Deep copy a class having a self reference pointer

I have a class Employee with pointer variables tag and values of type char and a self reference pointer children. I have to allocate and deallocate memory. For this I'm trying to implement a copy constructor and a destructor. The problem I am facing is, I couldn't able to deep copy the whole class when it has the children var not NULL. I have tried using memcpy() and also the solution mentioned here. But I couldn't able to do it properly. When everything goes well it fails in destructor. What I have tried so far is:

#include<iostream>
#include<stdlib.h>
#include<string>
#include<map>
#define _CRT_SECURE_NO_WARNINGS
using namespace std;

class Employee
{
public:
    char* tag;
    char* value;
    int numAttributes;
    int numChildren;
    Employee* children;

    Employee(const Employee &attr)
    {
        cout << "Copy constructor called" << endl;

        numAttributes = attr.numAttributes;
        numChildren = attr.numChildren;

        tag = (char*)malloc(sizeof(char)*strlen(attr.tag) + 1);
        value = (char*)malloc(sizeof(char)*strlen(attr.value) + 1);
        strcpy(tag, attr.tag);
        strcpy(value, attr.value);

        if (attr.children == NULL)
            children = NULL;
        else
            children = attr.children; // shallow copy happening. Have to do deep copy if it has children
    }

    Employee(){
        cout << " constructor called" << endl;
        tag = NULL;
        value = NULL;
        children = NULL;
        numAttributes = 0;
        numChildren = 0;
    }
    ~Employee(){
        cout << "Destructor called" << endl;
        if (tag != NULL){
            free(tag);
            tag = NULL;
        }
        if (value != NULL){
            free(value);
            value = NULL;
        }
        if (children != NULL){
            free(children);
            children = NULL;
        }
    }

};

Employee createNode(const char* tag, const char* value, unsigned int numAttributes, unsigned int numChildren)
{
    Employee retNode;
    retNode.tag = (char*)malloc(sizeof(char)* (strlen(tag) + 1));
    strcpy(retNode.tag, tag);
    retNode.value = (char*)malloc(sizeof(char)* (strlen(value) + 1));
    strcpy(retNode.value, value);

    retNode.numAttributes = numAttributes;
    retNode.numChildren = numChildren;
//use this block if we are not initializing the children in the createOffset() method
        /*if (numChildren == 0){
        retNode.children = NULL;
        }
        else{
        retNode.children = (Employee*)malloc(sizeof(Employee)*numChildren);
        }*/

        return retNode;
    }
Employee createOffset()
{
    //Create and tag initial root node
    Employee retNode = createNode("offset", "value", 0, 1);

    retNode.children = (Employee*)malloc(sizeof(Employee)*retNode.numChildren);

    retNode.children[0] = createNode("prnt", "0000", 0, 0);

    return retNode; // Until here it is fine. This return calls the copy constructor first. As it has children the children must also be deep copied. Getting error here. Have to do deep copy the entire the class
}

Employee get(){

    return createOffset();
}

int main(){
    Employee node = get();
    getchar();
    return 0;
}