diff --git a/openbsc/src/gprs/gb_proxy.c b/openbsc/src/gprs/gb_proxy.c
index 3c41529..3639650 100644
--- a/openbsc/src/gprs/gb_proxy.c
+++ b/openbsc/src/gprs/gb_proxy.c
@@ -736,7 +736,6 @@ int gbprox_signal(unsigned int subsys, unsigned int signal,
 {
 	struct ns_signal_data *nssd = signal_data;
 	struct gprs_nsvc *nsvc = nssd->nsvc;
-	struct gbprox_peer *peer;
 
 	if (subsys != SS_L_NS)
 		return 0;
@@ -759,6 +758,7 @@ int gbprox_signal(unsigned int subsys, unsigned int signal,
 	}
 
 	if (!nsvc->remote_end_is_sgsn) {
+		struct gbprox_peer *peer;
 		/* from BSS to SGSN */
 		peer = peer_by_nsei(nsvc->nsei);
 		if (!peer) {
diff --git a/openbsc/src/ipaccess/ipaccess-find.c b/openbsc/src/ipaccess/ipaccess-find.c
index c8de157..19acf26 100644
--- a/openbsc/src/ipaccess/ipaccess-find.c
+++ b/openbsc/src/ipaccess/ipaccess-find.c
@@ -173,7 +173,6 @@ int main(int argc, char **argv)
 {
 	struct osmo_fd bfd;
 	char *ifname = NULL;
-	int rc;
 
 	printf("ipaccess-find (C) 2009 by Harald Welte\n");
 	printf("This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY\n\n");
@@ -203,6 +202,7 @@ int main(int argc, char **argv)
 	printf("Trying to find ip.access BTS by broadcast UDP...\n");
 
 	while (1) {
+		int rc;
 		rc = osmo_select_main(0);
 		if (rc < 0)
 			exit(3);
diff --git a/openbsc/src/libbsc/abis_nm.c b/openbsc/src/libbsc/abis_nm.c
index 3bf55ec..00fd479 100644
--- a/openbsc/src/libbsc/abis_nm.c
+++ b/openbsc/src/libbsc/abis_nm.c
@@ -278,7 +278,6 @@ static int rx_fail_evt_rep(struct msgb *mb)
 	struct e1inp_sign_link *sign_link = mb->dst;
 	struct tlv_parsed tp;
 	const uint8_t *p_val;
-	char *p_text;
 
 	LOGPC(DNM, LOGL_ERROR, "Failure Event Report ");
 	
@@ -295,6 +294,7 @@ static int rx_fail_evt_rep(struct msgb *mb)
 		LOGPC(DNM, LOGL_ERROR, "Probable cause= %02X %02X %02X ", p_val[0], p_val[1], p_val[2]);
 	}
 	if (TLVP_PRESENT(&tp, NM_ATT_ADD_TEXT)) {
+		char *p_text;
 		p_val = TLVP_VAL(&tp, NM_ATT_ADD_TEXT);
 		p_text = talloc_strndup(tall_bsc_ctx, (const char *) p_val, TLVP_LEN(&tp, NM_ATT_ADD_TEXT));
 		if (p_text) {
@@ -544,9 +544,10 @@ static int abis_nm_rx_lmt_event(struct msgb *mb)
 void abis_nm_queue_send_next(struct gsm_bts *bts)
 {
 	int wait = 0;
-	struct msgb *msg;
+
 	/* the queue is empty */
 	while (!llist_empty(&bts->abis_queue)) {
+		struct msgb *msg;
 		msg = msgb_dequeue(&bts->abis_queue);
 		wait = OBSC_NM_W_ACK_CB(msg);
 		_abis_nm_sendmsg(msg);
@@ -1066,9 +1067,8 @@ static void sw_close_file(struct abis_nm_sw *sw)
 /* Fill the window */
 static int sw_fill_window(struct abis_nm_sw *sw)
 {
-	int rc;
-
 	while (sw->seg_in_window < sw->window_size) {
+		int rc;
 		rc = sw_load_segment(sw);
 		if (rc < 0)
 			return rc;
@@ -2738,9 +2738,8 @@ int ipac_parse_bcch_info(struct ipac_bcch_info *binf, uint8_t *buf)
 
