why static char out[0]; does not throws warning
This is undefined behavior to specify a zero sized array and the compiler is not obligated to produce a diagnostic in such cases. If we look at the C99 draft standard section 6.7.5.2 Array declarators paragraph 1 says(emphasis mine):
[..]If they delimit an expression (which specifies the size of an array), the
expression shall have an integer type. If the expression is a constant expression, it shall have a value greater than zero.[...]
Although gcc will warn you in this case if you use the -pedantic flag, I receive the following warning:
warning: ISO C forbids zero-size array ‘out’ [-pedantic]
If it also undefined to access an array out of bounds and the same applies here about warnings.
if we look at the definition of undefined behavior in section 3.4.3 in paragraph 2 says(emphasis mine):
NOTE Possible undefined behavior ranges from ignoring the situation completely with unpredictable results, to behaving during translation or program execution in a documented manner characteristic of the environment (with or without the issuance of a diagnostic message), to terminating a translation or execution (with the issuance of a diagnostic message).
Using a static variable for the output is a problematic design, it means that every caller to that method will share the same output. A better choice would be to use malloc to dynamically allocate memory which means you do have to remember to free the memory after you are done.