Bug 1309068 - Enable -Wshadow, r=franziskus

70 files changed, 569 insertions, 591 deletions

diff --git a/cmd/bltest/blapitest.c b/cmd/bltest/blapitest.c
index ca3d6f314..ef8fdd802 100644
--- a/cmd/bltest/blapitest.c
+++ b/cmd/bltest/blapitest.c
@@ -3724,7 +3724,7 @@ main(int argc, char **argv)
     /* test the RSA_PopulatePrivateKey function */
     if (bltest.commands[cmd_RSAPopulate].activated) {
         unsigned int keySize = 1024;
-        unsigned long exponent = 65537;
+        unsigned long keyExponent = 65537;
         int rounds = 1;
         int ret = -1;
 
@@ -3735,12 +3735,12 @@ main(int argc, char **argv)
             rounds = PORT_Atoi(bltest.options[opt_Rounds].arg);
         }
         if (bltest.options[opt_Exponent].activated) {
-            exponent = PORT_Atoi(bltest.options[opt_Exponent].arg);
+            keyExponent = PORT_Atoi(bltest.options[opt_Exponent].arg);
         }
 
         for (i = 0; i < rounds; i++) {
             printf("Running RSA Populate test round %d\n", i);
-            ret = doRSAPopulateTest(keySize, exponent);
+            ret = doRSAPopulateTest(keySize, keyExponent);
             if (ret != 0) {
                 break;
             }
diff --git a/cmd/certutil/certutil.c b/cmd/certutil/certutil.c
index 20722ae78..92193369f 100644
--- a/cmd/certutil/certutil.c
+++ b/cmd/certutil/certutil.c
@@ -782,17 +782,17 @@ ValidateCert(CERTCertDBHandle *handle, char *name, char *date,
                 fprintf(stdout, "%s: certificate is valid\n", progName);
                 GEN_BREAK(SECSuccess)
             } else {
-                char *name;
+                char *nick;
                 CERTVerifyLogNode *node;
 
                 node = log->head;
                 while (node) {
                     if (node->cert->nickname != NULL) {
-                        name = node->cert->nickname;
+                        nick = node->cert->nickname;
                     } else {
-                        name = node->cert->subjectName;
+                        nick = node->cert->subjectName;
                     }
-                    fprintf(stderr, "%s : %s\n", name,
+                    fprintf(stderr, "%s : %s\n", nick,
                             SECU_Strerror(node->error));
                     CERT_DestroyCertificate(node->cert);
                     node = node->next;
@@ -999,7 +999,7 @@ DeleteKey(char *nickname, secuPWData *pwdata)
 
     slot = PK11_GetInternalKeySlot();
     if (PK11_NeedLogin(slot)) {
-        SECStatus rv = PK11_Authenticate(slot, PR_TRUE, pwdata);
+        rv = PK11_Authenticate(slot, PR_TRUE, pwdata);
         if (rv != SECSuccess) {
             SECU_PrintError(progName, "could not authenticate to token %s.",
                             PK11_GetTokenName(slot));
@@ -1066,7 +1066,7 @@ PrintBuildFlags()
 }
 
 static void
-PrintSyntax(char *progName)
+PrintSyntax()
 {
 #define FPS fprintf(stderr,
     FPS "Type %s -H for more detailed descriptions\n", progName);
@@ -1838,7 +1838,7 @@ luBuildFlags(enum usage_level ul, const char *command)
 }
 
 static void
-LongUsage(char *progName, enum usage_level ul, const char *command)
+LongUsage(enum usage_level ul, const char *command)
 {
     luA(ul, command);
     luB(ul, command);
@@ -1866,14 +1866,14 @@ LongUsage(char *progName, enum usage_level ul, const char *command)
 }
 
 static void
-Usage(char *progName)
+Usage()
 {
     PR_fprintf(PR_STDERR,
                "%s - Utility to manipulate NSS certificate databases\n\n"
                "Usage:  %s <command> -d <database-directory> <options>\n\n"
                "Valid commands:\n",
                progName, progName);
-    LongUsage(progName, usage_selected, NULL);
+    LongUsage(usage_selected, NULL);
     PR_fprintf(PR_STDERR, "\n"
                           "%s -H <command> : Print available options for the given command\n"
                           "%s -H : Print complete help output of all commands and options\n"
@@ -2269,10 +2269,10 @@ flagArray opFlagsArray[] =
       { NAME_SIZE(verify_recover), CKF_VERIFY_RECOVER },
       { NAME_SIZE(wrap), CKF_WRAP },
       { NAME_SIZE(unwrap), CKF_UNWRAP },
-      { NAME_SIZE(derive), CKF_DERIVE },
+      { NAME_SIZE(derive), CKF_DERIVE }
     };
 
-int opFlagsCount = sizeof(opFlagsArray) / sizeof(flagArray);
+int opFlagsCount = PR_ARRAY_SIZE(opFlagsArray);
 
 flagArray attrFlagsArray[] =
     {
@@ -2286,14 +2286,13 @@ flagArray attrFlagsArray[] =
       { NAME_SIZE(insensitive), PK11_ATTR_INSENSITIVE },
       { NAME_SIZE(extractable), PK11_ATTR_EXTRACTABLE },
       { NAME_SIZE(unextractable), PK11_ATTR_UNEXTRACTABLE }
-
     };
 
-int attrFlagsCount = sizeof(attrFlagsArray) / sizeof(flagArray);
+int attrFlagsCount = PR_ARRAY_SIZE(attrFlagsArray);
 
 #define MAX_STRING 30
 CK_ULONG
-GetFlags(char *flagsString, flagArray *flagArray, int count)
+GetFlags(char *flagsString, flagArray *flags, int count)
 {
     CK_ULONG flagsValue = strtol(flagsString, NULL, 0);
     int i;
@@ -2303,10 +2302,10 @@ GetFlags(char *flagsString, flagArray *flagArray, int count)
     }
     while (*flagsString) {
         for (i = 0; i < count; i++) {
-            if (strncmp(flagsString, flagArray[i].name, flagArray[i].nameSize) ==
+            if (strncmp(flagsString, flags[i].name, flags[i].nameSize) ==
                 0) {
-                flagsValue |= flagArray[i].value;
-                flagsString += flagArray[i].nameSize;
+                flagsValue |= flags[i].value;
+                flagsString += flags[i].nameSize;
                 if (*flagsString != 0) {
                     flagsString++;
                 }
@@ -2691,14 +2690,13 @@ certutil_main(int argc, char **argv, PRBool initialize)
     rv = SECU_ParseCommandLine(argc, argv, progName, &certutil);
 
     if (rv != SECSuccess)
-        Usage(progName);
+        Usage();
 
     if (certutil.commands[cmd_PrintSyntax].activated) {
-        PrintSyntax(progName);
+        PrintSyntax();
     }
 
     if (certutil.commands[cmd_PrintHelp].activated) {
-        int i;
         char buf[2];
         const char *command = NULL;
         for (i = 0; i < max_cmd; i++) {
@@ -2715,7 +2713,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
                 break;
             }
         }
-        LongUsage(progName, (command ? usage_selected : usage_all), command);
+        LongUsage((command ? usage_selected : usage_all), command);
         exit(1);
     }
 
@@ -2823,7 +2821,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
         if (certutil.options[opt_DBPrefix].arg) {
             certPrefix = certutil.options[opt_DBPrefix].arg;
         } else {
-            Usage(progName);
+            Usage();
         }
     }
 
@@ -2832,7 +2830,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
         if (certutil.options[opt_SourcePrefix].arg) {
             srcCertPrefix = certutil.options[opt_SourcePrefix].arg;
         } else {
-            Usage(progName);
+            Usage();
         }
     }
 
@@ -2916,7 +2914,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
         return 255;
     }
     if (commandsEntered == 0) {
-        Usage(progName);
+        Usage();
     }
 
     if (certutil.commands[cmd_ListCerts].activated ||
diff --git a/cmd/crlutil/crlutil.c b/cmd/crlutil/crlutil.c
index c008ecc01..c5527fc93 100644
--- a/cmd/crlutil/crlutil.c
+++ b/cmd/crlutil/crlutil.c
@@ -770,7 +770,7 @@ loser:
 }
 
 static void
-Usage(char *progName)
+Usage()
 {
     fprintf(stderr,
             "Usage:  %s -L [-n nickname] [-d keydir] [-P dbprefix] [-t crlType]\n"
@@ -908,7 +908,7 @@ main(int argc, char **argv)
     while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
         switch (optstate->option) {
             case '?':
-                Usage(progName);
+                Usage();
                 break;
 
             case 'T':
@@ -1038,17 +1038,17 @@ main(int argc, char **argv)
     }
 
     if (deleteCRL && !nickName)
-        Usage(progName);
+        Usage();
     if (importCRL && !inFile)
-        Usage(progName);
+        Usage();
     if (showFileCRL && !inFile)
-        Usage(progName);
+        Usage();
     if ((generateCRL && !nickName) ||
         (modifyCRL && !inFile && !nickName))
-        Usage(progName);
+        Usage();
     if (!(listCRL || deleteCRL || importCRL || showFileCRL || generateCRL ||
           modifyCRL || test || erase))
-        Usage(progName);
+        Usage();
 
     if (listCRL || showFileCRL) {
         readonly = PR_TRUE;
diff --git a/cmd/crmftest/testcrmf.c b/cmd/crmftest/testcrmf.c
index cbc680b08..1c1359b1b 100644
--- a/cmd/crmftest/testcrmf.c
+++ b/cmd/crmftest/testcrmf.c
@@ -577,7 +577,6 @@ Decode(void)
         printf("WARNING: The DER contained %d messages.\n", numMsgs);
     }
     for (i = 0; i < numMsgs; i++) {
-        SECStatus rv;
         printf("crmftest: Processing cert request %d\n", i);
         certReqMsg = CRMF_CertReqMessagesGetCertReqMsgAtIndex(certReqMsgs, i);
         if (certReqMsg == NULL) {
diff --git a/cmd/dbtest/dbtest.c b/cmd/dbtest/dbtest.c
index 9a6a034a6..11713c23f 100644
--- a/cmd/dbtest/dbtest.c
+++ b/cmd/dbtest/dbtest.c
@@ -58,7 +58,7 @@ getPassword(PK11SlotInfo *slot, PRBool retry, void *arg)
 }
 
 static void
-Usage(const char *progName)
+Usage()
 {
     printf("Usage:  %s [-r] [-f] [-i] [-d dbdir ] \n",
            progName);
@@ -96,7 +96,7 @@ main(int argc, char **argv)
         switch (optstate->option) {
             case 'h':
             default:
-                Usage(progName);
+                Usage();
                 break;
 
             case 'r':
@@ -122,7 +122,7 @@ main(int argc, char **argv)
     }
     PL_DestroyOptState(optstate);
     if (optstatus == PL_OPT_BAD)
-        Usage(progName);
+        Usage();
 
     if (dbDir) {
         char *tmp = dbDir;
@@ -181,7 +181,6 @@ main(int argc, char **argv)
         ret = SUCCESS;
         if (doInitTest) {
             PK11SlotInfo *slot = PK11_GetInternalKeySlot();
-            SECStatus rv;
             int passwordSuccess = 0;
             int type = CKM_DES3_CBC;
             SECItem keyid = { 0, NULL, 0 };
diff --git a/cmd/httpserv/httpserv.c b/cmd/httpserv/httpserv.c
index 7cf28c65a..71e2ab88d 100644
--- a/cmd/httpserv/httpserv.c
+++ b/cmd/httpserv/httpserv.c
@@ -682,6 +682,7 @@ handle_connection(
                 }
                 if (arena) {
                     PORT_FreeArena(arena, PR_FALSE);
+                    arena = NULL;
                 }
                 if (!request || !request->tbsRequest ||
                     !request->tbsRequest->requestList ||
@@ -753,11 +754,11 @@ handle_connection(
 
                     {
                         PRTime now = PR_Now();
-                        PLArenaPool *arena = NULL;
                         CERTOCSPSingleResponse *sr;
                         CERTOCSPSingleResponse **singleResponses;
                         SECItem *ocspResponse;
 
+                        PORT_Assert(!arena);
                         arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 
                         if (unknown) {
@@ -787,8 +788,8 @@ handle_connection(
                         } else {
                             PR_Write(ssl_sock, outOcspHeader, strlen(outOcspHeader));
                             PR_Write(ssl_sock, ocspResponse->data, ocspResponse->len);
-                            PORT_FreeArena(arena, PR_FALSE);
                         }
+                        PORT_FreeArena(arena, PR_FALSE);
                     }
                     CERT_DestroyOCSPRequest(request);
                     break;
@@ -1357,7 +1358,6 @@ main(int argc, char **argv)
             caRevoIter = &caRevoInfos->link;
             do {
                 PRFileDesc *inFile;
-                int rv = SECFailure;
                 SECItem crlDER;
                 crlDER.data = NULL;
 
@@ -1413,11 +1413,9 @@ main(int argc, char **argv)
 
     if (provideOcsp) {
         if (caRevoInfos) {
-            PRCList *caRevoIter;
-
             caRevoIter = &caRevoInfos->link;
             do {
-                caRevoInfo *revoInfo = (caRevoInfo *)caRevoIter;
+                revoInfo = (caRevoInfo *)caRevoIter;
                 if (revoInfo->nickname)
                     PORT_Free(revoInfo->nickname);
                 if (revoInfo->crlFilename)
diff --git a/cmd/lib/secutil.c b/cmd/lib/secutil.c
index 2b33f8963..6be2df432 100644
--- a/cmd/lib/secutil.c
+++ b/cmd/lib/secutil.c
@@ -1528,9 +1528,9 @@ SECU_PrintDumpDerIssuerAndSerial(FILE *out, SECItem *der, char *m,
         unsigned int i;
         for (i = 0; i < c->serialNumber.len; ++i) {
             unsigned char *chardata = (unsigned char *)(c->serialNumber.data);
-            unsigned char c = *(chardata + i);
+            unsigned char ch = *(chardata + i);
 
-            fprintf(out, "\\x%02x", c);
+            fprintf(out, "\\x%02x", ch);
         }
         fprintf(out, "\" }\n");
     }
@@ -3137,7 +3137,7 @@ typedef enum {
 static int
 secu_PrintSignedDataSigOpt(FILE *out, SECItem *der, const char *m,
                            int level, SECU_PPFunc inner,
-                           SignatureOptionType withSignature)
+                           SignatureOptionType signatureOption)
 {
     PLArenaPool *arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     CERTSignedData *sd;
@@ -3164,7 +3164,7 @@ secu_PrintSignedDataSigOpt(FILE *out, SECItem *der, const char *m,
     }
     rv = (*inner)(out, &sd->data, "Data", level + 1);
 
-    if (withSignature) {
+    if (signatureOption == withSignature) {
         SECU_PrintAlgorithmID(out, &sd->signatureAlgorithm, "Signature Algorithm",
                               level + 1);
         DER_ConvertBitString(&sd->signature);
diff --git a/cmd/listsuites/listsuites.c b/cmd/listsuites/listsuites.c
index 8eb2c3553..b49f2d8cf 100644
--- a/cmd/listsuites/listsuites.c
+++ b/cmd/listsuites/listsuites.c
@@ -64,9 +64,7 @@ main(int argc, char **argv)
     /* disable all the SSL3 cipher suites */
     for (i = 0; i < SSL_NumImplementedCiphers; i++) {
         PRUint16 suite = cipherSuites[i];
-        SECStatus rv;
         PRBool enabled;
-        PRErrorCode err;
         SSLCipherSuiteInfo info;
 
         rv = SSL_CipherPrefGetDefault(suite, &enabled);
diff --git a/cmd/lowhashtest/lowhashtest.c b/cmd/lowhashtest/lowhashtest.c
index 29d6ff4fd..fcc06a86e 100644
--- a/cmd/lowhashtest/lowhashtest.c
+++ b/cmd/lowhashtest/lowhashtest.c
@@ -390,7 +390,7 @@ testSHA512(NSSLOWInitContext *initCtx)
 }
 
 static void
-Usage(char *progName)
+Usage()
 {
     fprintf(stderr, "Usage: %s [algorithm]\n",
             progName);
@@ -436,7 +436,7 @@ main(int argc, char **argv)
         rv += testSHA512(initCtx);
     } else {
         SECU_PrintError(progName, "Unsupported hash type %s\n", argv[0]);
-        Usage(progName);
+        Usage();
     }
 
     NSSLOW_Shutdown(initCtx);
diff --git a/cmd/modutil/install-ds.c b/cmd/modutil/install-ds.c
index 030568762..576839f8f 100644
--- a/cmd/modutil/install-ds.c
+++ b/cmd/modutil/install-ds.c
@@ -88,11 +88,11 @@ static const char* errString[] = {
 
 static char* PR_Strdup(const char* str);
 
-#define PAD(x)                  \
-    {                           \
-        int i;                  \
-        for (i = 0; i < x; i++) \
-            printf(" ");        \
+#define PAD(x)                                \
+    {                                         \
+        int pad_i;                            \
+        for (pad_i = 0; pad_i < (x); pad_i++) \
+            printf(" ");                      \
     }
 #define PADINC 4
 
diff --git a/cmd/mpitests/mpi-test.c b/cmd/mpitests/mpi-test.c
index 3a1f5d6c2..b7953b6f6 100644
--- a/cmd/mpitests/mpi-test.c
+++ b/cmd/mpitests/mpi-test.c
@@ -375,14 +375,14 @@ void reason(char *fmt, ...);
 char g_intbuf[4096]; /* buffer for integer comparison   */
 char a_intbuf[4096]; /* buffer for integer comparison   */
 int g_verbose = 1;   /* print out reasons for failure?  */
-int res;
-
-#define IFOK(x)                                            \
-    {                                                      \
-        if (MP_OKAY > (res = (x))) {                       \
-            reason("test %s failed: error %d\n", #x, res); \
-            return 1;                                      \
-        }                                                  \
+
+#define IFOK(x)                                                 \
+    {                                                           \
+        int ifok_res = (x);                                     \
+        if (MP_OKAY > ifok_res) {                               \
+            reason("test %s failed: error %d\n", #x, ifok_res); \
+            return 1;                                           \
+        }                                                       \
     }
 
 int
diff --git a/cmd/ocspclnt/ocspclnt.c b/cmd/ocspclnt/ocspclnt.c
index afcb7e13f..0927f8ef6 100644
--- a/cmd/ocspclnt/ocspclnt.c
+++ b/cmd/ocspclnt/ocspclnt.c
@@ -38,7 +38,7 @@
 char *program_name;
 
 static void
-synopsis(char *program_name)
+synopsis(char *progname)
 {
     PRFileDesc *pr_stderr;
 