 void abis_nm_clear_queue(struct gsm_bts *bts)
 {
-	struct msgb *msg;
-
 	while (!llist_empty(&bts->abis_queue)) {
+		struct msgb *msg;
 		msg = msgb_dequeue(&bts->abis_queue);
 		msgb_free(msg);
 	}
diff --git a/openbsc/src/libbsc/abis_rsl.c b/openbsc/src/libbsc/abis_rsl.c
index 425dd8d..398f243 100644
--- a/openbsc/src/libbsc/abis_rsl.c
+++ b/openbsc/src/libbsc/abis_rsl.c
@@ -1089,7 +1089,6 @@ static int rsl_rx_meas_res(struct msgb *msg)
 	struct gsm_meas_rep *mr = lchan_next_meas_rep(msg->lchan);
 	uint8_t len;
 	const uint8_t *val;
-	int rc;
 
 	/* check if this channel is actually active */
 	/* FIXME: maybe this check should be way more generic/centralized */
@@ -1145,6 +1144,7 @@ static int rsl_rx_meas_res(struct msgb *msg)
 			mr->ms_l1.ta >>= 2;
 	}
 	if (TLVP_PRESENT(&tp, RSL_IE_L3_INFO)) {
+		int rc;
 		msg->l3h = (uint8_t *) TLVP_VAL(&tp, RSL_IE_L3_INFO);
 		rc = gsm48_parse_meas_rep(mr, msg);
 		if (rc < 0)
diff --git a/openbsc/src/libbsc/arfcn_range_encode.c b/openbsc/src/libbsc/arfcn_range_encode.c
index e67bf0a..d2230a6 100644
--- a/openbsc/src/libbsc/arfcn_range_encode.c
+++ b/openbsc/src/libbsc/arfcn_range_encode.c
@@ -54,12 +54,12 @@ static inline int mod(int data, int range)
  */
 int range_enc_find_index(const int range, const int *freqs, const int size)
 {
-	int i, j, n;
+	int i, j;
 
 	const int RANGE_DELTA = (range - 1) / 2;
 
 	for (i = 0; i < size; ++i) {
-		n = 0;
+		int n = 0;
 		for (j = 0; j < size; ++j) {
 			if (mod(freqs[j] - freqs[i], range) <= RANGE_DELTA)
 				n += 1;
diff --git a/openbsc/src/libbsc/bsc_api.c b/openbsc/src/libbsc/bsc_api.c
index e567038..0a8a2a8 100644
--- a/openbsc/src/libbsc/bsc_api.c
+++ b/openbsc/src/libbsc/bsc_api.c
@@ -639,7 +639,6 @@ static void dispatch_dtap(struct gsm_subscriber_connection *conn,
 /*! \brief RSL has received a DATA INDICATION with L3 from MS */
 int gsm0408_rcvmsg(struct msgb *msg, uint8_t link_id)
 {
-	int rc;
 	struct bsc_api *api = msg->lchan->ts->trx->bts->network->bsc_api;
 	struct gsm_lchan *lchan;
 
@@ -657,6 +656,7 @@ int gsm0408_rcvmsg(struct msgb *msg, uint8_t link_id)
 		dispatch_dtap(lchan->conn, link_id, msg);
 	} else {
 		/* allocate a new connection */
+		int rc;
 		rc = BSC_API_CONN_POL_REJECT;
 		lchan->conn = subscr_con_allocate(msg->lchan);
 		if (!lchan->conn) {
diff --git a/openbsc/src/libbsc/bsc_vty.c b/openbsc/src/libbsc/bsc_vty.c
index 9129059..d1ef244 100644
--- a/openbsc/src/libbsc/bsc_vty.c
+++ b/openbsc/src/libbsc/bsc_vty.c
@@ -1037,8 +1037,7 @@ static int lchan_summary(struct vty *vty, int argc, const char **argv,
 	struct gsm_bts *bts;
 	struct gsm_bts_trx *trx;
 	struct gsm_bts_trx_ts *ts;
-	struct gsm_lchan *lchan;
-	int bts_nr, trx_nr, ts_nr, lchan_nr;
+	int bts_nr;
 
