...
Assuming a conforming implementation, eliminating diagnostic messages will eliminate any violation of syntax rules or other constraints.
If suitable source code-checking tools are available, use them regularly.
Exceptions
| Wiki Markup |
|---|
Compilers can produce diagnostic messages for correct code. This is permitted by C99 \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\], which allows a compiler to produce a diagnostic for any reason. It is usually preferable to rewrite code to eliminate compiler warnings, but if the code is correct it is sufficient to provide a comment explaining why the warning message does not apply. Some compiler provide ways to suppress warnings, for example, suitably-formatted comments or pragmas, which can be used sparingly when the programmer understands the implications of the warning but has good reason to use the flagged construct anyway. |
Do not simply quiet warnings, for example, by adding typecasts. Instead, understand the reason for the warning and to consider a better approach, for example, use matching types. Use typecasts sparingly, and only when there is no sensible alternative.
Risk Assessment
Eliminating violations of syntax rules and other constraints can eliminate serious software vulnerabilities that can lead to the execution of arbitrary code with the permissions of the vulnerable process.
...
| Wiki Markup |
|---|
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 5.1.1.3, "Diagnostics" \[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 563|http://cwe.mitre.org/dataorgdata/definitions/563.html], "Unused Variable"; [CWE ID 570|http://cwe.mitre.org/data/definitions/570.html], "Expression is Always False"; [CWE ID 571|http://cwe.mitre.org/data/definitions/571.html], "Expression is Always True" \[[Sutter 05|AA. C References#Sutter 05]\] Item 1 \[[Seacord 05|AA. C References#Seacord 05]\] Chapter 8, "Recommended Practices" |
...