@@ -46,44 +46,44 @@ synopsis(char *program_name)
     PR_fprintf(pr_stderr, "Usage:");
     PR_fprintf(pr_stderr,
                "\t%s -p [-d <dir>]\n",
-               program_name);
+               progname);
     PR_fprintf(pr_stderr,
                "\t%s -P [-d <dir>]\n",
-               program_name);
+               progname);
     PR_fprintf(pr_stderr,
                "\t%s -r <name> [-a] [-L] [-s <name>] [-d <dir>]\n",
-               program_name);
+               progname);
     PR_fprintf(pr_stderr,
                "\t%s -R <name> [-a] [-l <location>] [-s <name>] [-d <dir>]\n",
-               program_name);
+               progname);
     PR_fprintf(pr_stderr,
                "\t%s -S <name> [-a] [-l <location> -t <name>]\n",
-               program_name);
+               progname);
     PR_fprintf(pr_stderr,
                "\t\t [-s <name>] [-w <time>] [-d <dir>]\n");
     PR_fprintf(pr_stderr,
                "\t%s -V <name> [-a] -u <usage> [-l <location> -t <name>]\n",
-               program_name);
+               progname);
     PR_fprintf(pr_stderr,
                "\t\t [-s <name>] [-w <time>] [-d <dir>]\n");
 }
 
 static void
-short_usage(char *program_name)
+short_usage(char *progname)
 {
     PR_fprintf(PR_STDERR,
                "Type %s -H for more detailed descriptions\n",
-               program_name);
-    synopsis(program_name);
+               progname);
+    synopsis(progname);
 }
 
 static void
-long_usage(char *program_name)
+long_usage(char *progname)
 {
     PRFileDesc *pr_stderr;
 
     pr_stderr = PR_STDERR;
-    synopsis(program_name);
+    synopsis(progname);
     PR_fprintf(pr_stderr, "\nCommands (must specify exactly one):\n");
     PR_fprintf(pr_stderr,
                "  %-13s Pretty-print a binary request read from stdin\n",
diff --git a/cmd/ocspresp/ocspresp.c b/cmd/ocspresp/ocspresp.c
index 632623c97..d18d32e18 100644
--- a/cmd/ocspresp/ocspresp.c
+++ b/cmd/ocspresp/ocspresp.c
@@ -194,8 +194,8 @@ main(int argc, char **argv)
                                                        &obtainedSignerCert, caCert));
 #ifdef DEBUG
     {
-        SECStatus rv = CERT_GetOCSPStatusForCertID(certHandle, decodedRev, cid,
-                                                   obtainedSignerCert, now);
+        rv = CERT_GetOCSPStatusForCertID(certHandle, decodedRev, cid,
+                                         obtainedSignerCert, now);
         PORT_Assert(rv == SECFailure);
         PORT_Assert(PORT_GetError() == SEC_ERROR_REVOKED_CERTIFICATE);
     }
@@ -211,7 +211,7 @@ main(int argc, char **argv)
     decodedFail = CERT_DecodeOCSPResponse(encodedFail);
 #ifdef DEBUG
     {
-        SECStatus rv = CERT_GetOCSPResponseStatus(decodedFail);
+        rv = CERT_GetOCSPResponseStatus(decodedFail);
         PORT_Assert(rv == SECFailure);
         PORT_Assert(PORT_GetError() == SEC_ERROR_OCSP_TRY_SERVER_LATER);
     }
diff --git a/cmd/pk12util/pk12util.c b/cmd/pk12util/pk12util.c
index 70454a0d8..5884713e3 100644
--- a/cmd/pk12util/pk12util.c
+++ b/cmd/pk12util/pk12util.c
@@ -28,7 +28,7 @@ static PRBool pk12uForceUnicode;
 PRIntn pk12uErrno = 0;
 
 static void
-Usage(char *progName)
+Usage()
 {
 #define FPS PR_fprintf(PR_STDERR,
     FPS "Usage:	 %s -i importfile [-d certdir] [-P dbprefix] [-h tokenname]\n",
@@ -1020,26 +1020,26 @@ main(int argc, char **argv)
     rv = SECU_ParseCommandLine(argc, argv, progName, &pk12util);
 
     if (rv != SECSuccess)
-        Usage(progName);
+        Usage();
 
     pk12_debugging = pk12util.options[opt_Debug].activated;
 
     if ((pk12util.options[opt_Import].activated +
          pk12util.options[opt_Export].activated +
          pk12util.options[opt_List].activated) != 1) {
-        Usage(progName);
+        Usage();
     }
 
     if (pk12util.options[opt_Export].activated &&
         !pk12util.options[opt_Nickname].activated) {
-        Usage(progName);
+        Usage();
     }
 
     rv = NSS_OptionGet(__NSS_PKCS12_DECODE_FORCE_UNICODE, &forceUnicode);
     if (rv != SECSuccess) {
         SECU_PrintError(progName,
                         "Failed to get NSS_PKCS12_DECODE_FORCE_UNICODE option");
-        Usage(progName);
+        Usage();
     }
     pk12uForceUnicode = forceUnicode;
 
@@ -1144,7 +1144,7 @@ main(int argc, char **argv)
         P12U_ListPKCS12File(import_file, slot, &slotPw, &p12FilePw);
 
     } else {
-        Usage(progName);
+        Usage();
         pk12uErrno = PK12UERR_USAGE;
     }
 
diff --git a/cmd/rsaperf/rsaperf.c b/cmd/rsaperf/rsaperf.c
index 2bb23856e..7762a465b 100644
--- a/cmd/rsaperf/rsaperf.c
+++ b/cmd/rsaperf/rsaperf.c
@@ -313,7 +313,7 @@ main(int argc, char **argv)
     char *slotname = NULL;
     long keybits = 0;
     RSAOp fn;
-    void *rsaKey = NULL;
+    void *rsaKeyPtr = NULL;
     PLOptState *optstate;
     PLOptStatus optstatus;
     long iters = DEFAULT_ITERS;
@@ -464,7 +464,7 @@ main(int argc, char **argv)
         if (doPub) {
             /* do public key ops */
             fn = (RSAOp)PK11_PublicKeyOp;
-            rsaKey = (void *)pubHighKey;
+            rsaKeyPtr = (void *)pubHighKey;
 
             kh = PK11_ImportPublicKey(cert->slot, pubHighKey, PR_FALSE);
             if (CK_INVALID_HANDLE == kh) {
@@ -489,7 +489,7 @@ main(int argc, char **argv)
             fn = (RSAOp)PK11_PrivateKeyOp;
             keys.privKey = privHighKey;
             keys.pubKey = pubHighKey;
-            rsaKey = (void *)&keys;
+            rsaKeyPtr = (void *)&keys;
             printf("Using PKCS#11 for RSA decryption with token %s.\n",
                    PK11_GetTokenName(privHighKey->pkcs11Slot));
         }
@@ -537,13 +537,13 @@ main(int argc, char **argv)
         if (doPub) {
             /* do public key operations */
             fn = (RSAOp)PK11_PublicKeyOp;
-            rsaKey = (void *)pubHighKey;
+            rsaKeyPtr = (void *)pubHighKey;
         } else {
             /* do private key operations */
             fn = (RSAOp)PK11_PrivateKeyOp;
             keys.privKey = privHighKey;
             keys.pubKey = pubHighKey;
-            rsaKey = (void *)&keys;
+            rsaKeyPtr = (void *)&keys;
         }
     } else
 
@@ -574,7 +574,7 @@ main(int argc, char **argv)
             pe.data = &pubEx[0];
             pe.type = siBuffer;
 
-            rsaKey = RSA_NewKey(keybits, &pe);
+            rsaKeyPtr = RSA_NewKey(keybits, &pe);
             fprintf(stderr, "Keygen completed.\n");
         } else {
             /* use a hardcoded key */
@@ -589,31 +589,31 @@ main(int argc, char **argv)
         if (doPub) {
             /* do public key operations */
             fn = (RSAOp)RSA_PublicKeyOp;
-            if (rsaKey) {
+            if (rsaKeyPtr) {
                 /* convert the RSAPrivateKey to RSAPublicKey */
                 pubKeyStr.arena = NULL;
-                pubKeyStr.modulus = ((RSAPrivateKey *)rsaKey)->modulus;
+                pubKeyStr.modulus = ((RSAPrivateKey *)rsaKeyPtr)->modulus;
                 pubKeyStr.publicExponent =
-                    ((RSAPrivateKey *)rsaKey)->publicExponent;
-                rsaKey = &pubKeyStr;
+                    ((RSAPrivateKey *)rsaKeyPtr)->publicExponent;
+                rsaKeyPtr = &pubKeyStr;
             } else {
                 /* convert NSSLOWKeyPublicKey to RSAPublicKey */
-                rsaKey = (void *)(&pubKey->u.rsa);
+                rsaKeyPtr = (void *)(&pubKey->u.rsa);
             }
-            PORT_Assert(rsaKey);
+            PORT_Assert(rsaKeyPtr);
         } else {
             /* do private key operations */
             fn = (RSAOp)RSA_PrivateKeyOp;
             if (privKey) {
                 /* convert NSSLOWKeyPrivateKey to RSAPrivateKey */
-                rsaKey = (void *)(&privKey->u.rsa);
+                rsaKeyPtr = (void *)(&privKey->u.rsa);
             }
-            PORT_Assert(rsaKey);
+            PORT_Assert(rsaKeyPtr);
         }
     }
 
     memset(buf, 1, sizeof buf);
-    rv = fn(rsaKey, buf2, buf);
+    rv = fn(rsaKeyPtr, buf2, buf);
     if (rv != SECSuccess) {
         PRErrorCode errNum;
         const char *errStr = NULL;
@@ -638,7 +638,7 @@ main(int argc, char **argv)
         runDataArr[i]->fn = fn;
         runDataArr[i]->buf = buf;
         runDataArr[i]->doIters = &doIters;
-        runDataArr[i]->rsaKey = rsaKey;
+        runDataArr[i]->rsaKey = rsaKeyPtr;
         runDataArr[i]->seconds = seconds;
         runDataArr[i]->iters = iters;
         threadsArr[i] =
diff --git a/cmd/selfserv/selfserv.c b/cmd/selfserv/selfserv.c
index fac428e10..c372ec9b8 100644
--- a/cmd/selfserv/selfserv.c
+++ b/cmd/selfserv/selfserv.c
@@ -57,7 +57,7 @@
 
 int NumSidCacheEntries = 1024;
 
-static int handle_connection(PRFileDesc *, PRFileDesc *, int);
+static int handle_connection(PRFileDesc *, PRFileDesc *);
 
 static const char envVarName[] = { SSL_ENV_VAR_NAME };
 static const char inheritableSockName[] = { "SELFSERV_LISTEN_SOCKET" };
@@ -509,7 +509,6 @@ typedef struct jobStr {
     PRCList link;
     PRFileDesc *tcp_sock;
     PRFileDesc *model_sock;
-    int requestCert;
 } JOB;
 
 static PZLock *qLock;             /* this lock protects all data immediately below */
@@ -541,7 +540,7 @@ setupJobs(int maxJobs)
     return SECSuccess;
 }
 
-typedef int startFn(PRFileDesc *a, PRFileDesc *b, int c);
+typedef int startFn(PRFileDesc *a, PRFileDesc *b);
 
 typedef enum { rs_idle = 0,
                rs_running = 1,
@@ -550,7 +549,6 @@ typedef enum { rs_idle = 0,
 typedef struct perThreadStr {
     PRFileDesc *a;
     PRFileDesc *b;
-    int c;
     int rv;
     startFn *startFunc;
     PRThread *prThread;
@@ -564,7 +562,7 @@ thread_wrapper(void *arg)
 {
     perThread *slot = (perThread *)arg;
 
-    slot->rv = (*slot->startFunc)(slot->a, slot->b, slot->c);
+    slot->rv = (*slot->startFunc)(slot->a, slot->b);
 
     /* notify the thread exit handler. */
     PZ_Lock(qLock);
@@ -575,7 +573,7 @@ thread_wrapper(void *arg)
 }
 
 int
-jobLoop(PRFileDesc *a, PRFileDesc *b, int c)
+jobLoop(PRFileDesc *a, PRFileDesc *b)
 {
     PRCList *myLink = 0;
     JOB *myJob;
@@ -595,8 +593,7 @@ jobLoop(PRFileDesc *a, PRFileDesc *b, int c)
         /* myJob will be null when stopping is true and jobQ is empty */
         if (!myJob)
             break;
-        handle_connection(myJob->tcp_sock, myJob->model_sock,
-                          myJob->requestCert);
+        handle_connection(myJob->tcp_sock, myJob->model_sock);
         PZ_Lock(qLock);
         PR_APPEND_LINK(myLink, &freeJobs);
         PZ_NotifyCondVar(freeListNotEmptyCv);
@@ -609,7 +606,6 @@ launch_threads(
     startFn *startFunc,
     PRFileDesc *a,
     PRFileDesc *b,
-    int c,
     PRBool local)
 {
     int i;
@@ -645,7 +641,6 @@ launch_threads(
         slot->state = rs_running;
         slot->a = a;
         slot->b = b;
-        slot->c = c;
         slot->startFunc = startFunc;
         slot->prThread = PR_CreateThread(PR_USER_THREAD,
                                          thread_wrapper, slot, PR_PRIORITY_NORMAL,
@@ -893,8 +888,7 @@ int /* returns count */
 int
 do_writes(
     PRFileDesc *ssl_sock,
-    PRFileDesc *model_sock,
-    int requestCert)
+    PRFileDesc *model_sock)
 {
     int sent = 0;
     int count = 0;
@@ -925,8 +919,7 @@ do_writes(
 static int
 handle_fdx_connection(
     PRFileDesc *tcp_sock,
-    PRFileDesc *model_sock,
-    int requestCert)
+    PRFileDesc *model_sock)
 {
     PRFileDesc *ssl_sock = NULL;
     SECStatus result;
@@ -960,8 +953,7 @@ handle_fdx_connection(
     lockedVars_AddToCount(&lv, 1);
 
     /* Attempt to launch the writer thread. */
-    result = launch_thread(do_writes, ssl_sock, (PRFileDesc *)&lv,
-                           requestCert);
+    result = launch_thread(do_writes, ssl_sock, (PRFileDesc *)&lv);
 
     if (result == SECSuccess)
         do {
@@ -1093,7 +1085,7 @@ makeCorruptedOCSPResponse(PLArenaPool *arena)
 }
 
 SECItemArray *
-makeSignedOCSPResponse(PLArenaPool *arena, ocspStaplingModeType osm,
+makeSignedOCSPResponse(PLArenaPool *arena,
                        CERTCertificate *cert, secuPWData *pwdata)
 {
     SECItemArray *result = NULL;
@@ -1117,7 +1109,7 @@ makeSignedOCSPResponse(PLArenaPool *arena, ocspStaplingModeType osm,
 
     nextUpdate = now + (PRTime)60 * 60 * 24 * PR_USEC_PER_SEC; /* plus 1 day */
 
-    switch (osm) {
+    switch (ocspStaplingMode) {
         case osm_good:
         case osm_badsig:
             sr = CERT_CreateOCSPSingleResponseGood(arena, cid, now,
@@ -1150,7 +1142,7 @@ makeSignedOCSPResponse(PLArenaPool *arena, ocspStaplingModeType osm,
     singleResponses[1] = NULL;
 
     ocspResponse = CERT_CreateEncodedOCSPSuccessResponse(arena,
-                                                         (osm == osm_badsig)
+                                                         (ocspStaplingMode == osm_badsig)
                                                              ? NULL
                                                              : ca,
                                                          ocspResponderID_byName, now, singleResponses,
@@ -1175,7 +1167,7 @@ makeSignedOCSPResponse(PLArenaPool *arena, ocspStaplingModeType osm,
 }
 
 void
-setupCertStatus(PLArenaPool *arena, enum ocspStaplingModeEnum ocspStaplingMode,
+setupCertStatus(PLArenaPool *arena,
                 CERTCertificate *cert, int index, secuPWData *pwdata)
 {
     if (ocspStaplingMode == osm_random) {
@@ -1213,7 +1205,7 @@ setupCertStatus(PLArenaPool *arena, enum ocspStaplingModeEnum ocspStaplingMode,
             case osm_unknown:
             case osm_badsig:
                 multiOcspResponses =
-                    makeSignedOCSPResponse(arena, ocspStaplingMode, cert,
+                    makeSignedOCSPResponse(arena, cert,
                                            pwdata);
                 break;
             case osm_corrupted:
@@ -1236,10 +1228,7 @@ setupCertStatus(PLArenaPool *arena, enum ocspStaplingModeEnum ocspStaplingMode,
 }
 
 int
-handle_connection(
-    PRFileDesc *tcp_sock,
-    PRFileDesc *model_sock,
-    int requestCert)
+handle_connection(PRFileDesc *tcp_sock, PRFileDesc *model_sock)
 {
     PRFileDesc *ssl_sock = NULL;
     PRFileDesc *local_file_fd = NULL;
@@ -1272,7 +1261,6 @@ handle_connection(
 
     VLOG(("selfserv: handle_connection: starting\n"));
     if (useModelSocket && model_sock) {
-        SECStatus rv;
         ssl_sock = SSL_ImportFD(model_sock, tcp_sock);
         if (!ssl_sock) {
             errWarn("SSL_ImportFD with model");
@@ -1588,8 +1576,7 @@ sigusr1_handler(int sig)
 SECStatus
 do_accepts(
     PRFileDesc *listen_sock,
-    PRFileDesc *model_sock,
-    int requestCert)
+    PRFileDesc *model_sock)
 {
     PRNetAddr addr;
     PRErrorCode perr;
@@ -1659,7 +1646,6 @@ do_accepts(
             JOB *myJob = (JOB *)myLink;
             myJob->tcp_sock = tcp_sock;
             myJob->model_sock = model_sock;
-            myJob->requestCert = requestCert;
         }
 
         PR_APPEND_LINK(myLink, &jobQ);
@@ -1818,7 +1804,6 @@ handshakeCallback(PRFileDesc *fd, void *client_data)
 void
 server_main(
     PRFileDesc *listen_sock,
-    int requestCert,
     SECKEYPrivateKey **privKey,
     CERTCertificate **cert,
     const char *expectedHostNameVal)
@@ -2021,7 +2006,7 @@ server_main(
     /* end of ssl configuration. */
 
     /* Now, do the accepting, here in the main thread. */
-    rv = do_accepts(listen_sock, model_sock, requestCert);
+    rv = do_accepts(listen_sock, model_sock);
 
     terminateWorkerThreads();
 
@@ -2654,9 +2639,8 @@ main(int argc, char **argv)
                 }
             }
             if (cipher > 0) {
-                SECStatus status;
-                status = SSL_CipherPrefSetDefault(cipher, SSL_ALLOWED);
-                if (status != SECSuccess)
+                rv = SSL_CipherPrefSetDefault(cipher, SSL_ALLOWED);
+                if (rv != SECSuccess)
                     SECU_PrintError(progName, "SSL_CipherPrefSet()");
             } else {
                 fprintf(stderr,
@@ -2684,7 +2668,7 @@ main(int argc, char **argv)
             exit(11);
         }
         if (privKey[i]->keyType != ecKey)
-            setupCertStatus(certStatusArena, ocspStaplingMode, cert[i], i, &pwdata);
+            setupCertStatus(certStatusArena, cert[i], i, &pwdata);
     }
 
     if (configureWeakDHE > 0) {
@@ -2697,7 +2681,7 @@ main(int argc, char **argv)
     }
 
     /* allocate the array of thread slots, and launch the worker threads. */
-    rv = launch_threads(&jobLoop, 0, 0, requestCert, useLocalThreads);
+    rv = launch_threads(&jobLoop, 0, 0, useLocalThreads);
 
     if (rv == SECSuccess && logStats) {
         loggerThread = PR_CreateThread(PR_SYSTEM_THREAD,
@@ -2712,7 +2696,7 @@ main(int argc, char **argv)
     }
 
     if (rv == SECSuccess) {
-        server_main(listen_sock, requestCert, privKey, cert,
+        server_main(listen_sock, privKey, cert,
                     expectedHostNameVal);
     }
 
@@ -2731,7 +2715,6 @@ cleanup:
     }
 
     {
-        int i;
         for (i = 0; i < certNicknameIndex; i++) {
             if (cert[i]) {
                 CERT_DestroyCertificate(cert[i]);
diff --git a/cmd/signtool/javascript.c b/cmd/signtool/javascript.c
index ffff2db59..58869aa61 100644
--- a/cmd/signtool/javascript.c
+++ b/cmd/signtool/javascript.c
@@ -1300,7 +1300,6 @@ extract_js(char *filename)
      * Now we have a stream of tags and text.  Go through and deal with each.
      */
     for (curitem = head; curitem; curitem = curitem->next) {
-        TagItem *tagp = NULL;
         AVPair *pairp = NULL;
         char *src = NULL, *id = NULL, *codebase = NULL;
         PRBool hasEventHandler = PR_FALSE;
@@ -1669,11 +1668,14 @@ loser:
  * Returns PR_SUCCESS if the directory is present, PR_FAILURE otherwise.
  */
 static PRStatus
-ensureExists(char *base, char *path)
+ensureExists(char *basepath, char *path)
 {
     char fn[FNSIZE];
     PRDir *dir;
-    sprintf(fn, "%s/%s", base, path);
+    int c = snprintf(fn, sizeof(fn), "%s/%s", basepath, path);
+    if (c >= sizeof(fn)) {
+        return PR_FAILURE;
+    }
 
     /*PR_fprintf(outputFD, "Trying to open directory %s.\n", fn);*/
 
diff --git a/cmd/signtool/sign.c b/cmd/signtool/sign.c
index 6f8e43946..534530947 100644
--- a/cmd/signtool/sign.c
+++ b/cmd/signtool/sign.c
@@ -175,16 +175,16 @@ typedef struct {
  *
  */
 int
-SignAllArc(char *jartree, char *keyName, int javascript, char *metafile,
-           char *install_script, int optimize, PRBool recurse)
+SignAllArc(char *jartree, char *keyName, int javascript, char *metafilename,
+           char *install_script, int optimize_level, PRBool recurse)
 {
     SignArcInfo info;
 
     info.keyName = keyName;
     info.javascript = javascript;
-    info.metafile = metafile;
+    info.metafile = metafilename;
     info.install_script = install_script;
-    info.optimize = optimize;
+    info.optimize = optimize_level;
 
     return foreach (jartree, "", sign_all_arc_fn, recurse,
                     PR_TRUE /*include dirs*/, (void *)&info);
@@ -194,7 +194,7 @@ static int
 sign_all_arc_fn(char *relpath, char *basedir, char *reldir, char *filename,
                 void *arg)
 {
-    char *zipfile = NULL;
+    char *zipfilename = NULL;
     char *arc = NULL, *archive = NULL;
     int retval = 0;
     SignArcInfo *infop = (SignArcInfo *)arg;
@@ -212,8 +212,8 @@ sign_all_arc_fn(char *relpath, char *basedir, char *reldir, char *filename,
         }
         archive = PR_smprintf("%s/%s", basedir, relpath);
 
