SDL compliance

[asklar]

There are a bunch of warnings that are being suppressed (esp in RN core and folly).
We should identify them, and fix them.

[chrisglein]

@asklar can you include a list of the current warnings?
If there are different warning levels being applied we're going to have difficulty with dependencies regressing these. We'll still need to fix them, but what process should we use for finding them earlier?
What warning level do we need to enforce? (there's likely multiple customers with different needs here, but can we raise the baseline upstream?)

[asklar]

https://osgwiki.com/wiki/Compiler_Warnings_(Debt_Type)

Build environments configured with the Visual Studio C/C++ compiler must be configured with the required compiler warnings. All security related warnings as defined below must be fixed.

Enable level 3 warnings by setting the /W3 flag. Triage and fix all warnings.

Enable the following mandatory warnings. All mandatory warnings must be fixed.

• C4018 - 'expression' : signed/unsigned mismatch
• C4055 - 'conversion' : from data pointer 'type1' to function pointer 'type2'
• C4146 - unary minus operator applied to unsigned type, result still unsigned
• C4242 - 'identifier' : conversion from 'type1' to 'type2', possible loss of data
• C4244 - 'conversion' conversion from 'type1' to 'type2', possible loss of data
• C4267 - 'var' : conversion from 'size_t' to 'type', possible loss of data
• C4302 - 'conversion' : truncation from 'type 1' to 'type 2'
• C4308 - negative integral constant converted to unsigned type
• C4509 - nonstandard extension used: 'function' uses SEH and 'object' has destructor
• C4510 - 'class' : default constructor could not be generated
• C4532 - 'continue' : jump out of __finally/finally block has undefined behavior during termination handling
• C4533 - initialization of 'variable' is skipped by 'instruction'
• C4610 - object 'class' can never be instantiated - user-defined constructor required
• C4611 - interaction between 'function' and C++ object destruction is non-portable
• C4700 - uninitialized local variable 'name' used
• C4701 - Potentially uninitialized local variable 'name' used
• C4703 - Potentially uninitialized local pointer variable 'name' used
• C4789 - destination of memory copy is too small
• C4995 - 'function': name was marked as #pragma deprecated
• C4996 - 'function': was declared deprecated also 'std::': Function call with parameters that are potentially unsafe - this call relies on the caller to check that the passed values are correct. To disable this warning, use -D_SCL_SECURE_NO_WARNINGS. See documentation on how to use Visual C++ 'Checked Iterators'

[JunielKatarn]

Should we perhaps add this list to the MSRN docs?

If we wanted to go crazy, we could even add some MSBuild trigger that made sure those are not disabled (withing MSBuild files).

[acoates-ms]

This should fix a bunch of the errors in particular 4244 and 4267
facebook/react-native#31002