First of all in line int fun(int *p) it should be int fun(int *p1) Edit done
Now str is pointer to string constant which is typecasted to integer pointer in fun(int *p1) therefore p1 and p2 are both integer pointers.
Line while(*++p1); incements p1 pointer 2 bytes everytime till we reach the null value = 0 and this loop terminates.
p2-p1 = {addressof(p2) - address of(p1) } / 2 since integer occupies two bytes
p2 - p1 = -3 // p2 is at lower address and p1 is at higher address
-3 is returned and printed