-        zipfile = PL_strdup(archive);
-        arc = PORT_Strrchr(zipfile, '.');
+        zipfilename = PL_strdup(archive);
+        arc = PORT_Strrchr(zipfilename, '.');
 
         if (arc == NULL) {
             PR_fprintf(errorFD, "%s: Internal failure\n", PROGRAM_NAME);
@@ -225,17 +225,17 @@ sign_all_arc_fn(char *relpath, char *basedir, char *reldir, char *filename,
         PL_strcpy(arc, ".jar");
 
         if (verbosity >= 0) {
-            PR_fprintf(outputFD, "\nsigning: %s\n", zipfile);
+            PR_fprintf(outputFD, "\nsigning: %s\n", zipfilename);
         }
-        retval = SignArchive(archive, infop->keyName, zipfile,
+        retval = SignArchive(archive, infop->keyName, zipfilename,
                              infop->javascript, infop->metafile, infop->install_script,
                              infop->optimize, PR_TRUE /* recurse */);
     }
 finish:
     if (archive)
         PR_Free(archive);
-    if (zipfile)
-        PR_Free(zipfile);
+    if (zipfilename)
+        PR_Free(zipfilename);
 
     return retval;
 }
@@ -707,8 +707,8 @@ SignFile(FILE *outFile, FILE *inFile, CERTCertificate *cert)
 static int
 generate_SF_file(char *manifile, char *who)
 {
-    FILE *sf;
-    FILE *mf;
+    FILE *sfFile;
+    FILE *mfFile;
     long r1, r2, r3;
     char whofile[FNSIZE];
     char *buf, *name = NULL;
@@ -718,12 +718,12 @@ generate_SF_file(char *manifile, char *who)
 
     strcpy(whofile, who);
 
-    if ((mf = fopen(manifile, "rb")) == NULL) {
+    if ((mfFile = fopen(manifile, "rb")) == NULL) {
         perror(manifile);
         exit(ERRX);
     }
 
-    if ((sf = fopen(whofile, "wb")) == NULL) {
+    if ((sfFile = fopen(whofile, "wb")) == NULL) {
         perror(who);
         exit(ERRX);
     }
@@ -736,11 +736,11 @@ generate_SF_file(char *manifile, char *who)
     if (buf == NULL || name == NULL)
         out_of_memory();
 
-    fprintf(sf, "Signature-Version: 1.0\n");
-    fprintf(sf, "Created-By: %s\n", CREATOR);
-    fprintf(sf, "Comments: %s\n", BREAKAGE);
+    fprintf(sfFile, "Signature-Version: 1.0\n");
+    fprintf(sfFile, "Created-By: %s\n", CREATOR);
+    fprintf(sfFile, "Comments: %s\n", BREAKAGE);
 
-    if (fgets(buf, BUFSIZ, mf) == NULL) {
+    if (fgets(buf, BUFSIZ, mfFile) == NULL) {
         PR_fprintf(errorFD, "%s: empty manifest file!\n", PROGRAM_NAME);
         errorCount++;
         exit(ERRX);
@@ -752,15 +752,15 @@ generate_SF_file(char *manifile, char *who)
         exit(ERRX);
     }
 
-    fseek(mf, 0L, SEEK_SET);
+    fseek(mfFile, 0L, SEEK_SET);
 
     /* Process blocks of headers, and calculate their hashen */
 
     while (1) {
         /* Beginning range */
-        r1 = ftell(mf);
+        r1 = ftell(mfFile);
 
-        if (fgets(name, BUFSIZ, mf) == NULL)
+        if (fgets(name, BUFSIZ, mfFile) == NULL)
             break;
 
         line++;
@@ -774,46 +774,46 @@ generate_SF_file(char *manifile, char *who)
         }
 
         r2 = r1;
-        while (fgets(buf, BUFSIZ, mf)) {
+        while (fgets(buf, BUFSIZ, mfFile)) {
             if (*buf == 0 || *buf == '\n' || *buf == '\r')
                 break;
 
             line++;
 
             /* Ending range for hashing */
-            r2 = ftell(mf);
+            r2 = ftell(mfFile);
         }
 
-        r3 = ftell(mf);
+        r3 = ftell(mfFile);
 
         if (r1) {
-            fprintf(sf, "\n");
-            fprintf(sf, "%s", name);
+            fprintf(sfFile, "\n");
+            fprintf(sfFile, "%s", name);
         }
 
-        calculate_MD5_range(mf, r1, r2, &dig);
+        calculate_MD5_range(mfFile, r1, r2, &dig);
 
         if (optimize == 0) {
-            fprintf(sf, "Digest-Algorithms: MD5 SHA1\n");
+            fprintf(sfFile, "Digest-Algorithms: MD5 SHA1\n");
 
             md5 = BTOA_DataToAscii(dig.md5, MD5_LENGTH);
-            fprintf(sf, "MD5-Digest: %s\n", md5);
+            fprintf(sfFile, "MD5-Digest: %s\n", md5);
             PORT_Free(md5);
         }
 
         sha1 = BTOA_DataToAscii(dig.sha1, SHA1_LENGTH);
-        fprintf(sf, "SHA1-Digest: %s\n", sha1);
+        fprintf(sfFile, "SHA1-Digest: %s\n", sha1);
         PORT_Free(sha1);
 
         /* restore normalcy after changing offset position */
-        fseek(mf, r3, SEEK_SET);
+        fseek(mfFile, r3, SEEK_SET);
     }
 
     PORT_Free(buf);
     PORT_Free(name);
 
-    fclose(sf);
-    fclose(mf);
+    fclose(sfFile);
+    fclose(mfFile);
 
     return 0;
 }
diff --git a/cmd/signtool/zip.c b/cmd/signtool/zip.c
index 35d5f5733..aeb5d6c54 100644
--- a/cmd/signtool/zip.c
+++ b/cmd/signtool/zip.c
@@ -129,7 +129,7 @@ handle_zerror(int err, char *msg)
  * been opened with JzipOpen.
  */
 int
-JzipAdd(char *fullname, char *filename, ZIPfile *zipfile, int compression_level)
+JzipAdd(char *fullname, char *filename, ZIPfile *zipfile, int lvl)
 {
     ZIPentry *entry;
     PRFileDesc *readfp;
@@ -319,7 +319,7 @@ JzipAdd(char *fullname, char *filename, ZIPfile *zipfile, int compression_level)
      * It causes zlib to leave out its headers and footers, which don't
      * work in PKZIP files.
      */
-    err = deflateInit2(&zstream, compression_level, Z_DEFLATED,
+    err = deflateInit2(&zstream, lvl, Z_DEFLATED,
                        -MAX_WBITS, 8 /*default*/, Z_DEFAULT_STRATEGY);
     if (err != Z_OK) {
         handle_zerror(err, zstream.msg);
diff --git a/cmd/smimetools/cmsutil.c b/cmd/smimetools/cmsutil.c
index fe17f26a4..7106521c1 100644
--- a/cmd/smimetools/cmsutil.c
+++ b/cmd/smimetools/cmsutil.c
@@ -68,7 +68,7 @@ DigestFile(PLArenaPool *poolp, SECItem ***digests, SECItem *input,
 }
 
 static void
-Usage(char *progName)
+Usage(void)
 {
     fprintf(stderr,
             "Usage:  %s [-C|-D|-E|-O|-S] [<options>] [-d dbdir] [-u certusage]\n"
@@ -280,7 +280,6 @@ decode(FILE *out, SECItem *input, const struct decodeOptionsStr *decodeOptions)
                     ** or might be an invalid message, such as a QA test message
                     ** or a message from an attacker.
                     */
-                    SECStatus rv;
                     rv = NSS_CMSSignedData_VerifyCertsOnly(sigd,
                                                            decodeOptions->options->certHandle,
                                                            decodeOptions->options->certUsage);
@@ -1127,7 +1126,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -G only supported with option -S.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 signOptions.signingTime = PR_TRUE;
@@ -1137,7 +1136,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -H only supported with option -S.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 decodeOptions.suppressContent = PR_TRUE;
@@ -1167,7 +1166,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -N only supported with option -S.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 signOptions.nickname = PORT_Strdup(optstate->value);
@@ -1180,7 +1179,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -P only supported with option -S.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 signOptions.smimeProfile = PR_TRUE;
@@ -1193,7 +1192,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -T only supported with option -S.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 signOptions.detached = PR_TRUE;
@@ -1203,7 +1202,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -Y only supported with option -S.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 signOptions.encryptionKeyPreferenceNick = strdup(optstate->value);
@@ -1214,7 +1213,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -b only supported with option -D.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 batch = PR_TRUE;
@@ -1225,7 +1224,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -c only supported with option -D.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 contentFile = PR_Open(optstate->value, PR_RDONLY, 006600);
@@ -1261,7 +1260,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -h only supported with option -D.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 decodeOptions.headerLevel = atoi(optstate->value);
@@ -1288,7 +1287,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -k only supported with option -D.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 decodeOptions.keepCerts = PR_TRUE;
@@ -1299,7 +1298,7 @@ main(int argc, char **argv)
                     fprintf(stderr,
                             "%s: option -n only supported with option -D.\n",
                             progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 decodeOptions.suppressContent = PR_TRUE;
@@ -1315,7 +1314,7 @@ main(int argc, char **argv)
             case 'p':
                 if (!optstate->value) {
                     fprintf(stderr, "%s: option -p must have a value.\n", progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
 
@@ -1325,7 +1324,7 @@ main(int argc, char **argv)
             case 'f':
                 if (!optstate->value) {
                     fprintf(stderr, "%s: option -f must have a value.\n", progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
 
@@ -1335,7 +1334,7 @@ main(int argc, char **argv)
             case 'r':
                 if (!optstate->value) {
                     fprintf(stderr, "%s: option -r must have a value.\n", progName);
-                    Usage(progName);
+                    Usage();
                     exit(1);
                 }
                 envelopeOptions.recipients = ptrarray;
@@ -1368,11 +1367,11 @@ main(int argc, char **argv)
         }
     }
     if (status == PL_OPT_BAD)
-        Usage(progName);
+        Usage();
     PL_DestroyOptState(optstate);
 
     if (mode == UNKNOWN)
-        Usage(progName);
+        Usage();
 
     if (mode != CERTSONLY && !batch) {
         rv = SECU_FileToItem(&input, inFile);
@@ -1529,7 +1528,7 @@ main(int argc, char **argv)
             break;
         default:
             fprintf(stderr, "One of options -D, -S or -E must be set.\n");
-            Usage(progName);
+            Usage();
             exitstatus = 1;
     }
 
diff --git a/cmd/strsclnt/strsclnt.c b/cmd/strsclnt/strsclnt.c
index 7d259bd0a..bba53efac 100644
--- a/cmd/strsclnt/strsclnt.c
+++ b/cmd/strsclnt/strsclnt.c
@@ -137,7 +137,7 @@ SECItem bigBuf;
     fprintf
 
 static void
-Usage(const char *progName)
+Usage(void)
 {
     fprintf(stderr,
             "Usage: %s [-n nickname] [-p port] [-d dbdir] [-c connections]\n"
@@ -260,7 +260,6 @@ void
 printSecurityInfo(PRFileDesc *fd)
 {
     CERTCertificate *cert = NULL;
-    SSL3Statistics *ssl3stats = SSL_GetStatistics();
     SECStatus result;
     SSLChannelInfo channel;
     SSLCipherSuiteInfo suite;
@@ -1095,7 +1094,6 @@ client_main(
         while (0 != (ndx = *cipherString)) {
             const char *startCipher = cipherString++;
             int cipher = 0;
-            SECStatus rv;
 
             if (ndx == ':') {
                 cipher = hexchar_to_int(*cipherString++);
@@ -1353,7 +1351,7 @@ main(int argc, char **argv)
                                                     enabledVersions, &enabledVersions) !=
                     SECSuccess) {
                     fprintf(stderr, "Bad version specified.\n");
-                    Usage(progName);
+                    Usage();
                 }
                 break;
 
@@ -1431,27 +1429,27 @@ main(int argc, char **argv)
 
             case 0: /* positional parameter */
                 if (hostName) {
-                    Usage(progName);
+                    Usage();
                 }
                 hostName = PL_strdup(optstate->value);
                 break;
 
             default:
             case '?':
-                Usage(progName);
+                Usage();
                 break;
         }
     }
     PL_DestroyOptState(optstate);
 
     if (!hostName || status == PL_OPT_BAD)
-        Usage(progName);
+        Usage();
 
     if (fullhs != NO_FULLHS_PERCENTAGE && (fullhs < 0 || fullhs > 100 || NoReuse))
-        Usage(progName);
+        Usage();
 
     if (port == 0)
-        Usage(progName);
+        Usage();
 
     if (fileName)
         readBigFile(fileName);
diff --git a/cmd/symkeyutil/symkeyutil.c b/cmd/symkeyutil/symkeyutil.c
index 444456808..31ab4dda4 100644
--- a/cmd/symkeyutil/symkeyutil.c
+++ b/cmd/symkeyutil/symkeyutil.c
@@ -1034,10 +1034,10 @@ main(int argc, char **argv)
         char *targetName = symKeyUtil.options[opt_TargetToken].arg;
         PK11SymKey *newKey;
         PK11SymKey *symKey = FindKey(slot, name, &keyID, &pwdata);
-        char *keyName = PK11_GetSymKeyNickname(symKey);
+        char *keyName;
 
         if (!symKey) {
-            char *keyName = keyID.data ? BufToHex(&keyID) : PORT_Strdup(name);
+            keyName = keyID.data ? BufToHex(&keyID) : PORT_Strdup(name);
             PR_fprintf(PR_STDERR, "%s: Couldn't find key %s on %s\n",
                        progName, keyName, PK11_GetTokenName(slot));
             PORT_Free(keyName);
@@ -1061,6 +1061,7 @@ main(int argc, char **argv)
             PR_fprintf(PR_STDERR, "%s: Couldn't move the key \n", progName);
             goto shutdown;
         }
+        keyName = PK11_GetSymKeyNickname(symKey);
         if (keyName) {
             rv = PK11_SetSymKeyNickname(newKey, keyName);
             if (rv != SECSuccess) {
diff --git a/cmd/tstclnt/tstclnt.c b/cmd/tstclnt/tstclnt.c
index 1ad99502b..38cbe94b4 100644
--- a/cmd/tstclnt/tstclnt.c
+++ b/cmd/tstclnt/tstclnt.c
@@ -172,7 +172,7 @@ printSecurityInfo(PRFileDesc *fd)
 }
 
 static void
-PrintUsageHeader(const char *progName)
+PrintUsageHeader()
 {
     fprintf(stderr,
             "Usage:  %s -h host [-a 1st_hs_name ] [-a 2nd_hs_name ] [-p port]\n"
@@ -186,7 +186,7 @@ PrintUsageHeader(const char *progName)
 }
 
 static void
-PrintParameterUsage(void)
+PrintParameterUsage()
 {
     fprintf(stderr, "%-20s Send different SNI name. 1st_hs_name - at first\n"
                     "%-20s handshake, 2nd_hs_name - at second handshake.\n"
@@ -259,17 +259,17 @@ PrintParameterUsage(void)
 }
 
 static void
-Usage(const char *progName)
+Usage()
 {
-    PrintUsageHeader(progName);
+    PrintUsageHeader();
     PrintParameterUsage();
     exit(1);
 }
 
 static void
-PrintCipherUsage(const char *progName)
+PrintCipherUsage()
 {
-    PrintUsageHeader(progName);
+    PrintUsageHeader();
     fprintf(stderr, "%-20s Letter(s) chosen from the following list\n",
             "-c ciphers");
     fprintf(stderr,
@@ -303,7 +303,7 @@ milliPause(PRUint32 milli)
 }
 
 void
-disableAllSSLCiphers(void)
+disableAllSSLCiphers()
 {
     const PRUint16 *cipherSuites = SSL_GetImplementedCiphers();
     int i = SSL_GetNumImplementedCiphers();
@@ -844,7 +844,7 @@ separateReqHeader(const PRFileDesc *outFd, const char *buf, const int nb,
     } else if (((c) >= 'A') && ((c) <= 'F')) { \
         i = (c) - 'A' + 10;                    \
     } else {                                   \
-        Usage(progName);                       \
+        Usage();                               \
     }
 
 static SECStatus
@@ -1015,17 +1015,17 @@ handshakeCallback(PRFileDesc *fd, void *client_data)
 #define REQUEST_WAITING (requestString && !requestSent)
 
 static SECStatus
-installServerCertificate(PRFileDesc *s, char *nickname)
+installServerCertificate(PRFileDesc *s, char *nick)
 {
     CERTCertificate *cert;
     SECKEYPrivateKey *privKey = NULL;
 
-    if (!nickname) {
+    if (!nick) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
-    cert = PK11_FindCertFromNickname(nickname, &pwdata);
+    cert = PK11_FindCertFromNickname(nick, &pwdata);
     if (cert == NULL) {
         return SECFailure;
     }
@@ -1129,7 +1129,7 @@ connectToServer(PRFileDesc *s, PRPollDesc *pollset)
 }
 
 static int
-run(void)
+run()
 {
     int headerSeparatorPtrnId = 0;
     int error = 0;
@@ -1225,19 +1225,18 @@ run(void)
                 cipherString++;
             } else {
                 if (!isalpha(ndx))
-                    Usage(progName);
+                    Usage();
                 ndx = tolower(ndx) - 'a';
                 if (ndx < PR_ARRAY_SIZE(ssl3CipherSuites)) {
                     cipher = ssl3CipherSuites[ndx];
                 }
             }
             if (cipher > 0) {
-                SECStatus status;
-                status = SSL_CipherPrefSet(s, cipher, SSL_ALLOWED);
-                if (status != SECSuccess)
+                rv = SSL_CipherPrefSet(s, cipher, SSL_ALLOWED);
+                if (rv != SECSuccess)
                     SECU_PrintError(progName, "SSL_CipherPrefSet()");
             } else {
-                Usage(progName);
+                Usage();
             }
         }
         PORT_Free(cstringSaved);
@@ -1653,18 +1652,18 @@ main(int argc, char **argv)
         switch (optstate->option) {
             case '?':
             default:
-                Usage(progName);
+                Usage();
                 break;
 
             case '4':
                 allowIPv6 = PR_FALSE;
                 if (!allowIPv4)
-                    Usage(progName);
+                    Usage();
                 break;
             case '6':
                 allowIPv4 = PR_FALSE;
                 if (!allowIPv6)
-                    Usage(progName);
+                    Usage();
                 break;
 
             case 'A':
@@ -1735,7 +1734,7 @@ main(int argc, char **argv)
                     actAsServer = 1;
                 } else {
                     if (strcmp(optstate->value, "client")) {
-                        Usage(progName);
+                        Usage();
                     }
                 }
                 break;
@@ -1768,11 +1767,11 @@ main(int argc, char **argv)
                 if (!strcmp(optstate->value, "alt-server-hello")) {
                     enableAltServerHello = PR_TRUE;
                 } else {
-                    Usage(progName);
+                    Usage();
                 }
                 break;
             case 'Y':
-                PrintCipherUsage(progName);
+                PrintCipherUsage();
                 exit(0);
                 break;
 
@@ -1786,7 +1785,7 @@ main(int argc, char **argv)
                 } else if (!hs2SniHostName) {
                     hs2SniHostName = PORT_Strdup(optstate->value);
                 } else {
-                    Usage(progName);
+                    Usage();
                 }
                 break;
 
