MSC13-C. Detect and remove unused values

The presence of unused values may indicate significant logic errors. To prevent such errors, unused values should be identified and removed from code.

This recommendation is a specific case of MSC12-C. Detect and remove code that has no effect.

Noncompliant Code Example

In this example, p2 is assigned the value returned by bar(), but that value is never used. Note this example assumes that foo() and bar() return valid pointers (see DCL30-C. Declare objects with appropriate storage durations).

int *p1, *p2;
p1 = foo();
p2 = bar();

if (baz()) {
  return p1;
}
else {
  p2 = p1;
}
return p2;

Compliant Solution

This example can be corrected many different ways depending on the intent of the programmer. In this compliant solution, p2 is found to be extraneous. The calls to bar() and baz() can be removed if they do not produce any side effects.

int *p1 = foo();

/* Removable if bar() does not produce any side effects */
(void)bar();

/* Removable if baz() does not produce any side effects */
(void)baz();
return p1;

Risk Assessment

Unused values may indicate significant logic errors.

Automated Detection

The LDRA tool suite Version 7.6.0 can detect violations of this recommendation.

The Coverity Prevent Version 5.0 UNUSED_VALUE checker finds variables that are assigned pointer values returned from a function call but never used.

Klocwork can detect violations of this rule with a number of checkers.  See Klocwork Cross Reference

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as MSC13-CPP. Detect and remove unused values.

References

[Coverity 07]
[ISO/IEC PDTR 24772] "BRS Leveraging human experience," "KOA Likely incorrect expressions," "XYQ Dead and Deactivated Code," and "XYR Unused Variable"

MSC12-C. Detect and remove code that has no effect      49. Miscellaneous (MSC)