
        return 0;
    }
    if(bytes < size)
    {
        char* p = *buffer + bytes;
        //int temp = read_string(&p, size - bytes, 0); // works
        //int temp = read_string(&(char *){&(*buffer)[bytes]}, size - bytes, 0); // works
        int temp = read_string(buffer + bytes, size - bytes, 0); // doesn't work

        if(temp > 0)
            bytes += temp;
        else return bytes;
    }

    return bytes;
}

int main()
{
    char* buffer = NULL;

    int bytes = read_string(&buffer, strlen(string) + 1, 1);

    printf("[%u][%s]\n", bytes, buffer);

    if(buffer)
        free(buffer);

    return 0;
}

The randomizer is the dumbest quickie to "simulate" a recv() that can not receive all bytes. This implementation simulates recv() but instead of reading from a socket queue it reads from a global string.