@@ -1875,7 +1874,7 @@ main(int argc, char **argv)
                 if (rv != SECSuccess) {
                     PL_DestroyOptState(optstate);
                     fprintf(stderr, "Bad group specified.\n");
-                    Usage(progName);
+                    Usage();
                 }
                 break;
         }
@@ -1889,18 +1888,18 @@ main(int argc, char **argv)
                                             enabledVersions, &enabledVersions) !=
             SECSuccess) {
             fprintf(stderr, "Bad version specified.\n");
-            Usage(progName);
+            Usage();
         }
         PORT_Free(versionString);
     }
 
     if (optstatus == PL_OPT_BAD) {
-        Usage(progName);
+        Usage();
     }
 
     if (!host || !portno) {
         fprintf(stderr, "%s: parameters -h and -p are mandatory\n", progName);
-        Usage(progName);
+        Usage();
     }
 
     if (serverCertAuth.testFreshStatusFromSideChannel &&
diff --git a/cmd/vfyserv/vfyserv.c b/cmd/vfyserv/vfyserv.c
index aa648ad8c..4234ecd09 100644
--- a/cmd/vfyserv/vfyserv.c
+++ b/cmd/vfyserv/vfyserv.c
@@ -327,9 +327,7 @@ do_connects(void *a, int connection)
 }
 
 void
-client_main(unsigned short port,
-            int connections,
-            const char *hostName)
+client_main(int connections)
 {
     int i;
     SECStatus secStatus;
@@ -553,7 +551,7 @@ main(int argc, char **argv)
         }
     }
 
-    client_main(port, connections, hostName);
+    client_main(connections);
 
 cleanup:
     if (doOcspCheck) {
diff --git a/cmd/vfyserv/vfyutil.c b/cmd/vfyserv/vfyutil.c
index 2f1b53262..d3d8a206e 100644
--- a/cmd/vfyserv/vfyutil.c
+++ b/cmd/vfyserv/vfyutil.c
@@ -310,13 +310,13 @@ myHandshakeCallback(PRFileDesc *socket, void *arg)
 void
 disableAllSSLCiphers(void)
 {
-    const PRUint16 *cipherSuites = SSL_ImplementedCiphers;
+    const PRUint16 *allSuites = SSL_ImplementedCiphers;
     int i = SSL_NumImplementedCiphers;
     SECStatus rv;
 
     /* disable all the SSL3 cipher suites */
     while (--i >= 0) {
-        PRUint16 suite = cipherSuites[i];
+        PRUint16 suite = allSuites[i];
         rv = SSL_CipherPrefSetDefault(suite, PR_FALSE);
         if (rv != SECSuccess) {
             fprintf(stderr,
diff --git a/coreconf/Werror.mk b/coreconf/Werror.mk
index 69155eb14..a569a497c 100644
--- a/coreconf/Werror.mk
+++ b/coreconf/Werror.mk
@@ -48,9 +48,11 @@ ifndef WARNING_CFLAGS
   else
     # This tests to see if enabling the warning is possible before
     # setting an option to disable it.
-    disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
+    set_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -W$(2)$(1))
+    enable_warning = $(call set_warning,$(1),)
+    disable_warning = $(call set_warning,$(1),no-)
 
-    WARNING_CFLAGS = -Wall
+    WARNING_CFLAGS = -Wall $(call enable_warning,shadow)
     ifdef CC_IS_CLANG
       # -Qunused-arguments : clang objects to arguments that it doesn't understand
       #    and fixing this would require rearchitecture
diff --git a/coreconf/werror.py b/coreconf/werror.py
index c469c4002..0e2d41c63 100644
--- a/coreconf/werror.py
+++ b/coreconf/werror.py
@@ -54,7 +54,7 @@ def main():
             set_warning(w, 'no-')
         print('-Qunused-arguments')
 
-    # set_warning('shadow') # Bug 1309068
+    set_warning('shadow')
 
 if __name__ == '__main__':
     main()
diff --git a/cpputil/databuffer.cc b/cpputil/databuffer.cc
index d60ebccb3..1420d76b4 100644
--- a/cpputil/databuffer.cc
+++ b/cpputil/databuffer.cc
@@ -18,12 +18,12 @@
 
 namespace nss_test {
 
-void DataBuffer::Assign(const uint8_t* data, size_t len) {
-  if (data) {
-    Allocate(len);
-    memcpy(static_cast<void*>(data_), static_cast<const void*>(data), len);
+void DataBuffer::Assign(const uint8_t* d, size_t l) {
+  if (d) {
+    Allocate(l);
+    memcpy(static_cast<void*>(data_), static_cast<const void*>(d), l);
   } else {
-    assert(len == 0);
+    assert(l == 0);
     data_ = nullptr;
     len_ = 0;
   }
diff --git a/cpputil/databuffer.h b/cpputil/databuffer.h
index 58e07efe1..5ec035098 100644
--- a/cpputil/databuffer.h
+++ b/cpputil/databuffer.h
@@ -17,8 +17,8 @@ namespace nss_test {
 class DataBuffer {
  public:
   DataBuffer() : data_(nullptr), len_(0) {}
-  DataBuffer(const uint8_t* data, size_t len) : data_(nullptr), len_(0) {
-    Assign(data, len);
+  DataBuffer(const uint8_t* d, size_t l) : data_(nullptr), len_(0) {
+    Assign(d, l);
   }
   DataBuffer(const DataBuffer& other) : data_(nullptr), len_(0) {
     Assign(other);
@@ -32,17 +32,17 @@ class DataBuffer {
     return *this;
   }
 
-  void Allocate(size_t len) {
+  void Allocate(size_t l) {
     delete[] data_;
-    data_ = new uint8_t[len ? len : 1];  // Don't depend on new [0].
-    len_ = len;
+    data_ = new uint8_t[l ? l : 1];  // Don't depend on new [0].
+    len_ = l;
   }
 
-  void Truncate(size_t len) { len_ = (std::min)(len_, len); }
+  void Truncate(size_t l) { len_ = (std::min)(len_, l); }
 
   void Assign(const DataBuffer& other) { Assign(other.data(), other.len()); }
 
-  void Assign(const uint8_t* data, size_t len);
+  void Assign(const uint8_t* d, size_t l);
 
   // Write will do a new allocation and expand the size of the buffer if needed.
   // Returns the offset of the end of the write.
diff --git a/fuzz/fuzz.gyp b/fuzz/fuzz.gyp
index ed1f53d58..69e178319 100644
--- a/fuzz/fuzz.gyp
+++ b/fuzz/fuzz.gyp
@@ -44,6 +44,9 @@
         # This is a static build of pk11wrap, softoken, and freebl.
         '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap_static',
       ],
+      'cflags_cc': [
+        '-Wno-error=shadow',
+      ],
       'conditions': [
         ['fuzz_oss==0', {
           'sources': [
diff --git a/gtests/freebl_gtest/blake2b_unittest.cc b/gtests/freebl_gtest/blake2b_unittest.cc
index e6b0c1157..ac9cca83f 100644
--- a/gtests/freebl_gtest/blake2b_unittest.cc
+++ b/gtests/freebl_gtest/blake2b_unittest.cc
@@ -50,7 +50,7 @@ TEST_P(Blake2BKATUnkeyed, Unkeyed) {
 TEST_P(Blake2BKATKeyed, Keyed) {
   std::vector<uint8_t> values(BLAKE2B512_LENGTH);
   SECStatus rv = BLAKE2B_MAC_HashBuf(values.data(), kat_data.data(),
-                                     std::get<0>(GetParam()), key.data(),
+                                     std::get<0>(GetParam()), kat_key.data(),
                                      BLAKE2B_KEY_SIZE);
   ASSERT_EQ(SECSuccess, rv);
   EXPECT_EQ(values, std::get<1>(GetParam()));
@@ -139,7 +139,7 @@ TEST_F(Blake2BTests, NullTest) {
   EXPECT_EQ(std::get<1>(TestcasesUnkeyed[0]), digest);
 
   digest = std::vector<uint8_t>(BLAKE2B512_LENGTH);
-  rv = BLAKE2B_MAC_HashBuf(digest.data(), nullptr, 0, key.data(),
+  rv = BLAKE2B_MAC_HashBuf(digest.data(), nullptr, 0, kat_key.data(),
                            BLAKE2B_KEY_SIZE);
   ASSERT_EQ(SECSuccess, rv);
   EXPECT_EQ(std::get<1>(TestcasesKeyed[0]), digest);
diff --git a/gtests/freebl_gtest/kat/blake2b_kat.h b/gtests/freebl_gtest/kat/blake2b_kat.h
index 28921cc94..2d73a4ab5 100644
--- a/gtests/freebl_gtest/kat/blake2b_kat.h
+++ b/gtests/freebl_gtest/kat/blake2b_kat.h
@@ -7,7 +7,7 @@
 #include <vector>
 #include <stdint.h>
 
-const std::vector<uint8_t> key = {
+const std::vector<uint8_t> kat_key = {
     0,  1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, 15,
     16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,
     32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47,
diff --git a/gtests/nss_bogo_shim/config.h b/gtests/nss_bogo_shim/config.h
index 822df65b3..4f4eec403 100644
--- a/gtests/nss_bogo_shim/config.h
+++ b/gtests/nss_bogo_shim/config.h
@@ -23,8 +23,8 @@
 // Abstract base class for a given config flag.
 class ConfigEntryBase {
  public:
-  ConfigEntryBase(const std::string& name, const std::string& type)
-      : name_(name), type_(type) {}
+  ConfigEntryBase(const std::string& nm, const std::string& typ)
+      : name_(nm), type_(typ) {}
 
   virtual ~ConfigEntryBase() {}
 
diff --git a/gtests/nss_bogo_shim/nss_bogo_shim.cc b/gtests/nss_bogo_shim/nss_bogo_shim.cc
index 4bb5debaf..62a2d258e 100644
--- a/gtests/nss_bogo_shim/nss_bogo_shim.cc
+++ b/gtests/nss_bogo_shim/nss_bogo_shim.cc
@@ -415,7 +415,7 @@ class TestAgent {
 
     size_t left = sizeof(block);
     while (left) {
-      int32_t rv = PR_Read(ssl_fd_, block, left);
+      rv = PR_Read(ssl_fd_, block, left);
       if (rv < 0) {
         std::cerr << "Failure reading\n";
         return SECFailure;
diff --git a/gtests/pk11_gtest/pk11_signature_test.h b/gtests/pk11_gtest/pk11_signature_test.h
index b14104371..8a12171a0 100644
--- a/gtests/pk11_gtest/pk11_signature_test.h
+++ b/gtests/pk11_gtest/pk11_signature_test.h
@@ -25,8 +25,8 @@ struct Pkcs11SignatureTestParams {
 
 class Pk11SignatureTest : public ::testing::Test {
  protected:
-  Pk11SignatureTest(CK_MECHANISM_TYPE mechanism, SECOidTag hash_oid)
-      : mechanism_(mechanism), hash_oid_(hash_oid) {}
+  Pk11SignatureTest(CK_MECHANISM_TYPE mech, SECOidTag hash_oid)
+      : mechanism_(mech), hash_oid_(hash_oid) {}
 
   virtual const SECItem* parameters() const { return nullptr; }
   CK_MECHANISM_TYPE mechanism() const { return mechanism_; }
diff --git a/gtests/ssl_gtest/ssl_auth_unittest.cc b/gtests/ssl_gtest/ssl_auth_unittest.cc
index 7f2b2840d..06a72defb 100644
--- a/gtests/ssl_gtest/ssl_auth_unittest.cc
+++ b/gtests/ssl_gtest/ssl_auth_unittest.cc
@@ -155,8 +155,8 @@ TEST_P(TlsConnectTls12, ClientAuthBigRsaCheckSigAlg) {
 
 class TlsZeroCertificateRequestSigAlgsFilter : public TlsHandshakeFilter {
  public:
-  TlsZeroCertificateRequestSigAlgsFilter(const std::shared_ptr<TlsAgent>& agent)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeCertificateRequest}) {}
+  TlsZeroCertificateRequestSigAlgsFilter(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(a, {kTlsHandshakeCertificateRequest}) {}
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) {
diff --git a/gtests/ssl_gtest/ssl_dhe_unittest.cc b/gtests/ssl_gtest/ssl_dhe_unittest.cc
index cdafa7a84..c3eee010e 100644
--- a/gtests/ssl_gtest/ssl_dhe_unittest.cc
+++ b/gtests/ssl_gtest/ssl_dhe_unittest.cc
@@ -103,8 +103,8 @@ TEST_P(TlsConnectGenericPre13, ConnectFfdheServer) {
 
 class TlsDheServerKeyExchangeDamager : public TlsHandshakeFilter {
  public:
-  TlsDheServerKeyExchangeDamager(const std::shared_ptr<TlsAgent>& agent)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}) {}
+  TlsDheServerKeyExchangeDamager(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}) {}
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) {
@@ -141,9 +141,9 @@ class TlsDheSkeChangeY : public TlsHandshakeFilter {
     kYZeroPad
   };
 
-  TlsDheSkeChangeY(const std::shared_ptr<TlsAgent>& agent,
+  TlsDheSkeChangeY(const std::shared_ptr<TlsAgent>& a,
                    uint8_t handshake_type, ChangeYTo change)
-      : TlsHandshakeFilter(agent, {handshake_type}), change_Y_(change) {}
+      : TlsHandshakeFilter(a, {handshake_type}), change_Y_(change) {}
 
  protected:
   void ChangeY(const DataBuffer& input, DataBuffer* output, size_t offset,
@@ -208,9 +208,9 @@ class TlsDheSkeChangeY : public TlsHandshakeFilter {
 
 class TlsDheSkeChangeYServer : public TlsDheSkeChangeY {
  public:
-  TlsDheSkeChangeYServer(const std::shared_ptr<TlsAgent>& agent,
+  TlsDheSkeChangeYServer(const std::shared_ptr<TlsAgent>& a,
                          ChangeYTo change, bool modify)
-      : TlsDheSkeChangeY(agent, kTlsHandshakeServerKeyExchange, change),
+      : TlsDheSkeChangeY(a, kTlsHandshakeServerKeyExchange, change),
         modify_(modify),
         p_() {}
 
@@ -247,9 +247,9 @@ class TlsDheSkeChangeYServer : public TlsDheSkeChangeY {
 class TlsDheSkeChangeYClient : public TlsDheSkeChangeY {
  public:
   TlsDheSkeChangeYClient(
-      const std::shared_ptr<TlsAgent>& agent, ChangeYTo change,
+      const std::shared_ptr<TlsAgent>& a, ChangeYTo change,
       std::shared_ptr<const TlsDheSkeChangeYServer> server_filter)
-      : TlsDheSkeChangeY(agent, kTlsHandshakeClientKeyExchange, change),
+      : TlsDheSkeChangeY(a, kTlsHandshakeClientKeyExchange, change),
         server_filter_(server_filter) {}
 
  protected:
@@ -357,8 +357,8 @@ INSTANTIATE_TEST_CASE_P(
 
 class TlsDheSkeMakePEven : public TlsHandshakeFilter {
  public:
-  TlsDheSkeMakePEven(const std::shared_ptr<TlsAgent>& agent)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}) {}
+  TlsDheSkeMakePEven(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}) {}
 
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
@@ -390,8 +390,8 @@ TEST_P(TlsConnectGenericPre13, MakeDhePEven) {
 
 class TlsDheSkeZeroPadP : public TlsHandshakeFilter {
  public:
-  TlsDheSkeZeroPadP(const std::shared_ptr<TlsAgent>& agent)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}) {}
+  TlsDheSkeZeroPadP(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}) {}
 
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
@@ -546,9 +546,9 @@ TEST_P(TlsConnectTls13, ResumeFfdhe) {
 
 class TlsDheSkeChangeSignature : public TlsHandshakeFilter {
  public:
-  TlsDheSkeChangeSignature(const std::shared_ptr<TlsAgent>& agent,
+  TlsDheSkeChangeSignature(const std::shared_ptr<TlsAgent>& a,
                            uint16_t version, const uint8_t* data, size_t len)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}),
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}),
         version_(version),
         data_(data),
         len_(len) {}
diff --git a/gtests/ssl_gtest/ssl_ecdh_unittest.cc b/gtests/ssl_gtest/ssl_ecdh_unittest.cc
index 3c7cd2ecf..a8ca15334 100644
--- a/gtests/ssl_gtest/ssl_ecdh_unittest.cc
+++ b/gtests/ssl_gtest/ssl_ecdh_unittest.cc
@@ -192,8 +192,8 @@ TEST_P(TlsConnectGenericPre13, P384PriorityFromModelSocket) {
 
 class TlsKeyExchangeGroupCapture : public TlsHandshakeFilter {
  public:
-  TlsKeyExchangeGroupCapture(const std::shared_ptr<TlsAgent> &agent)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}),
+  TlsKeyExchangeGroupCapture(const std::shared_ptr<TlsAgent> &a)
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerKeyExchange}),
         group_(ssl_grp_none) {}
 
   SSLNamedGroup group() const { return group_; }
diff --git a/gtests/ssl_gtest/ssl_extension_unittest.cc b/gtests/ssl_gtest/ssl_extension_unittest.cc
index 0453dabdb..5cf13b7e3 100644
--- a/gtests/ssl_gtest/ssl_extension_unittest.cc
+++ b/gtests/ssl_gtest/ssl_extension_unittest.cc
@@ -19,9 +19,9 @@ namespace nss_test {
 
 class TlsExtensionTruncator : public TlsExtensionFilter {
  public:
-  TlsExtensionTruncator(const std::shared_ptr<TlsAgent>& agent,
+  TlsExtensionTruncator(const std::shared_ptr<TlsAgent>& a,
                         uint16_t extension, size_t length)
-      : TlsExtensionFilter(agent), extension_(extension), length_(length) {}
+      : TlsExtensionFilter(a), extension_(extension), length_(length) {}
   virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
                                                const DataBuffer& input,
                                                DataBuffer* output) {
@@ -43,9 +43,9 @@ class TlsExtensionTruncator : public TlsExtensionFilter {
 
 class TlsExtensionDamager : public TlsExtensionFilter {
  public:
-  TlsExtensionDamager(const std::shared_ptr<TlsAgent>& agent,
+  TlsExtensionDamager(const std::shared_ptr<TlsAgent>& a,
                       uint16_t extension, size_t index)
-      : TlsExtensionFilter(agent), extension_(extension), index_(index) {}
+      : TlsExtensionFilter(a), extension_(extension), index_(index) {}
   virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
                                                const DataBuffer& input,
                                                DataBuffer* output) {
@@ -65,9 +65,9 @@ class TlsExtensionDamager : public TlsExtensionFilter {
 
 class TlsExtensionAppender : public TlsHandshakeFilter {
  public:
-  TlsExtensionAppender(const std::shared_ptr<TlsAgent>& agent,
+  TlsExtensionAppender(const std::shared_ptr<TlsAgent>& a,
                        uint8_t handshake_type, uint16_t ext, DataBuffer& data)
-      : TlsHandshakeFilter(agent, {handshake_type}),
+      : TlsHandshakeFilter(a, {handshake_type}),
         extension_(ext),
         data_(data) {}
 
@@ -628,9 +628,9 @@ typedef std::function<void(TlsPreSharedKeyReplacer*)>
 
 class TlsPreSharedKeyReplacer : public TlsExtensionFilter {
  public:
-  TlsPreSharedKeyReplacer(const std::shared_ptr<TlsAgent>& agent,
+  TlsPreSharedKeyReplacer(const std::shared_ptr<TlsAgent>& a,
                           TlsPreSharedKeyReplacerFunc function)
-      : TlsExtensionFilter(agent),
+      : TlsExtensionFilter(a),
         identities_(),
         binders_(),
         function_(function) {}
diff --git a/gtests/ssl_gtest/ssl_fuzz_unittest.cc b/gtests/ssl_gtest/ssl_fuzz_unittest.cc
index 99448321c..f0afc9118 100644
--- a/gtests/ssl_gtest/ssl_fuzz_unittest.cc
+++ b/gtests/ssl_gtest/ssl_fuzz_unittest.cc
@@ -27,8 +27,8 @@ class TlsFuzzTest : public ::testing::Test {};
 // Record the application data stream.
 class TlsApplicationDataRecorder : public TlsRecordFilter {
  public:
-  TlsApplicationDataRecorder(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent), buffer_() {}
+  TlsApplicationDataRecorder(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a), buffer_() {}
 