 	if (argc >= 1) {
 		/* use the BTS number that the user has specified */
@@ -1054,7 +1053,7 @@ static int lchan_summary(struct vty *vty, int argc, const char **argv,
 			return dump_lchan_bts(bts, vty, dump_cb);
 	}
 	if (argc >= 2) {
-		trx_nr = atoi(argv[1]);
+		int trx_nr = atoi(argv[1]);
 		if (trx_nr >= bts->num_trx) {
 			vty_out(vty, "%% can't find TRX %s%s", argv[1],
 				VTY_NEWLINE);
@@ -1066,7 +1065,7 @@ static int lchan_summary(struct vty *vty, int argc, const char **argv,
 			return dump_lchan_trx(trx, vty, dump_cb);
 	}
 	if (argc >= 3) {
-		ts_nr = atoi(argv[2]);
+		int ts_nr = atoi(argv[2]);
 		if (ts_nr >= TRX_NR_TS) {
 			vty_out(vty, "%% can't find TS %s%s", argv[2],
 				VTY_NEWLINE);
@@ -1078,6 +1077,8 @@ static int lchan_summary(struct vty *vty, int argc, const char **argv,
 			return dump_lchan_trx_ts(ts, vty, dump_cb);
 	}
 	if (argc >= 4) {
+		struct gsm_lchan *lchan;
+		int lchan_nr;
 		lchan_nr = atoi(argv[3]);
 		if (lchan_nr >= TS_MAX_LCHAN) {
 			vty_out(vty, "%% can't find LCHAN %s%s", argv[3],
diff --git a/openbsc/src/libbsc/bts_nokia_site.c b/openbsc/src/libbsc/bts_nokia_site.c
index 376a048..ae13335 100644
--- a/openbsc/src/libbsc/bts_nokia_site.c
+++ b/openbsc/src/libbsc/bts_nokia_site.c
@@ -1164,7 +1164,6 @@ static int abis_nm_send_multi_segments(struct gsm_bts *bts, uint8_t msg_type,
 
 	while (len_remain) {
 		struct abis_om_hdr *oh;
-		struct abis_om_nokia_hdr *noh;
 		struct msgb *msg = nm_msgb_alloc();
 
 		if (seq == 0)
@@ -1176,6 +1175,7 @@ static int abis_nm_send_multi_segments(struct gsm_bts *bts, uint8_t msg_type,
 			len_to_send = max_send;
 
 			if (seq == 0) {
+				struct abis_om_nokia_hdr *noh;
 				/* first segment */
 				oh = (struct abis_om_hdr *)msgb_put(msg,
 								    ABIS_OM_NOKIA_HDR_SIZE
@@ -1307,10 +1307,10 @@ static int find_element(uint8_t * data, int len, uint16_t id, uint8_t * value,
 	uint8_t ub;
 	int idx = 0;
 	int found = 0;
-	int constructed __attribute__((unused));
 	uint16_t id_value;
 
 	for (;;) {
+		int constructed __attribute__((unused));
 
 		GET_NEXT_BYTE;
 
@@ -1365,11 +1365,11 @@ static int dump_elements(uint8_t * data, int len)
 {
 	uint8_t ub;
 	int idx = 0;
-	int constructed;
 	uint16_t id_value;
 	static char indent[100] = "";	/* TODO: move static to BTS context */
 
 	for (;;) {
+		int constructed;
 
 		GET_NEXT_BYTE;
 
@@ -1423,9 +1423,9 @@ static int dump_elements(uint8_t * data, int len)
 static void nokia_abis_nm_queue_send_next(struct gsm_bts *bts)
 {
 	int wait = 0;
-	struct msgb *msg;
 	/* the queue is empty */
 	while (!llist_empty(&bts->abis_queue)) {
+		struct msgb *msg;
 		msg = msgb_dequeue(&bts->abis_queue);
 		wait = OBSC_NM_W_ACK_CB(msg);
 		abis_sendmsg(msg);
diff --git a/openbsc/src/libbsc/chan_alloc.c b/openbsc/src/libbsc/chan_alloc.c
index 9b74329..255c79d 100644
--- a/openbsc/src/libbsc/chan_alloc.c
+++ b/openbsc/src/libbsc/chan_alloc.c
@@ -432,9 +432,9 @@ struct gsm_subscriber_connection *connection_for_subscr(struct gsm_subscriber *s
 {
 	struct gsm_bts *bts;
 	struct gsm_network *net = subscr->net;
-	struct gsm_lchan *lchan;
 