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& input,
diff --git a/gtests/ssl_gtest/ssl_hrr_unittest.cc b/gtests/ssl_gtest/ssl_hrr_unittest.cc
index 05ae87034..ba4cd804d 100644
--- a/gtests/ssl_gtest/ssl_hrr_unittest.cc
+++ b/gtests/ssl_gtest/ssl_hrr_unittest.cc
@@ -69,8 +69,8 @@ TEST_P(TlsConnectTls13, HelloRetryRequestAbortsZeroRtt) {
 // handshake packets, this will break.
 class CorrectMessageSeqAfterHrrFilter : public TlsRecordFilter {
  public:
-  CorrectMessageSeqAfterHrrFilter(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent) {}
+  CorrectMessageSeqAfterHrrFilter(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a) {}
 
  protected:
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
@@ -151,8 +151,8 @@ TEST_P(TlsConnectTls13, SecondClientHelloRejectEarlyDataXtn) {
 
 class KeyShareReplayer : public TlsExtensionFilter {
  public:
-  KeyShareReplayer(const std::shared_ptr<TlsAgent>& agent)
-      : TlsExtensionFilter(agent) {}
+  KeyShareReplayer(const std::shared_ptr<TlsAgent>& a)
+      : TlsExtensionFilter(a) {}
 
   virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
                                                const DataBuffer& input,
diff --git a/gtests/ssl_gtest/ssl_loopback_unittest.cc b/gtests/ssl_gtest/ssl_loopback_unittest.cc
index f1b78f52f..2c292ae27 100644
--- a/gtests/ssl_gtest/ssl_loopback_unittest.cc
+++ b/gtests/ssl_gtest/ssl_loopback_unittest.cc
@@ -56,8 +56,8 @@ TEST_P(TlsConnectGeneric, CipherSuiteMismatch) {
 
 class TlsAlertRecorder : public TlsRecordFilter {
  public:
-  TlsAlertRecorder(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent), level_(255), description_(255) {}
+  TlsAlertRecorder(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a), level_(255), description_(255) {}
 
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                     const DataBuffer& input,
@@ -87,9 +87,9 @@ class TlsAlertRecorder : public TlsRecordFilter {
 
 class HelloTruncator : public TlsHandshakeFilter {
  public:
-  HelloTruncator(const std::shared_ptr<TlsAgent>& agent)
+  HelloTruncator(const std::shared_ptr<TlsAgent>& a)
       : TlsHandshakeFilter(
-            agent, {kTlsHandshakeClientHello, kTlsHandshakeServerHello}) {}
+            a, {kTlsHandshakeClientHello, kTlsHandshakeServerHello}) {}
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                        const DataBuffer& input,
                                        DataBuffer* output) override {
@@ -171,8 +171,8 @@ TEST_P(TlsConnectGeneric, ConnectSendReceive) {
 
 class SaveTlsRecord : public TlsRecordFilter {
  public:
-  SaveTlsRecord(const std::shared_ptr<TlsAgent>& agent, size_t index)
-      : TlsRecordFilter(agent), index_(index), count_(0), contents_() {}
+  SaveTlsRecord(const std::shared_ptr<TlsAgent>& a, size_t index)
+      : TlsRecordFilter(a), index_(index), count_(0), contents_() {}
 
   const DataBuffer& contents() const { return contents_; }
 
@@ -227,8 +227,8 @@ TEST_F(TlsConnectStreamTls13, DecryptRecordServer) {
 
 class DropTlsRecord : public TlsRecordFilter {
  public:
-  DropTlsRecord(const std::shared_ptr<TlsAgent>& agent, size_t index)
-      : TlsRecordFilter(agent), index_(index), count_(0) {}
+  DropTlsRecord(const std::shared_ptr<TlsAgent>& a, size_t index)
+      : TlsRecordFilter(a), index_(index), count_(0) {}
 
  protected:
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
@@ -373,8 +373,8 @@ TEST_P(TlsHolddownTest, TestDtlsHolddownExpiryResumption) {
 
 class TlsPreCCSHeaderInjector : public TlsRecordFilter {
  public:
-  TlsPreCCSHeaderInjector(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent) {}
+  TlsPreCCSHeaderInjector(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a) {}
   virtual PacketFilter::Action FilterRecord(
       const TlsRecordHeader& record_header, const DataBuffer& input,
       size_t* offset, DataBuffer* output) override {
diff --git a/gtests/ssl_gtest/ssl_record_unittest.cc b/gtests/ssl_gtest/ssl_record_unittest.cc
index 3b8727850..e76dab488 100644
--- a/gtests/ssl_gtest/ssl_record_unittest.cc
+++ b/gtests/ssl_gtest/ssl_record_unittest.cc
@@ -103,8 +103,8 @@ TEST_P(TlsPaddingTest, LastByteOfPadWrong) {
 
 class RecordReplacer : public TlsRecordFilter {
  public:
-  RecordReplacer(const std::shared_ptr<TlsAgent>& agent, size_t size)
-      : TlsRecordFilter(agent), enabled_(false), size_(size) {}
+  RecordReplacer(const std::shared_ptr<TlsAgent>& a, size_t size)
+      : TlsRecordFilter(a), enabled_(false), size_(size) {}
 
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                     const DataBuffer& data,
diff --git a/gtests/ssl_gtest/ssl_resumption_unittest.cc b/gtests/ssl_gtest/ssl_resumption_unittest.cc
index eb78c0585..bc2f689a3 100644
--- a/gtests/ssl_gtest/ssl_resumption_unittest.cc
+++ b/gtests/ssl_gtest/ssl_resumption_unittest.cc
@@ -484,9 +484,9 @@ TEST_P(TlsConnectStream, TestResumptionOverrideCipher) {
 
 class SelectedVersionReplacer : public TlsHandshakeFilter {
  public:
-  SelectedVersionReplacer(const std::shared_ptr<TlsAgent>& agent,
+  SelectedVersionReplacer(const std::shared_ptr<TlsAgent>& a,
                           uint16_t version)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerHello}),
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerHello}),
         version_(version) {}
 
  protected:
diff --git a/gtests/ssl_gtest/ssl_skip_unittest.cc b/gtests/ssl_gtest/ssl_skip_unittest.cc
index e4a9e5aed..0e22625c1 100644
--- a/gtests/ssl_gtest/ssl_skip_unittest.cc
+++ b/gtests/ssl_gtest/ssl_skip_unittest.cc
@@ -22,9 +22,9 @@ namespace nss_test {
 class TlsHandshakeSkipFilter : public TlsRecordFilter {
  public:
   // A TLS record filter that skips handshake messages of the identified type.
-  TlsHandshakeSkipFilter(const std::shared_ptr<TlsAgent>& agent,
+  TlsHandshakeSkipFilter(const std::shared_ptr<TlsAgent>& a,
                          uint8_t handshake_type)
-      : TlsRecordFilter(agent),
+      : TlsRecordFilter(a),
         handshake_type_(handshake_type),
         skipped_(false) {}
 
diff --git a/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc b/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc
index 7f3c4a896..09d7801e9 100644
--- a/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc
+++ b/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc
@@ -50,12 +50,12 @@ inline std::ostream& operator<<(std::ostream& stream,
 
 class VersionRangeWithLabel {
  public:
-  VersionRangeWithLabel(const std::string& label, const SSLVersionRange& vr)
-      : label_(label), vr_(vr) {}
-  VersionRangeWithLabel(const std::string& label, uint16_t min, uint16_t max)
-      : label_(label) {
-    vr_.min = min;
-    vr_.max = max;
+  VersionRangeWithLabel(const std::string& txt, const SSLVersionRange& vr)
+      : label_(txt), vr_(vr) {}
+  VersionRangeWithLabel(const std::string& txt, uint16_t start, uint16_t end)
+      : label_(txt) {
+    vr_.min = start;
+    vr_.max = end;
   }
   VersionRangeWithLabel(const std::string& label) : label_(label) {
     vr_.min = vr_.max = SSL_LIBRARY_VERSION_NONE;
diff --git a/gtests/ssl_gtest/test_io.cc b/gtests/ssl_gtest/test_io.cc
index 728217851..d76b3526c 100644
--- a/gtests/ssl_gtest/test_io.cc
+++ b/gtests/ssl_gtest/test_io.cc
@@ -99,8 +99,8 @@ int32_t DummyPrSocket::Write(PRFileDesc *f, const void *buf, int32_t length) {
     return -1;
   }
 
-  auto peer = peer_.lock();
-  if (!peer) {
+  auto dst = peer_.lock();
+  if (!dst) {
     PR_SetError(PR_IO_ERROR, 0);
     return -1;
   }
@@ -116,14 +116,14 @@ int32_t DummyPrSocket::Write(PRFileDesc *f, const void *buf, int32_t length) {
     case PacketFilter::CHANGE:
       LOG("Original packet: " << packet);
       LOG("Filtered packet: " << filtered);
-      peer->PacketReceived(filtered);
+      dst->PacketReceived(filtered);
       break;
     case PacketFilter::DROP:
       LOG("Droppped packet: " << packet);
       break;
     case PacketFilter::KEEP:
       LOGV("Packet: " << packet);
-      peer->PacketReceived(packet);
+      dst->PacketReceived(packet);
       break;
   }
   // libssl can't handle it if this reports something other than the length
diff --git a/gtests/ssl_gtest/test_io.h b/gtests/ssl_gtest/test_io.h
index dbeb6b9d4..8327373ce 100644
--- a/gtests/ssl_gtest/test_io.h
+++ b/gtests/ssl_gtest/test_io.h
@@ -59,9 +59,9 @@ class PacketFilter {
 
 class DummyPrSocket : public DummyIOLayerMethods {
  public:
-  DummyPrSocket(const std::string& name, SSLProtocolVariant variant)
+  DummyPrSocket(const std::string& name, SSLProtocolVariant var)
       : name_(name),
-        variant_(variant),
+        variant_(var),
         peer_(),
         input_(),
         filter_(nullptr),
@@ -73,7 +73,7 @@ class DummyPrSocket : public DummyIOLayerMethods {
   ScopedPRFileDesc CreateFD();
 
   std::weak_ptr<DummyPrSocket>& peer() { return peer_; }
-  void SetPeer(const std::shared_ptr<DummyPrSocket>& peer) { peer_ = peer; }
+  void SetPeer(const std::shared_ptr<DummyPrSocket>& p) { peer_ = p; }
   void SetPacketFilter(const std::shared_ptr<PacketFilter>& filter) {
     filter_ = filter;
   }
diff --git a/gtests/ssl_gtest/tls_agent.cc b/gtests/ssl_gtest/tls_agent.cc
index 2f71caedb..f3cf9d7c6 100644
--- a/gtests/ssl_gtest/tls_agent.cc
+++ b/gtests/ssl_gtest/tls_agent.cc
@@ -44,13 +44,12 @@ const std::string TlsAgent::kServerEcdhRsa = "ecdh_rsa";
 const std::string TlsAgent::kServerEcdhEcdsa = "ecdh_ecdsa";
 const std::string TlsAgent::kServerDsa = "dsa";
 
-TlsAgent::TlsAgent(const std::string& name, Role role,
-                   SSLProtocolVariant variant)
-    : name_(name),
-      variant_(variant),
-      role_(role),
+TlsAgent::TlsAgent(const std::string& nm, Role rl, SSLProtocolVariant var)
+    : name_(nm),
+      variant_(var),
+      role_(rl),
       server_key_bits_(0),
-      adapter_(new DummyPrSocket(role_str(), variant)),
+      adapter_(new DummyPrSocket(role_str(), var)),
       ssl_fd_(nullptr),
       state_(STATE_INIT),
       timer_handle_(nullptr),
@@ -103,11 +102,11 @@ TlsAgent::~TlsAgent() {
   }
 }
 
-void TlsAgent::SetState(State state) {
-  if (state_ == state) return;
+void TlsAgent::SetState(State s) {
+  if (state_ == s) return;
 
-  LOG("Changing state from " << state_ << " to " << state);
-  state_ = state;
+  LOG("Changing state from " << state_ << " to " << s);
+  state_ = s;
 }
 
 /*static*/ bool TlsAgent::LoadCertificate(const std::string& name,
@@ -124,11 +123,11 @@ void TlsAgent::SetState(State state) {
   return true;
 }
 
-bool TlsAgent::ConfigServerCert(const std::string& name, bool updateKeyBits,
+bool TlsAgent::ConfigServerCert(const std::string& id, bool updateKeyBits,
                                 const SSLExtraServerCertData* serverCertData) {
   ScopedCERTCertificate cert;
   ScopedSECKEYPrivateKey priv;
-  if (!TlsAgent::LoadCertificate(name, &cert, &priv)) {
+  if (!TlsAgent::LoadCertificate(id, &cert, &priv)) {
     return false;
   }
 
@@ -282,8 +281,8 @@ bool TlsAgent::GetPeerChainLength(size_t* count) {
   return true;
 }
 
-void TlsAgent::CheckCipherSuite(uint16_t cipher_suite) {
-  EXPECT_EQ(csinfo_.cipherSuite, cipher_suite);
+void TlsAgent::CheckCipherSuite(uint16_t suite) {
+  EXPECT_EQ(csinfo_.cipherSuite, suite);
 }
 
 void TlsAgent::RequestClientAuth(bool requireAuth) {
@@ -442,8 +441,8 @@ void TlsAgent::GetVersionRange(uint16_t* minver, uint16_t* maxver) {
   *maxver = vrange_.max;
 }
 
-void TlsAgent::SetExpectedVersion(uint16_t version) {
-  expected_version_ = version;
+void TlsAgent::SetExpectedVersion(uint16_t ver) {
+  expected_version_ = ver;
 }
 
 void TlsAgent::SetServerKeyBits(uint16_t bits) { server_key_bits_ = bits; }
@@ -491,10 +490,10 @@ void TlsAgent::SetSignatureSchemes(const SSLSignatureScheme* schemes,
   EXPECT_EQ(i, configuredCount) << "schemes in use were all set";
 }
 
-void TlsAgent::CheckKEA(SSLKEAType kea_type, SSLNamedGroup kea_group,
+void TlsAgent::CheckKEA(SSLKEAType kea, SSLNamedGroup kea_group,
                         size_t kea_size) const {
   EXPECT_EQ(STATE_CONNECTED, state_);
-  EXPECT_EQ(kea_type, info_.keaType);
+  EXPECT_EQ(kea, info_.keaType);
   if (kea_size == 0) {
     switch (kea_group) {
       case ssl_grp_ec_curve25519:
@@ -515,7 +514,7 @@ void TlsAgent::CheckKEA(SSLKEAType kea_type, SSLNamedGroup kea_group,
       case ssl_grp_ffdhe_custom:
         break;
       default:
-        if (kea_type == ssl_kea_rsa) {
+        if (kea == ssl_kea_rsa) {
           kea_size = server_key_bits_;
         } else {
           EXPECT_TRUE(false) << "need to update group sizes";
@@ -534,13 +533,13 @@ void TlsAgent::CheckOriginalKEA(SSLNamedGroup kea_group) const {
   }
 }
 
-void TlsAgent::CheckAuthType(SSLAuthType auth_type,
+void TlsAgent::CheckAuthType(SSLAuthType auth,
                              SSLSignatureScheme sig_scheme) const {
   EXPECT_EQ(STATE_CONNECTED, state_);
-  EXPECT_EQ(auth_type, info_.authType);
+  EXPECT_EQ(auth, info_.authType);
   EXPECT_EQ(server_key_bits_, info_.authKeyBits);
   if (expected_version_ < SSL_LIBRARY_VERSION_TLS_1_2) {
-    switch (auth_type) {
+    switch (auth) {
       case ssl_auth_rsa_sign:
         sig_scheme = ssl_sig_rsa_pkcs1_sha1md5;
         break;
@@ -558,9 +557,8 @@ void TlsAgent::CheckAuthType(SSLAuthType auth_type,
   }
 
   // Check authAlgorithm, which is the old value for authType.  This is a second
-  // switch
-  // statement because default label is different.
-  switch (auth_type) {
+  // switch statement because default label is different.
+  switch (auth) {
     case ssl_auth_rsa_sign:
       EXPECT_EQ(ssl_auth_rsa_decrypt, csinfo_.authAlgorithm)
           << "authAlgorithm for RSA is always decrypt";
@@ -574,7 +572,7 @@ void TlsAgent::CheckAuthType(SSLAuthType auth_type,
           << "authAlgorithm for ECDH_ECDSA is ECDSA (i.e., wrong)";
       break;
     default:
-      EXPECT_EQ(auth_type, csinfo_.authAlgorithm)
+      EXPECT_EQ(auth, csinfo_.authAlgorithm)
           << "authAlgorithm is (usually) the same as authType";
       break;
   }
@@ -600,15 +598,15 @@ void TlsAgent::EnableAlpn(const uint8_t* val, size_t len) {
 
 void TlsAgent::CheckAlpn(SSLNextProtoState expected_state,
                          const std::string& expected) const {
-  SSLNextProtoState state;
+  SSLNextProtoState npn_state;
   char chosen[10];
   unsigned int chosen_len;
-  SECStatus rv = SSL_GetNextProto(ssl_fd(), &state,
+  SECStatus rv = SSL_GetNextProto(ssl_fd(), &npn_state,
                                   reinterpret_cast<unsigned char*>(chosen),
                                   &chosen_len, sizeof(chosen));
   EXPECT_EQ(SECSuccess, rv);
-  EXPECT_EQ(expected_state, state);
-  if (state == SSL_NEXT_PROTO_NO_SUPPORT) {
+  EXPECT_EQ(expected_state, npn_state);
+  if (npn_state == SSL_NEXT_PROTO_NO_SUPPORT) {
     EXPECT_EQ("", expected);
   } else {
     EXPECT_NE("", expected);
@@ -840,10 +838,10 @@ void TlsAgent::CheckSecretsDestroyed() {
   ASSERT_EQ(PR_TRUE, SSLInt_CheckSecretsDestroyed(ssl_fd()));
 }
 
-void TlsAgent::SetDowngradeCheckVersion(uint16_t version) {
+void TlsAgent::SetDowngradeCheckVersion(uint16_t ver) {
   ASSERT_TRUE(EnsureTlsSetup());
 
-  SECStatus rv = SSL_SetDowngradeCheckVersion(ssl_fd(), version);
+  SECStatus rv = SSL_SetDowngradeCheckVersion(ssl_fd(), ver);
   ASSERT_EQ(SECSuccess, rv);
 }
 
diff --git a/gtests/ssl_gtest/tls_agent.h b/gtests/ssl_gtest/tls_agent.h
index 6cd6d5073..6719f56e4 100644
--- a/gtests/ssl_gtest/tls_agent.h
+++ b/gtests/ssl_gtest/tls_agent.h
@@ -209,10 +209,10 @@ class TlsAgent : public PollTarget {
     return info_.protocolVersion;
   }
 
-  bool cipher_suite(uint16_t* cipher_suite) const {
+  bool cipher_suite(uint16_t* suite) const {
     if (state_ != STATE_CONNECTED) return false;
 
-    *cipher_suite = info_.cipherSuite;
+    *suite = info_.cipherSuite;
     return true;
   }
 
@@ -227,17 +227,17 @@ class TlsAgent : public PollTarget {
                                 info_.sessionID + info_.sessionIDLength);
   }
 
-  bool auth_type(SSLAuthType* auth_type) const {
+  bool auth_type(SSLAuthType* a) const {
     if (state_ != STATE_CONNECTED) return false;
 
-    *auth_type = info_.authType;
+    *a = info_.authType;
     return true;
   }
 
-  bool kea_type(SSLKEAType* kea_type) const {
+  bool kea_type(SSLKEAType* k) const {
     if (state_ != STATE_CONNECTED) return false;
 
-    *kea_type = info_.keaType;
+    *k = info_.keaType;
     return true;
   }
 
diff --git a/gtests/ssl_gtest/tls_filter.cc b/gtests/ssl_gtest/tls_filter.cc
index d34b13bcb..cc682a934 100644
--- a/gtests/ssl_gtest/tls_filter.cc
+++ b/gtests/ssl_gtest/tls_filter.cc
@@ -179,20 +179,20 @@ PacketFilter::Action TlsRecordFilter::FilterRecord(
   return CHANGE;
 }
 
-bool TlsRecordHeader::Parse(uint64_t sequence_number, TlsParser* parser,
+bool TlsRecordHeader::Parse(uint64_t seqno, TlsParser* parser,
                             DataBuffer* body) {
   if (!parser->Read(&content_type_)) {
     return false;
   }
 
-  uint32_t version;
-  if (!parser->Read(&version, 2)) {
+  uint32_t ver;
+  if (!parser->Read(&ver, 2)) {
     return false;
   }
-  version_ = version;
+  version_ = ver;
 
   // If this is DTLS, overwrite the sequence number.
-  if (IsDtls(version)) {
+  if (IsDtls(ver)) {
     uint32_t tmp;
     if (!parser->Read(&tmp, 4)) {
       return false;
@@ -203,7 +203,7 @@ bool TlsRecordHeader::Parse(uint64_t sequence_number, TlsParser* parser,
     }
     sequence_number_ |= static_cast<uint64_t>(tmp);
   } else {
-    sequence_number_ = sequence_number;
+    sequence_number_ = seqno;
   }
   return parser->ReadVariable(body, 2);
 }
@@ -488,9 +488,9 @@ PacketFilter::Action TlsConversationRecorder::FilterRecord(
 }
 
 PacketFilter::Action TlsHeaderRecorder::FilterRecord(
-    const TlsRecordHeader& header, const DataBuffer& input,
+    const TlsRecordHeader& hdr, const DataBuffer& input,
     DataBuffer* output) {
-  headers_.push_back(header);
+  headers_.push_back(hdr);
   return KEEP;
 }
 
diff --git a/gtests/ssl_gtest/tls_filter.h b/gtests/ssl_gtest/tls_filter.h
index 1bbe190ab..ea7f194c7 100644
--- a/gtests/ssl_gtest/tls_filter.h
+++ b/gtests/ssl_gtest/tls_filter.h
@@ -28,7 +28,7 @@ class TlsCipherSpec;
 class TlsVersioned {
  public:
   TlsVersioned() : version_(0) {}
-  explicit TlsVersioned(uint16_t version) : version_(version) {}
+  explicit TlsVersioned(uint16_t v) : version_(v) {}
 
   bool is_dtls() const { return IsDtls(version_); }
   uint16_t version() const { return version_; }
@@ -42,11 +42,10 @@ class TlsVersioned {
 class TlsRecordHeader : public TlsVersioned {
  public:
   TlsRecordHeader() : TlsVersioned(), content_type_(0), sequence_number_(0) {}
-  TlsRecordHeader(uint16_t version, uint8_t content_type,
-                  uint64_t sequence_number)
-      : TlsVersioned(version),
-        content_type_(content_type),
-        sequence_number_(sequence_number) {}
+  TlsRecordHeader(uint16_t ver, uint8_t ct, uint64_t seqno)
+      : TlsVersioned(ver),
+        content_type_(ct),
+        sequence_number_(seqno) {}
 
   uint8_t content_type() const { return content_type_; }
   uint64_t sequence_number() const { return sequence_number_; }
@@ -83,8 +82,8 @@ inline std::shared_ptr<T> MakeTlsFilter(const std::shared_ptr<TlsAgent>& agent,
 // Abstract filter that operates on entire (D)TLS records.
 class TlsRecordFilter : public PacketFilter {
  public:
-  TlsRecordFilter(const std::shared_ptr<TlsAgent>& agent)
-      : agent_(agent),
+  TlsRecordFilter(const std::shared_ptr<TlsAgent>& a)
+      : agent_(a),
         count_(0),
         cipher_spec_(),
         dropped_record_(false),
@@ -183,11 +182,11 @@ inline std::ostream& operator<<(std::ostream& stream,
 // records and that they don't span records or anything crazy like that.
 class TlsHandshakeFilter : public TlsRecordFilter {
  public:
-  TlsHandshakeFilter(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent), handshake_types_(), preceding_fragment_() {}
-  TlsHandshakeFilter(const std::shared_ptr<TlsAgent>& agent,
+  TlsHandshakeFilter(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a), handshake_types_(), preceding_fragment_() {}
+  TlsHandshakeFilter(const std::shared_ptr<TlsAgent>& a,
                      const std::set<uint8_t>& types)
-      : TlsRecordFilter(agent),
+      : TlsRecordFilter(a),
         handshake_types_(types),
         preceding_fragment_() {}
 
@@ -243,12 +242,12 @@ class TlsHandshakeFilter : public TlsRecordFilter {
 // Make a copy of the first instance of a handshake message.
 class TlsHandshakeRecorder : public TlsHandshakeFilter {
  public:
-  TlsHandshakeRecorder(const std::shared_ptr<TlsAgent>& agent,
+  TlsHandshakeRecorder(const std::shared_ptr<TlsAgent>& a,
                        uint8_t handshake_type)
-      : TlsHandshakeFilter(agent, {handshake_type}), buffer_() {}
-  TlsHandshakeRecorder(const std::shared_ptr<TlsAgent>& agent,
+      : TlsHandshakeFilter(a, {handshake_type}), buffer_() {}
+  TlsHandshakeRecorder(const std::shared_ptr<TlsAgent>& a,
                        const std::set<uint8_t>& handshake_types)
-      : TlsHandshakeFilter(agent, handshake_types), buffer_() {}
+      : TlsHandshakeFilter(a, handshake_types), buffer_() {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -265,10 +264,10 @@ class TlsHandshakeRecorder : public TlsHandshakeFilter {
 // Replace all instances of a handshake message.
 class TlsInspectorReplaceHandshakeMessage : public TlsHandshakeFilter {
  public:
-  TlsInspectorReplaceHandshakeMessage(const std::shared_ptr<TlsAgent>& agent,
+  TlsInspectorReplaceHandshakeMessage(const std::shared_ptr<TlsAgent>& a,
                                       uint8_t handshake_type,
                                       const DataBuffer& replacement)
-      : TlsHandshakeFilter(agent, {handshake_type}), buffer_(replacement) {}
+      : TlsHandshakeFilter(a, {handshake_type}), buffer_(replacement) {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -281,10 +280,10 @@ class TlsInspectorReplaceHandshakeMessage : public TlsHandshakeFilter {
 // Make a copy of each record of a given type.
 class TlsRecordRecorder : public TlsRecordFilter {
  public:
-  TlsRecordRecorder(const std::shared_ptr<TlsAgent>& agent, uint8_t ct)
-      : TlsRecordFilter(agent), filter_(true), ct_(ct), records_() {}
-  TlsRecordRecorder(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent),
+  TlsRecordRecorder(const std::shared_ptr<TlsAgent>& a, uint8_t ct)
+      : TlsRecordFilter(a), filter_(true), ct_(ct), records_() {}
+  TlsRecordRecorder(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a),
         filter_(false),
         ct_(content_handshake),  // dummy (<optional> is C++14)
         records_() {}
@@ -306,9 +305,9 @@ class TlsRecordRecorder : public TlsRecordFilter {
 // Make a copy of the complete conversation.
 class TlsConversationRecorder : public TlsRecordFilter {
  public:
-  TlsConversationRecorder(const std::shared_ptr<TlsAgent>& agent,
+  TlsConversationRecorder(const std::shared_ptr<TlsAgent>& a,
                           DataBuffer& buffer)
-      : TlsRecordFilter(agent), buffer_(buffer) {}
+      : TlsRecordFilter(a), buffer_(buffer) {}
 
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& input,
@@ -321,8 +320,8 @@ class TlsConversationRecorder : public TlsRecordFilter {
 // Make a copy of the records
 class TlsHeaderRecorder : public TlsRecordFilter {
  public:
-  TlsHeaderRecorder(const std::shared_ptr<TlsAgent>& agent)
-      : TlsRecordFilter(agent) {}
+  TlsHeaderRecorder(const std::shared_ptr<TlsAgent>& a)
+      : TlsRecordFilter(a) {}
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& input,
                                             DataBuffer* output);
@@ -359,15 +358,15 @@ typedef std::function<bool(TlsParser* parser, const TlsVersioned& header)>
 
 class TlsExtensionFilter : public TlsHandshakeFilter {
  public:
-  TlsExtensionFilter(const std::shared_ptr<TlsAgent>& agent)
-      : TlsHandshakeFilter(agent,
+  TlsExtensionFilter(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(a,
                            {kTlsHandshakeClientHello, kTlsHandshakeServerHello,
                             kTlsHandshakeHelloRetryRequest,
                             kTlsHandshakeEncryptedExtensions}) {}
 
-  TlsExtensionFilter(const std::shared_ptr<TlsAgent>& agent,
+  TlsExtensionFilter(const std::shared_ptr<TlsAgent>& a,
                      const std::set<uint8_t>& types)
-      : TlsHandshakeFilter(agent, types) {}
+      : TlsHandshakeFilter(a, types) {}
 
   static bool FindExtensions(TlsParser* parser, const HandshakeHeader& header);
 
@@ -388,9 +387,9 @@ class TlsExtensionFilter : public TlsHandshakeFilter {
 
 class TlsExtensionCapture : public TlsExtensionFilter {
  public:
-  TlsExtensionCapture(const std::shared_ptr<TlsAgent>& agent, uint16_t ext,
+  TlsExtensionCapture(const std::shared_ptr<TlsAgent>& a, uint16_t ext,
                       bool last = false)
-      : TlsExtensionFilter(agent),
+      : TlsExtensionFilter(a),
         extension_(ext),
         captured_(false),
         last_(last),
@@ -413,9 +412,9 @@ class TlsExtensionCapture : public TlsExtensionFilter {
 
 class TlsExtensionReplacer : public TlsExtensionFilter {
  public:
-  TlsExtensionReplacer(const std::shared_ptr<TlsAgent>& agent,
+  TlsExtensionReplacer(const std::shared_ptr<TlsAgent>& a,
                        uint16_t extension, const DataBuffer& data)
-      : TlsExtensionFilter(agent), extension_(extension), data_(data) {}
+      : TlsExtensionFilter(a), extension_(extension), data_(data) {}
   PacketFilter::Action FilterExtension(uint16_t extension_type,
                                        const DataBuffer& input,
                                        DataBuffer* output) override;
@@ -427,9 +426,9 @@ class TlsExtensionReplacer : public TlsExtensionFilter {
 
 class TlsExtensionDropper : public TlsExtensionFilter {
  public:
-  TlsExtensionDropper(const std::shared_ptr<TlsAgent>& agent,
+  TlsExtensionDropper(const std::shared_ptr<TlsAgent>& a,
                       uint16_t extension)
-      : TlsExtensionFilter(agent), extension_(extension) {}
+      : TlsExtensionFilter(a), extension_(extension) {}
   PacketFilter::Action FilterExtension(uint16_t extension_type,
                                        const DataBuffer&, DataBuffer*) override;
 
@@ -439,9 +438,9 @@ class TlsExtensionDropper : public TlsExtensionFilter {
 
 class TlsExtensionInjector : public TlsHandshakeFilter {
  public:
-  TlsExtensionInjector(const std::shared_ptr<TlsAgent>& agent, uint16_t ext,
+  TlsExtensionInjector(const std::shared_ptr<TlsAgent>& a, uint16_t ext,
                        const DataBuffer& data)
-      : TlsHandshakeFilter(agent), extension_(ext), data_(data) {}
+      : TlsHandshakeFilter(a), extension_(ext), data_(data) {}
 
  protected:
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
@@ -453,7 +452,6 @@ class TlsExtensionInjector : public TlsHandshakeFilter {
   const DataBuffer data_;
 };
 
-class TlsAgent;
 typedef std::function<void(void)> VoidFunction;
 
 class AfterRecordN : public TlsRecordFilter {
@@ -515,16 +513,16 @@ class SelectiveDropFilter : public PacketFilter {
 // datagram, we just drop one.
 class SelectiveRecordDropFilter : public TlsRecordFilter {
  public:
-  SelectiveRecordDropFilter(const std::shared_ptr<TlsAgent>& agent,
+  SelectiveRecordDropFilter(const std::shared_ptr<TlsAgent>& a,
                             uint32_t pattern, bool enabled = true)
-      : TlsRecordFilter(agent), pattern_(pattern), counter_(0) {
+      : TlsRecordFilter(a), pattern_(pattern), counter_(0) {
     if (!enabled) {
       Disable();
     }
   }
-  SelectiveRecordDropFilter(const std::shared_ptr<TlsAgent>& agent,
+  SelectiveRecordDropFilter(const std::shared_ptr<TlsAgent>& a,
                             std::initializer_list<size_t> records)
-      : SelectiveRecordDropFilter(agent, ToPattern(records), true) {}
+      : SelectiveRecordDropFilter(a, ToPattern(records), true) {}
 
   void Reset(uint32_t pattern) {
     counter_ = 0;
@@ -551,9 +549,9 @@ class SelectiveRecordDropFilter : public TlsRecordFilter {
 // Set the version number in the ClientHello.
 class TlsClientHelloVersionSetter : public TlsHandshakeFilter {
  public:
-  TlsClientHelloVersionSetter(const std::shared_ptr<TlsAgent>& agent,
+  TlsClientHelloVersionSetter(const std::shared_ptr<TlsAgent>& a,
                               uint16_t version)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeClientHello}),
+      : TlsHandshakeFilter(a, {kTlsHandshakeClientHello}),
         version_(version) {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
@@ -567,8 +565,8 @@ class TlsClientHelloVersionSetter : public TlsHandshakeFilter {
 // Damages the last byte of a handshake message.
 class TlsLastByteDamager : public TlsHandshakeFilter {
  public:
-  TlsLastByteDamager(const std::shared_ptr<TlsAgent>& agent, uint8_t type)
-      : TlsHandshakeFilter(agent), type_(type) {}
+  TlsLastByteDamager(const std::shared_ptr<TlsAgent>& a, uint8_t type)
+      : TlsHandshakeFilter(a), type_(type) {}
   PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) override {
@@ -588,9 +586,9 @@ class TlsLastByteDamager : public TlsHandshakeFilter {
 
 class SelectedCipherSuiteReplacer : public TlsHandshakeFilter {
  public:
-  SelectedCipherSuiteReplacer(const std::shared_ptr<TlsAgent>& agent,
+  SelectedCipherSuiteReplacer(const std::shared_ptr<TlsAgent>& a,
                               uint16_t suite)
-      : TlsHandshakeFilter(agent, {kTlsHandshakeServerHello}),
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerHello}),
         cipher_suite_(suite) {}
 
  protected:
diff --git a/gtests/ssl_gtest/tls_protect.cc b/gtests/ssl_gtest/tls_protect.cc
index 6c945f66e..7606e034d 100644
--- a/gtests/ssl_gtest/tls_protect.cc
+++ b/gtests/ssl_gtest/tls_protect.cc
@@ -91,9 +91,9 @@ bool AeadCipherChacha20Poly1305::Aead(bool decrypt, uint64_t seq,
                    in, inlen, out, outlen, maxlen);
 }
 
-bool TlsCipherSpec::Init(uint16_t epoch, SSLCipherAlgorithm cipher,
+bool TlsCipherSpec::Init(uint16_t epoc, SSLCipherAlgorithm cipher,
                          PK11SymKey *key, const uint8_t *iv) {
-  epoch_ = epoch;
+  epoch_ = epoc;
   switch (cipher) {
     case ssl_calg_aes_gcm:
       aead_.reset(new AeadCipherAesGcm());
diff --git a/lib/certdb/crl.c b/lib/certdb/crl.c
index d1c48dfba..63adcad46 100644
--- a/lib/certdb/crl.c
+++ b/lib/certdb/crl.c
@@ -898,13 +898,13 @@ static PLHashAllocOps preAllocOps = { PreAllocTable, PreFreeTable,
 
 /* destructor for PreAllocator object */
 void
-PreAllocator_Destroy(PreAllocator* PreAllocator)
+PreAllocator_Destroy(PreAllocator* allocator)
 {
-    if (!PreAllocator) {
+    if (!allocator) {
         return;
     }
-    if (PreAllocator->arena) {
-        PORT_FreeArena(PreAllocator->arena, PR_TRUE);
+    if (allocator->arena) {
+        PORT_FreeArena(allocator->arena, PR_TRUE);
     }
 }
 
diff --git a/lib/ckfw/session.c b/lib/ckfw/session.c
index a3119345c..7efedf403 100644
--- a/lib/ckfw/session.c
+++ b/lib/ckfw/session.c
@@ -1419,9 +1419,8 @@ nssCKFWSession_CopyObject(
         /* use create object */
         NSSArena *tmpArena;
         CK_ATTRIBUTE_PTR newTemplate;
-        CK_ULONG i, j, n, newLength, k;
+        CK_ULONG j, n, newLength, k;
         CK_ATTRIBUTE_TYPE_PTR oldTypes;
-        NSSCKFWObject *rv;
 
         n = nssCKFWObject_GetAttributeCount(fwObject, pError);
         if ((0 == n) && (CKR_OK != *pError)) {
diff --git a/lib/freebl/loader.c b/lib/freebl/loader.c
index fe5e0a668..6d200e6dd 100644
--- a/lib/freebl/loader.c
+++ b/lib/freebl/loader.c
@@ -2164,12 +2164,12 @@ BLAKE2B_NewContext(void)
 }
 
 void
-BLAKE2B_DestroyContext(BLAKE2BContext *BLAKE2BContext, PRBool freeit)
+BLAKE2B_DestroyContext(BLAKE2BContext *ctx, PRBool freeit)
 {
     if (!vector && PR_SUCCESS != freebl_RunLoaderOnce()) {
         return;
     }
-    (vector->p_BLAKE2B_DestroyContext)(BLAKE2BContext, freeit);
+    (vector->p_BLAKE2B_DestroyContext)(ctx, freeit);
 }
 
 SECStatus
diff --git a/lib/freebl/mpi/mpi.c b/lib/freebl/mpi/mpi.c
index ae404019d..8c893fb5f 100644
--- a/lib/freebl/mpi/mpi.c
+++ b/lib/freebl/mpi/mpi.c
@@ -2657,10 +2657,10 @@ mp_toradix(mp_int *mp, char *str, int radix)
         /* Reverse the digits and sign indicator     */
         ix = 0;
         while (ix < pos) {
-            char tmp = str[ix];
+            char tmpc = str[ix];
 
             str[ix] = str[pos];
-            str[pos] = tmp;
+            str[pos] = tmpc;
             ++ix;
             --pos;
         }
@@ -3313,13 +3313,14 @@ s_mp_div_d(mp_int *mp, mp_digit d, mp_digit *r)
     /* could check for power of 2 here, but mp_div_d does that. */
     if (MP_USED(mp) == 1) {
         mp_digit n = MP_DIGIT(mp, 0);
-        mp_digit rem;
+        mp_digit remdig;
 
         q = n / d;
-        rem = n % d;
+        remdig = n % d;
         MP_DIGIT(mp, 0) = q;
-        if (r)
-            *r = rem;
+        if (r) {
+            *r = remdig;
+        }
         return MP_OKAY;
     }
 
diff --git a/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c b/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c
index 9954f0ca6..f73b95f68 100644
--- a/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c
+++ b/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpdefaultclient.c
@@ -70,7 +70,7 @@ static const PKIX_UInt32 httpprotocolLen = 5; /* strlen(httpprotocol) */
  *      The address at which the Boolean state machine flag is stored to
  *      indicate whether processing can continue without further input.
  *      Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -85,7 +85,7 @@ pkix_pl_HttpDefaultClient_HdrCheckComplete(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_UInt32 bytesRead,
         PKIX_Boolean *pKeepGoing,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_UInt32 alreadyScanned = 0;
         PKIX_UInt32 comp = 0;
@@ -142,7 +142,7 @@ pkix_pl_HttpDefaultClient_HdrCheckComplete(
         headerLength = (eoh - client->rcvBuf);
 
         /* allocate space to copy header (and for the NULL terminator) */
-        PKIX_CHECK(PKIX_PL_Malloc(headerLength + 1, (void **)&copy, plContext),
+        PKIX_CHECK(PKIX_PL_Malloc(headerLength + 1, (void **)&copy, plCtx),
                 PKIX_MALLOCFAILED);
 
         /* copy header data before we corrupt it (by storing NULLs) */
@@ -301,7 +301,7 @@ pkix_pl_HttpDefaultClient_HdrCheckComplete(
  
          if (contentLength > 0) {
              /* allocate a buffer of size contentLength  for the content */
-             PKIX_CHECK(PKIX_PL_Malloc(contentLength, (void **)&body, plContext),
+             PKIX_CHECK(PKIX_PL_Malloc(contentLength, (void **)&body, plCtx),
                         PKIX_MALLOCFAILED);
              
              /* copy any remaining bytes in current buffer into new buffer */
@@ -311,7 +311,7 @@ pkix_pl_HttpDefaultClient_HdrCheckComplete(
              }
          }
  
-         PKIX_CHECK(PKIX_PL_Free(client->rcvBuf, plContext),
+         PKIX_CHECK(PKIX_PL_Free(client->rcvBuf, plCtx),
                     PKIX_FREEFAILED);
          client->rcvBuf = body;
 
@@ -340,7 +340,7 @@ cleanup:
  *  "pClient"
  *      The address at which the created HttpDefaultClient is to be stored.
  *      Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -355,7 +355,7 @@ pkix_pl_HttpDefaultClient_Create(
         const char *host,
         PRUint16 portnum,
         PKIX_PL_HttpDefaultClient **pClient,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_PL_HttpDefaultClient *client = NULL;
 
@@ -367,7 +367,7 @@ pkix_pl_HttpDefaultClient_Create(
                 (PKIX_HTTPDEFAULTCLIENT_TYPE,
                 sizeof (PKIX_PL_HttpDefaultClient),
                 (PKIX_PL_Object **)&client,
-                plContext),
+                plCtx),
                 PKIX_COULDNOTCREATEHTTPDEFAULTCLIENTOBJECT);
 
         /* Client timeout is overwritten in HttpDefaultClient_RequestCreate
@@ -408,10 +408,10 @@ pkix_pl_HttpDefaultClient_Create(
         client->socket = NULL;
 
         /*
-         * The HttpClient API does not include a plContext argument in its
+         * The HttpClient API does not include a plCtx argument in its
          * function calls. Save it here.
          */
-        client->plContext = plContext;
+        client->plContext = plCtx;
 
         *pClient = client;
 
@@ -430,7 +430,7 @@ cleanup:
 static PKIX_Error *
 pkix_pl_HttpDefaultClient_Destroy(
         PKIX_PL_Object *object,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_PL_HttpDefaultClient *client = NULL;
 
@@ -438,13 +438,13 @@ pkix_pl_HttpDefaultClient_Destroy(
         PKIX_NULLCHECK_ONE(object);
 
         PKIX_CHECK(pkix_CheckType
-                    (object, PKIX_HTTPDEFAULTCLIENT_TYPE, plContext),
+                    (object, PKIX_HTTPDEFAULTCLIENT_TYPE, plCtx),
                     PKIX_OBJECTNOTANHTTPDEFAULTCLIENT);
 
         client = (PKIX_PL_HttpDefaultClient *)object;
 
         if (client->rcvHeaders) {
-            PKIX_PL_Free(client->rcvHeaders, plContext);
+            PKIX_PL_Free(client->rcvHeaders, plCtx);
             client->rcvHeaders = NULL;
         }
         if (client->rcvContentType) {
@@ -456,11 +456,11 @@ pkix_pl_HttpDefaultClient_Destroy(
                 client->GETBuf = NULL;
         }
         if (client->POSTBuf != NULL) {
-                PKIX_PL_Free(client->POSTBuf, plContext);
+                PKIX_PL_Free(client->POSTBuf, plCtx);
                 client->POSTBuf = NULL;
         }
         if (client->rcvBuf != NULL) {
-                PKIX_PL_Free(client->rcvBuf, plContext);
+                PKIX_PL_Free(client->rcvBuf, plCtx);
                 client->rcvBuf = NULL;
         }
         if (client->host) {
@@ -493,7 +493,7 @@ cleanup:
  *  thread-safe.
  */
 PKIX_Error *
-pkix_pl_HttpDefaultClient_RegisterSelf(void *plContext)
+pkix_pl_HttpDefaultClient_RegisterSelf(void *plCtx)
 {
         extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
         pkix_ClassTable_Entry *entry =
@@ -529,7 +529,7 @@ pkix_pl_HttpDefaultClient_RegisterSelf(void *plContext)
  *      The address at which the Boolean state machine flag is stored to
  *      indicate whether processing can continue without further input.
  *      Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -543,7 +543,7 @@ static PKIX_Error *
 pkix_pl_HttpDefaultClient_ConnectContinue(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_Boolean *pKeepGoing,
-        void *plContext)
+        void *plCtx)
 {
         PRErrorCode status;
         PKIX_Boolean keepGoing = PKIX_FALSE;
@@ -557,7 +557,7 @@ pkix_pl_HttpDefaultClient_ConnectContinue(
         callbackList = (PKIX_PL_Socket_Callback *)client->callbackList;
 
         PKIX_CHECK(callbackList->connectcontinueCallback
-                (client->socket, &status, plContext),
+                (client->socket, &status, plCtx),
                 PKIX_SOCKETCONNECTCONTINUEFAILED);
 
         if (status == 0) {
@@ -595,7 +595,7 @@ cleanup:
  *  "pBytesTransferred"
  *      The address at which the number of bytes sent is stored. Must be
  *      non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -610,7 +610,7 @@ pkix_pl_HttpDefaultClient_Send(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_Boolean *pKeepGoing,
         PKIX_UInt32 *pBytesTransferred,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_Int32 bytesWritten = 0;
         PKIX_Int32 lenToWrite = 0;
@@ -640,7 +640,7 @@ pkix_pl_HttpDefaultClient_Send(
                         dataToWrite,
                         lenToWrite,
                         &bytesWritten,
-                        plContext),
+                        plCtx),
                         PKIX_SOCKETSENDFAILED);
 
                 client->rcvBuf = NULL;
@@ -690,7 +690,7 @@ cleanup:
  *  "pBytesTransferred"
  *      The address at which the number of bytes sent is stored. Must be
  *      non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -705,7 +705,7 @@ pkix_pl_HttpDefaultClient_SendContinue(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_Boolean *pKeepGoing,
         PKIX_UInt32 *pBytesTransferred,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_Int32 bytesWritten = 0;
         PKIX_PL_Socket_Callback *callbackList = NULL;
@@ -718,7 +718,7 @@ pkix_pl_HttpDefaultClient_SendContinue(
         callbackList = (PKIX_PL_Socket_Callback *)client->callbackList;
 
         PKIX_CHECK(callbackList->pollCallback
-                (client->socket, &bytesWritten, NULL, plContext),
+                (client->socket, &bytesWritten, NULL, plCtx),
                 PKIX_SOCKETPOLLFAILED);
 
         /*
@@ -752,7 +752,7 @@ cleanup:
  *      The address at which the Boolean state machine flag is stored to
  *      indicate whether processing can continue without further input.
  *      Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -766,7 +766,7 @@ static PKIX_Error *
 pkix_pl_HttpDefaultClient_RecvHdr(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_Boolean *pKeepGoing,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_UInt32 bytesToRead = 0;
         PKIX_Int32 bytesRead = 0;
@@ -787,7 +787,7 @@ pkix_pl_HttpDefaultClient_RecvHdr(
                 (client->rcvBuf,
                 client->capacity,
                 (void **)&(client->rcvBuf),
-                plContext),
+                plCtx),
                 PKIX_REALLOCFAILED);
 
         bytesToRead = client->capacity - client->filledupBytes;
@@ -799,7 +799,7 @@ pkix_pl_HttpDefaultClient_RecvHdr(
                 (void *)&(client->rcvBuf[client->filledupBytes]),
                 bytesToRead,
                 &bytesRead,
-                plContext),
+                plCtx),
                 PKIX_SOCKETRECVFAILED);
 
         if (bytesRead > 0) {
@@ -808,7 +808,7 @@ pkix_pl_HttpDefaultClient_RecvHdr(
             PKIX_CHECK(
                 pkix_pl_HttpDefaultClient_HdrCheckComplete(client, bytesRead,
                                                            pKeepGoing,
-                                                           plContext),
+                                                           plCtx),
                        PKIX_HTTPDEFAULTCLIENTHDRCHECKCOMPLETEFAILED);
         } else {
             client->connectStatus = HTTP_RECV_HDR_PENDING;
@@ -834,7 +834,7 @@ cleanup:
  *      The address at which the Boolean state machine flag is stored to
  *      indicate whether processing can continue without further input.
  *      Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -848,7 +848,7 @@ static PKIX_Error *
 pkix_pl_HttpDefaultClient_RecvHdrContinue(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_Boolean *pKeepGoing,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_Int32 bytesRead = 0;
         PKIX_PL_Socket_Callback *callbackList = NULL;
@@ -861,14 +861,14 @@ pkix_pl_HttpDefaultClient_RecvHdrContinue(
         callbackList = (PKIX_PL_Socket_Callback *)client->callbackList;
 
         PKIX_CHECK(callbackList->pollCallback
-                (client->socket, NULL, &bytesRead, plContext),
+                (client->socket, NULL, &bytesRead, plCtx),
                 PKIX_SOCKETPOLLFAILED);
 
         if (bytesRead > 0) {
                 client->filledupBytes += bytesRead;
 
                 PKIX_CHECK(pkix_pl_HttpDefaultClient_HdrCheckComplete
-                        (client, bytesRead, pKeepGoing, plContext),
+                        (client, bytesRead, pKeepGoing, plCtx),
                         PKIX_HTTPDEFAULTCLIENTHDRCHECKCOMPLETEFAILED);
 
         } else {
@@ -897,7 +897,7 @@ cleanup:
  *      The address at which the Boolean state machine flag is stored to
  *      indicate whether processing can continue without further input.
  *      Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -911,7 +911,7 @@ static PKIX_Error *
 pkix_pl_HttpDefaultClient_RecvBody(
         PKIX_PL_HttpDefaultClient *client,
         PKIX_Boolean *pKeepGoing,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_Int32 bytesRead = 0;
         PKIX_Int32 bytesToRead = 0;
@@ -952,7 +952,7 @@ pkix_pl_HttpDefaultClient_RecvBody(
                     client->capacity = newLength;
                     PKIX_CHECK(
                         PKIX_PL_Realloc(client->rcvBuf, newLength,
-                                        (void**)&client->rcvBuf, plContext),
+                                        (void**)&client->rcvBuf, plCtx),
                         PKIX_REALLOCFAILED);
                     freeBuffSize = client->capacity -
                         client->filledupBytes;
@@ -964,7 +964,7 @@ pkix_pl_HttpDefaultClient_RecvBody(
         /* Use poll callback if waiting on non-blocking IO */
         if (client->connectStatus == HTTP_RECV_BODY_PENDING) {
             PKIX_CHECK(callbackList->pollCallback
-                       (client->socket, NULL, &bytesRead, plContext),
+                       (client->socket, NULL, &bytesRead, plCtx),
                        PKIX_SOCKETPOLLFAILED);
         } else {
             PKIX_CHECK(callbackList->recvCallback
@@ -972,7 +972,7 @@ pkix_pl_HttpDefaultClient_RecvBody(
                         (void *)&(client->rcvBuf[client->filledupBytes]),
                         bytesToRead,
                         &bytesRead,
-                        plContext),
+                        plCtx),
                        PKIX_SOCKETRECVFAILED);
         }
 
@@ -1026,7 +1026,7 @@ cleanup:
  * PARAMETERS:
  *  "client"
  *      The address of the HttpDefaultClient object. Must be non-NULL.
- *  "plContext"
+ *  "plCtx"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
@@ -1039,7 +1039,7 @@ cleanup:
 static PKIX_Error *
 pkix_pl_HttpDefaultClient_Dispatch(
         PKIX_PL_HttpDefaultClient *client,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_UInt32 bytesTransferred = 0;
         PKIX_Boolean keepGoing = PKIX_TRUE;
@@ -1051,33 +1051,33 @@ pkix_pl_HttpDefaultClient_Dispatch(
                 switch (client->connectStatus) {
                 case HTTP_CONNECT_PENDING:
                     PKIX_CHECK(pkix_pl_HttpDefaultClient_ConnectContinue
-                        (client, &keepGoing, plContext),
+                        (client, &keepGoing, plCtx),
                         PKIX_HTTPDEFAULTCLIENTCONNECTCONTINUEFAILED);
                     break;
                 case HTTP_CONNECTED:
                     PKIX_CHECK(pkix_pl_HttpDefaultClient_Send
-                        (client, &keepGoing, &bytesTransferred, plContext),
+                        (client, &keepGoing, &bytesTransferred, plCtx),
                         PKIX_HTTPDEFAULTCLIENTSENDFAILED);
                     break;
                 case HTTP_SEND_PENDING:
                     PKIX_CHECK(pkix_pl_HttpDefaultClient_SendContinue
-                        (client, &keepGoing, &bytesTransferred, plContext),
+                        (client, &keepGoing, &bytesTransferred, plCtx),
                         PKIX_HTTPDEFAULTCLIENTSENDCONTINUEFAILED);
                     break;
                 case HTTP_RECV_HDR:
                     PKIX_CHECK(pkix_pl_HttpDefaultClient_RecvHdr
-                        (client, &keepGoing, plContext),
+                        (client, &keepGoing, plCtx),
                         PKIX_HTTPDEFAULTCLIENTRECVHDRFAILED);
                     break;
                 case HTTP_RECV_HDR_PENDING:
                     PKIX_CHECK(pkix_pl_HttpDefaultClient_RecvHdrContinue
-                        (client, &keepGoing, plContext),
+                        (client, &keepGoing, plCtx),
                         PKIX_HTTPDEFAULTCLIENTRECVHDRCONTINUEFAILED);
                     break;
                 case HTTP_RECV_BODY:
                 case HTTP_RECV_BODY_PENDING:
                     PKIX_CHECK(pkix_pl_HttpDefaultClient_RecvBody
-                        (client, &keepGoing, plContext),
+                        (client, &keepGoing, plCtx),
                         PKIX_HTTPDEFAULTCLIENTRECVBODYFAILED);
                     break;
                 case HTTP_ERROR:
@@ -1106,7 +1106,7 @@ pkix_pl_HttpDefaultClient_CreateSession(
         const char *host,
         PRUint16 portnum,
         SEC_HTTP_SERVER_SESSION *pSession,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_PL_HttpDefaultClient *client = NULL;
 
@@ -1115,7 +1115,7 @@ pkix_pl_HttpDefaultClient_CreateSession(
         PKIX_NULLCHECK_TWO(host, pSession);
 
         PKIX_CHECK(pkix_pl_HttpDefaultClient_Create
-                (host, portnum, &client, plContext),
+                (host, portnum, &client, plCtx),
                 PKIX_HTTPDEFAULTCLIENTCREATEFAILED);
 
         *pSession = (SEC_HTTP_SERVER_SESSION)client;
@@ -1130,7 +1130,7 @@ PKIX_Error *
 pkix_pl_HttpDefaultClient_KeepAliveSession(
         SEC_HTTP_SERVER_SESSION session,
         PRPollDesc **pPollDesc,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_ENTER
                 (HTTPDEFAULTCLIENT,
@@ -1140,7 +1140,7 @@ pkix_pl_HttpDefaultClient_KeepAliveSession(
         PKIX_CHECK(pkix_CheckType
                 ((PKIX_PL_Object *)session,
                 PKIX_HTTPDEFAULTCLIENT_TYPE,
-                plContext),
+                plCtx),
                 PKIX_SESSIONNOTANHTTPDEFAULTCLIENT);
 
         /* XXX Not implemented */
@@ -1159,7 +1159,7 @@ pkix_pl_HttpDefaultClient_RequestCreate(
         const char *http_request_method, 
         const PRIntervalTime timeout, 
         SEC_HTTP_REQUEST_SESSION *pRequest,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_PL_HttpDefaultClient *client = NULL;
         PKIX_PL_Socket *socket = NULL;
@@ -1174,7 +1174,7 @@ pkix_pl_HttpDefaultClient_RequestCreate(
         PKIX_CHECK(pkix_CheckType
                 ((PKIX_PL_Object *)session,
                 PKIX_HTTPDEFAULTCLIENT_TYPE,
-                plContext),
+                plCtx),
                 PKIX_SESSIONNOTANHTTPDEFAULTCLIENT);
 
         client = (PKIX_PL_HttpDefaultClient *)session;
@@ -1212,7 +1212,7 @@ pkix_pl_HttpDefaultClient_RequestCreate(
                 2001,   /* client->portnum, */
                 &status,
                 &socket,
-                plContext),
+                plCtx),
 		PKIX_HTTPCERTSTOREFINDSOCKETCONNECTIONFAILED);
 #else
 	PKIX_CHECK(pkix_HttpCertStore_FindSocketConnection
@@ -1221,20 +1221,20 @@ pkix_pl_HttpDefaultClient_RequestCreate(
                 client->portnum,
                 &status,
                 &socket,
-                plContext),
+                plCtx),
 		PKIX_HTTPCERTSTOREFINDSOCKETCONNECTIONFAILED);
 #endif
 
         client->socket = socket;
 
         PKIX_CHECK(pkix_pl_Socket_GetCallbackList
-                (socket, &callbackList, plContext),
+                (socket, &callbackList, plCtx),
                 PKIX_SOCKETGETCALLBACKLISTFAILED);
 
         client->callbackList = (void *)callbackList;
 
         PKIX_CHECK(pkix_pl_Socket_GetPRFileDesc
-                (socket, &fileDesc, plContext),
+                (socket, &fileDesc, plCtx),
                 PKIX_SOCKETGETPRFILEDESCFAILED);
 
         client->pollDesc.fd = fileDesc;
@@ -1264,7 +1264,7 @@ pkix_pl_HttpDefaultClient_SetPostData(
         const char *http_data, 
         const PRUint32 http_data_len,
         const char *http_content_type,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_PL_HttpDefaultClient *client = NULL;
 
@@ -1276,7 +1276,7 @@ pkix_pl_HttpDefaultClient_SetPostData(
         PKIX_CHECK(pkix_CheckType
                 ((PKIX_PL_Object *)request,
                 PKIX_HTTPDEFAULTCLIENT_TYPE,
-                plContext),
+                plCtx),
                 PKIX_REQUESTNOTANHTTPDEFAULTCLIENT);
 
         client = (PKIX_PL_HttpDefaultClient *)request;
@@ -1307,7 +1307,7 @@ pkix_pl_HttpDefaultClient_TrySendAndReceive(
         PRUint32 *http_response_data_len, 
         PRPollDesc **pPollDesc,
         SECStatus *pSECReturn,
-        void *plContext)        
+        void *plCtx)        
 {
         PKIX_PL_HttpDefaultClient *client = NULL;
         PKIX_UInt32 postLen = 0;
@@ -1324,7 +1324,7 @@ pkix_pl_HttpDefaultClient_TrySendAndReceive(
         PKIX_CHECK(pkix_CheckType
                 ((PKIX_PL_Object *)request,
                 PKIX_HTTPDEFAULTCLIENT_TYPE,
-                plContext),
+                plCtx),
                 PKIX_REQUESTNOTANHTTPDEFAULTCLIENT);
 
         client = (PKIX_PL_HttpDefaultClient *)request;
@@ -1380,7 +1380,7 @@ pkix_pl_HttpDefaultClient_TrySendAndReceive(
                         PKIX_CHECK(PKIX_PL_Malloc
                                 (client->POSTLen,
                                 (void **)&(client->POSTBuf),
-                                plContext),
+                                plCtx),
                                 PKIX_MALLOCFAILED);
 
                         /* copy header into postBuffer */
@@ -1407,7 +1407,7 @@ pkix_pl_HttpDefaultClient_TrySendAndReceive(
         }
 
         /* continue according to state */
-        PKIX_CHECK(pkix_pl_HttpDefaultClient_Dispatch(client, plContext),
+        PKIX_CHECK(pkix_pl_HttpDefaultClient_Dispatch(client, plCtx),
                 PKIX_HTTPDEFAULTCLIENTDISPATCHFAILED);
 
         switch (client->connectStatus) {
@@ -1478,7 +1478,7 @@ cleanup:
 PKIX_Error *
 pkix_pl_HttpDefaultClient_Cancel(
         SEC_HTTP_REQUEST_SESSION request,
-        void *plContext)
+        void *plCtx)
 {
         PKIX_ENTER(HTTPDEFAULTCLIENT, "pkix_pl_HttpDefaultClient_Cancel");
         PKIX_NULLCHECK_ONE(request);
@@ -1486,7 +1486,7 @@ pkix_pl_HttpDefaultClient_Cancel(
         PKIX_CHECK(pkix_CheckType
                 ((PKIX_PL_Object *)request,
                 PKIX_HTTPDEFAULTCLIENT_TYPE,
-                plContext),
+                plCtx),
                 PKIX_REQUESTNOTANHTTPDEFAULTCLIENT);
 
         /* XXX Not implemented */
diff --git a/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c b/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c
index 9fa8e9260..09b54a2be 100644
--- a/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c
+++ b/lib/libpkix/pkix_pl_nss/pki/pkix_pl_infoaccess.c
@@ -23,8 +23,8 @@
  * PARAMETERS
  *  "method"
  *      The UInt32 value to be stored as the method field of the InfoAccess.
- *  "generalName"
- *      The GeneralName to be stored as the generalName field of the InfoAccess.
+ *  "gName"
+ *      The GeneralName to be stored as the gName field of the InfoAccess.
  *      Must be non-NULL.
  *  "pInfoAccess"
  *      Address where the result is stored. Must be non-NULL.
@@ -39,7 +39,7 @@
 static PKIX_Error *
 pkix_pl_InfoAccess_Create(
         PKIX_UInt32 method,
-        PKIX_PL_GeneralName *generalName,
+        PKIX_PL_GeneralName *gName,
         PKIX_PL_InfoAccess **pInfoAccess,
         void *plContext)
 {
@@ -47,7 +47,7 @@ pkix_pl_InfoAccess_Create(
         PKIX_PL_InfoAccess *infoAccess = NULL;
 
         PKIX_ENTER(INFOACCESS, "pkix_pl_InfoAccess_Create");
-        PKIX_NULLCHECK_TWO(generalName, pInfoAccess);
+        PKIX_NULLCHECK_TWO(gName, pInfoAccess);
 
         PKIX_CHECK(PKIX_PL_Object_Alloc
                 (PKIX_INFOACCESS_TYPE,
@@ -58,8 +58,8 @@ pkix_pl_InfoAccess_Create(
 
         infoAccess->method = method;
 
-        PKIX_INCREF(generalName);
-        infoAccess->location = generalName;
+        PKIX_INCREF(gName);
+        infoAccess->location = gName;
 
         *pInfoAccess = infoAccess;
         infoAccess = NULL;
@@ -678,7 +678,7 @@ pkix_pl_UnescapeURL(
  *   [binary|<other-type>]]*
  *
  * PARAMETERS
- *  "generalName"
+ *  "gName"
  *      Address of the GeneralName whose LDAPLocation is to be parsed. Must be
  *      non-NULL.
  *  "arena"
@@ -700,7 +700,7 @@ pkix_pl_UnescapeURL(
  */
 PKIX_Error *
 pkix_pl_InfoAccess_ParseLocation(
-        PKIX_PL_GeneralName *generalName,
+        PKIX_PL_GeneralName *gName,
         PLArenaPool *arena,
         LDAPRequestParams *request,
         char **pDomainName,
@@ -722,9 +722,9 @@ pkix_pl_InfoAccess_ParseLocation(
         LDAPNameComponent *nameComponent = NULL;
 
         PKIX_ENTER(INFOACCESS, "pkix_pl_InfoAccess_ParseLocation");
-        PKIX_NULLCHECK_FOUR(generalName, arena, request, pDomainName);
+        PKIX_NULLCHECK_FOUR(gName, arena, request, pDomainName);
 
-        PKIX_TOSTRING(generalName, &locationString, plContext,
+        PKIX_TOSTRING(gName, &locationString, plContext,
                 PKIX_GENERALNAMETOSTRINGFAILED);
 
         PKIX_CHECK(PKIX_PL_String_GetEncoded
diff --git a/lib/pk11wrap/pk11pars.c b/lib/pk11wrap/pk11pars.c
index fc30222b3..c165e1ef2 100644
--- a/lib/pk11wrap/pk11pars.c
+++ b/lib/pk11wrap/pk11pars.c
@@ -547,16 +547,16 @@ secmod_applyCryptoPolicy(const char *policyString,
         for (i = 0; i < PR_ARRAY_SIZE(algOptList); i++) {
             const oidValDef *algOpt = &algOptList[i];
             unsigned name_size = algOpt->name_size;
-            PRBool newValue = PR_FALSE;
+            PRBool newOption = PR_FALSE;
 
             if ((length >= name_size) && (cipher[name_size] == '/')) {
-                newValue = PR_TRUE;
+                newOption = PR_TRUE;
             }
-            if ((newValue || algOpt->name_size == length) &&
+            if ((newOption || algOpt->name_size == length) &&
                 PORT_Strncasecmp(algOpt->name, cipher, name_size) == 0) {
                 PRUint32 value = algOpt->val;
                 PRUint32 enable, disable;
-                if (newValue) {
+                if (newOption) {
                     value = secmod_parsePolicyValue(&cipher[name_size] + 1,
                                                     length - name_size - 1);
                 }
diff --git a/lib/pkcs7/p7decode.c b/lib/pkcs7/p7decode.c
index 658c61e44..62bc9f766 100644
--- a/lib/pkcs7/p7decode.c
+++ b/lib/pkcs7/p7decode.c
@@ -1590,7 +1590,6 @@ sec_pkcs7_verify_signature(SEC_PKCS7ContentInfo *cinfo,
     } else {
         SECItem *sig;
         SECItem holder;
-        SECStatus rv;
 
         /*
          * No authenticated attributes.
diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
index fb3110a23..fab3a7a02 100644
--- a/lib/pki/pki3hack.c
+++ b/lib/pki/pki3hack.c
@@ -1143,8 +1143,8 @@ STAN_ChangeCertTrust(CERTCertificate *cc, CERTCertTrust *trust)
         (PRBool)(trust->sslFlags & CERTDB_GOVT_APPROVED_CA);
     if (c->object.cryptoContext != NULL) {
         /* The cert is in a context, set the trust there */
-        NSSCryptoContext *cc = c->object.cryptoContext;
-        nssrv = nssCryptoContext_ImportTrust(cc, nssTrust);
+        NSSCryptoContext *cctx = c->object.cryptoContext;
+        nssrv = nssCryptoContext_ImportTrust(cctx, nssTrust);
         if (nssrv != PR_SUCCESS) {
             goto done;
         }
diff --git a/lib/smime/cmsrecinfo.c b/lib/smime/cmsrecinfo.c
index 2efb6b1f2..8cab288d2 100644
--- a/lib/smime/cmsrecinfo.c
+++ b/lib/smime/cmsrecinfo.c
@@ -82,7 +82,7 @@ nss_cmsrecipientinfo_create(NSSCMSMessage *cmsg,
     if (DERinput) {
         /* decode everything from DER */
         SECItem newinput;
-        SECStatus rv = SECITEM_CopyItem(poolp, &newinput, DERinput);
+        rv = SECITEM_CopyItem(poolp, &newinput, DERinput);
         if (SECSuccess != rv)
             goto loser;
         rv = SEC_QuickDERDecodeItem(poolp, ri, NSSCMSRecipientInfoTemplate, &newinput);
diff --git a/lib/softoken/lowpbe.c b/lib/softoken/lowpbe.c
index 0a47804bf..4a101c68c 100644
--- a/lib/softoken/lowpbe.c
+++ b/lib/softoken/lowpbe.c
@@ -1073,15 +1073,15 @@ sec_pkcs5_rc2(SECItem *key, SECItem *iv, SECItem *src, PRBool dummy,
     }
 
     if (encrypt != PR_FALSE) {
-        void *dummy;
+        void *v;
 
-        dummy = CBC_PadBuffer(NULL, dup_src->data,
-                              dup_src->len, &dup_src->len, 8 /* RC2_BLOCK_SIZE */);
-        if (dummy == NULL) {
+        v = CBC_PadBuffer(NULL, dup_src->data,
+                          dup_src->len, &dup_src->len, 8 /* RC2_BLOCK_SIZE */);
+        if (v == NULL) {
             SECITEM_FreeItem(dup_src, PR_TRUE);
             return NULL;
         }
-        dup_src->data = (unsigned char *)dummy;
+        dup_src->data = (unsigned char *)v;
     }
 
     dest = (SECItem *)PORT_ZAlloc(sizeof(SECItem));
diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c
index 77882a274..34f25a9d0 100644
--- a/lib/softoken/pkcs11.c
+++ b/lib/softoken/pkcs11.c
@@ -1343,7 +1343,6 @@ sftk_handleSecretKeyObject(SFTKSession *session, SFTKObject *object,
     if (sftk_isTrue(object, CKA_TOKEN)) {
         SFTKSlot *slot = session->slot;
         SFTKDBHandle *keyHandle = sftk_getKeyDB(slot);
-        CK_RV crv;
 
         if (keyHandle == NULL) {
             return CKR_TOKEN_WRITE_PROTECTED;
@@ -3807,12 +3806,12 @@ NSC_SetPIN(CK_SESSION_HANDLE hSession, CK_CHAR_PTR pOldPin,
         PZ_Unlock(slot->slotLock);
         /* Reset login flags. */
         if (ulNewLen == 0) {
-            PRBool tokenRemoved = PR_FALSE;
             PZ_Lock(slot->slotLock);
             slot->isLoggedIn = PR_FALSE;
             slot->ssoLoggedIn = PR_FALSE;
             PZ_Unlock(slot->slotLock);
 
+            tokenRemoved = PR_FALSE;
             rv = sftkdb_CheckPassword(handle, "", &tokenRemoved);
             if (tokenRemoved) {
                 sftk_CloseAllSessions(slot, PR_FALSE);
@@ -4422,6 +4421,44 @@ NSC_GetObjectSize(CK_SESSION_HANDLE hSession,
     return CKR_OK;
 }
 
+static CK_RV
+nsc_GetTokenAttributeValue(SFTKSession *session, CK_OBJECT_HANDLE hObject,
+                           CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount)
+{
+    SFTKSlot *slot = sftk_SlotFromSession(session);
+    SFTKDBHandle *dbHandle = sftk_getDBForTokenObject(slot, hObject);
+    SFTKDBHandle *keydb = NULL;
+    CK_RV crv;
+
+    if (dbHandle == NULL) {
+        return CKR_OBJECT_HANDLE_INVALID;
+    }
+
+    crv = sftkdb_GetAttributeValue(dbHandle, hObject, pTemplate, ulCount);
+
+    /* make sure we don't export any sensitive information */
+    keydb = sftk_getKeyDB(slot);
+    if (dbHandle == keydb) {
+        CK_ULONG i;
+        for (i = 0; i < ulCount; i++) {
+            if (sftk_isSensitive(pTemplate[i].type, CKO_PRIVATE_KEY)) {
+                crv = CKR_ATTRIBUTE_SENSITIVE;
+                if (pTemplate[i].pValue && (pTemplate[i].ulValueLen != -1)) {
+                    PORT_Memset(pTemplate[i].pValue, 0,
+                                pTemplate[i].ulValueLen);
+                }
+                pTemplate[i].ulValueLen = -1;
+            }
+        }
+    }
+
+    sftk_freeDB(dbHandle);
+    if (keydb) {
+        sftk_freeDB(keydb);
+    }
+    return crv;
+}
+
 /* NSC_GetAttributeValue obtains the value of one or more object attributes. */
 CK_RV
 NSC_GetAttributeValue(CK_SESSION_HANDLE hSession,
@@ -4450,37 +4487,8 @@ NSC_GetAttributeValue(CK_SESSION_HANDLE hSession,
 
     /* short circuit everything for token objects */
     if (sftk_isToken(hObject)) {
-        SFTKSlot *slot = sftk_SlotFromSession(session);
-        SFTKDBHandle *dbHandle = sftk_getDBForTokenObject(slot, hObject);
-        SFTKDBHandle *keydb = NULL;
-
-        if (dbHandle == NULL) {
-            sftk_FreeSession(session);
-            return CKR_OBJECT_HANDLE_INVALID;
-        }
-
-        crv = sftkdb_GetAttributeValue(dbHandle, hObject, pTemplate, ulCount);
-
-        /* make sure we don't export any sensitive information */
-        keydb = sftk_getKeyDB(slot);
-        if (dbHandle == keydb) {
-            for (i = 0; i < (int)ulCount; i++) {
-                if (sftk_isSensitive(pTemplate[i].type, CKO_PRIVATE_KEY)) {
-                    crv = CKR_ATTRIBUTE_SENSITIVE;
-                    if (pTemplate[i].pValue && (pTemplate[i].ulValueLen != -1)) {
-                        PORT_Memset(pTemplate[i].pValue, 0,
-                                    pTemplate[i].ulValueLen);
-                    }
-                    pTemplate[i].ulValueLen = -1;
-                }
-            }
-        }
-
+        crv = nsc_GetTokenAttributeValue(session, hObject, pTemplate, ulCount);
         sftk_FreeSession(session);
-        sftk_freeDB(dbHandle);
-        if (keydb) {
-            sftk_freeDB(keydb);
-        }
         return crv;
     }
 
diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
index d675d7331..e39e533da 100644
--- a/lib/softoken/pkcs11c.c
+++ b/lib/softoken/pkcs11c.c
@@ -7575,13 +7575,13 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
                 (const CK_NSS_HKDFParams *)pMechanism->pParameter;
             const SECHashObject *rawHash;
             unsigned hashLen;
-            CK_BYTE buf[HASH_LENGTH_MAX];
+            CK_BYTE hashbuf[HASH_LENGTH_MAX];
             CK_BYTE *prk; /* psuedo-random key */
             CK_ULONG prkLen;
             CK_BYTE *okm; /* output keying material */
 
             rawHash = HASH_GetRawHashObject(hashType);
-            if (rawHash == NULL || rawHash->length > sizeof buf) {
+            if (rawHash == NULL || rawHash->length > sizeof(hashbuf)) {
                 crv = CKR_FUNCTION_FAILED;
                 break;
             }
@@ -7615,7 +7615,7 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
                 saltLen = params->ulSaltLen;
                 if (salt == NULL) {
                     saltLen = hashLen;
-                    salt = buf;
+                    salt = hashbuf;
                     memset(salt, 0, saltLen);
                 }
                 hmac = HMAC_Create(rawHash, salt, saltLen, isFIPS);
@@ -7626,10 +7626,10 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
                 HMAC_Begin(hmac);
                 HMAC_Update(hmac, (const unsigned char *)att->attrib.pValue,
                             att->attrib.ulValueLen);
-                HMAC_Finish(hmac, buf, &bufLen, sizeof(buf));
+                HMAC_Finish(hmac, hashbuf, &bufLen, sizeof(hashbuf));
                 HMAC_Destroy(hmac, PR_TRUE);
                 PORT_Assert(bufLen == rawHash->length);
-                prk = buf;
+                prk = hashbuf;
                 prkLen = bufLen;
             } else {
                 /* PRK = base key value */
@@ -7646,24 +7646,24 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
                  * key material = T(1) | ... | T(n)
                  */
                 HMACContext *hmac;
-                CK_BYTE i;
+                CK_BYTE bi;
                 unsigned iterations = PR_ROUNDUP(keySize, hashLen) / hashLen;
                 hmac = HMAC_Create(rawHash, prk, prkLen, isFIPS);
                 if (hmac == NULL) {
                     crv = CKR_HOST_MEMORY;
                     break;
                 }
-                for (i = 1; i <= iterations; ++i) {
+                for (bi = 1; bi <= iterations; ++bi) {
                     unsigned len;
                     HMAC_Begin(hmac);
-                    if (i > 1) {
-                        HMAC_Update(hmac, key_block + ((i - 2) * hashLen), hashLen);
+                    if (bi > 1) {
+                        HMAC_Update(hmac, key_block + ((bi - 2) * hashLen), hashLen);
                     }
                     if (params->ulInfoLen != 0) {
                         HMAC_Update(hmac, params->pInfo, params->ulInfoLen);
                     }
-                    HMAC_Update(hmac, &i, 1);
-                    HMAC_Finish(hmac, key_block + ((i - 1) * hashLen), &len,
+                    HMAC_Update(hmac, &bi, 1);
+                    HMAC_Finish(hmac, key_block + ((bi - 1) * hashLen), &len,
                                 hashLen);
                     PORT_Assert(len == hashLen);
                 }
diff --git a/lib/softoken/pkcs11u.c b/lib/softoken/pkcs11u.c
index 27e411759..bcad22eff 100644
--- a/lib/softoken/pkcs11u.c
+++ b/lib/softoken/pkcs11u.c
@@ -1193,7 +1193,7 @@ sftk_DeleteObject(SFTKSession *session, SFTKObject *object)
 
     /* Handle Token case */
     if (so && so->session) {
-        SFTKSession *session = so->session;
+        session = so->session;
         PZ_Lock(session->objectLock);
         sftkqueue_delete(&so->sessionList, 0, session->objects, 0);
         PZ_Unlock(session->objectLock);
diff --git a/lib/softoken/sftkpars.c b/lib/softoken/sftkpars.c
index e972fe854..5e96a1c04 100644
--- a/lib/softoken/sftkpars.c
+++ b/lib/softoken/sftkpars.c
@@ -162,7 +162,7 @@ sftk_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS)
     }
     if (parsed->tokens == NULL) {
         int count = isFIPS ? 1 : 2;
-        int index = count - 1;
+        int i = count - 1;
         sftk_token_parameters *tokens = NULL;
 
         tokens = (sftk_token_parameters *)
@@ -172,30 +172,30 @@ sftk_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS)
         }
         parsed->tokens = tokens;
         parsed->token_count = count;
-        tokens[index].slotID = isFIPS ? FIPS_SLOT_ID : PRIVATE_KEY_SLOT_ID;
-        tokens[index].certPrefix = certPrefix;
-        tokens[index].keyPrefix = keyPrefix;
-        tokens[index].minPW = minPW ? atoi(minPW) : 0;
-        tokens[index].readOnly = parsed->readOnly;
-        tokens[index].noCertDB = parsed->noCertDB;
-        tokens[index].noKeyDB = parsed->noCertDB;
-        tokens[index].forceOpen = parsed->forceOpen;
-        tokens[index].pwRequired = parsed->pwRequired;
-        tokens[index].optimizeSpace = parsed->optimizeSpace;
+        tokens[i].slotID = isFIPS ? FIPS_SLOT_ID : PRIVATE_KEY_SLOT_ID;
+        tokens[i].certPrefix = certPrefix;
+        tokens[i].keyPrefix = keyPrefix;
+        tokens[i].minPW = minPW ? atoi(minPW) : 0;
+        tokens[i].readOnly = parsed->readOnly;
+        tokens[i].noCertDB = parsed->noCertDB;
+        tokens[i].noKeyDB = parsed->noCertDB;
+        tokens[i].forceOpen = parsed->forceOpen;
+        tokens[i].pwRequired = parsed->pwRequired;
+        tokens[i].optimizeSpace = parsed->optimizeSpace;
         tokens[0].optimizeSpace = parsed->optimizeSpace;
         certPrefix = NULL;
         keyPrefix = NULL;
         if (isFIPS) {
-            tokens[index].tokdes = ftokdes;
-            tokens[index].updtokdes = pupdtokdes;
-            tokens[index].slotdes = fslotdes;
+            tokens[i].tokdes = ftokdes;
+            tokens[i].updtokdes = pupdtokdes;
+            tokens[i].slotdes = fslotdes;
             fslotdes = NULL;
             ftokdes = NULL;
             pupdtokdes = NULL;
         } else {
-            tokens[index].tokdes = ptokdes;
-            tokens[index].updtokdes = pupdtokdes;
-            tokens[index].slotdes = pslotdes;
+            tokens[i].tokdes = ptokdes;
+            tokens[i].updtokdes = pupdtokdes;
+            tokens[i].slotdes = pslotdes;
             tokens[0].slotID = NETSCAPE_SLOT_ID;
             tokens[0].tokdes = tokdes;
             tokens[0].slotdes = slotdes;
diff --git a/lib/ssl/ssl3con.c b/lib/ssl/ssl3con.c
index 89fd06dfc..df9d8cb6c 100644
--- a/lib/ssl/ssl3con.c
+++ b/lib/ssl/ssl3con.c
@@ -3034,7 +3034,6 @@ ssl3_SendChangeCipherSpecsInt(sslSocket *ss)
             return SECFailure; /* error code set by ssl3_SendRecord */
         }
     } else {
-        SECStatus rv;
         rv = dtls_QueueMessage(ss, content_change_cipher_spec, &change, 1);
         if (rv != SECSuccess) {
             return SECFailure;
@@ -11708,7 +11707,7 @@ ssl_RemoveTLSCBCPadding(sslBuffer *plaintext, unsigned int macSize)
     }
 
     for (i = 0; i < toCheck; i++) {
-        unsigned int t = paddingLength - i;
+        t = paddingLength - i;
         /* If i <= paddingLength then the MSB of t is zero and mask is
          * 0xff.  Otherwise, mask is 0. */
         unsigned char mask = DUPLICATE_MSB_TO_ALL(~t);
diff --git a/nss-tool/enc/enctool.cc b/nss-tool/enc/enctool.cc
index b3c0d1dbe..e37e4593a 100644
--- a/nss-tool/enc/enctool.cc
+++ b/nss-tool/enc/enctool.cc
@@ -271,7 +271,6 @@ bool EncTool::DoCipher(std::string file_name, std::string out_file,
   if (file_name.empty()) {
     std::vector<uint8_t> data = ReadInputData("");
     std::vector<uint8_t> out(data.size() + 16);
-    SECStatus rv;
     if (encrypt) {
       rv = PK11_Encrypt(symKey.get(), cipher_mech_, params.get(), out.data(),
                         &outLen, data.size() + 16, data.data(), data.size());