 	llist_for_each_entry(bts, &net->bts_list, list) {
+		struct gsm_lchan *lchan;
 		lchan = lchan_find(bts, subscr);
 		if (lchan)
 			return lchan->conn;
diff --git a/openbsc/src/libbsc/system_information.c b/openbsc/src/libbsc/system_information.c
index a3deefc..7b7b3d7 100644
--- a/openbsc/src/libbsc/system_information.c
+++ b/openbsc/src/libbsc/system_information.c
@@ -334,7 +334,6 @@ static int bitvec2freq_list(uint8_t *chan_list, struct bitvec *bv,
 static int generate_bcch_chan_list(uint8_t *chan_list, struct gsm_bts *bts,
 	int si5, int bis, int ter)
 {
-	struct gsm_bts *cur_bts;
 	struct bitvec *bv;
 
 	if (si5 && bts->neigh_list_manual_mode == NL_MODE_MANUAL_SI5SEP)
@@ -344,6 +343,8 @@ static int generate_bcch_chan_list(uint8_t *chan_list, struct gsm_bts *bts,
 
 	/* Generate list of neighbor cells if we are in automatic mode */
 	if (bts->neigh_list_manual_mode == NL_MODE_AUTOMATIC) {
+		struct gsm_bts *cur_bts;
+
 		/* Zero-initialize the bit-vector */
 		memset(bv->data, 0, bv->data_len);
 
diff --git a/openbsc/src/libcommon/gsm_data.c b/openbsc/src/libcommon/gsm_data.c
index 5f7e32e..5b42269 100644
--- a/openbsc/src/libcommon/gsm_data.c
+++ b/openbsc/src/libcommon/gsm_data.c
@@ -231,13 +231,13 @@ struct gsm_bts *gsm_bts_by_lac(struct gsm_network *net, unsigned int lac,
 				struct gsm_bts *start_bts)
 {
 	int i;
-	struct gsm_bts *bts;
 	int skip = 0;
 
 	if (start_bts)
 		skip = 1;
 
 	for (i = 0; i < net->num_bts; i++) {
+		struct gsm_bts *bts;
 		bts = gsm_bts_num(net, i);
 
 		if (skip) {
diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c
index df93433..0f77a86 100644
--- a/openbsc/src/libmsc/gsm_04_08.c
+++ b/openbsc/src/libmsc/gsm_04_08.c
@@ -680,7 +680,6 @@ int gsm48_tx_mm_info(struct gsm_subscriber_connection *conn)
 
 	time_t cur_t;
 	struct tm* gmt_time;
-	struct tm* local_time;
 	int tzunits;
 	int dst = 0;
 
@@ -781,6 +780,8 @@ int gsm48_tx_mm_info(struct gsm_subscriber_connection *conn)
 			dst = bts->tz.dst;
 	}
 	else {
+		struct tm* local_time;
+
 		/* Need to get GSM offset and convert into 15 min units */
 		/* This probably breaks if gmtoff returns a value not evenly divisible by 15? */
 		local_time = localtime(&cur_t);
@@ -1635,7 +1636,6 @@ static int tch_recv_mncc(struct gsm_network *net, uint32_t callref, int enable)
 	struct gsm_trans *trans;
 	struct gsm_lchan *lchan;
 	struct gsm_bts *bts;
-	int rc;
 
 	/* Find callref */
 	trans = trans_find_by_callref(net, callref);
@@ -1669,7 +1669,7 @@ static int tch_recv_mncc(struct gsm_network *net, uint32_t callref, int enable)
 		}
 		if (enable) {
 			/* connect the TCH's to our RTP proxy */
-			rc = rsl_ipacc_mdcx_to_rtpsock(lchan);
+			int rc = rsl_ipacc_mdcx_to_rtpsock(lchan);
 			if (rc < 0)
 				return rc;
 			/* assign socket to application interface */
@@ -2935,7 +2935,7 @@ static struct downstate {
 int mncc_tx_to_cc(struct gsm_network *net, int msg_type, void *arg)
 {
 	int i, rc = 0;
-	struct gsm_trans *trans = NULL, *transt;
+	struct gsm_trans *trans = NULL;
 	struct gsm_subscriber_connection *conn = NULL;
 	struct gsm_bts *bts = NULL;
 	struct gsm_mncc *data = arg, rel;
@@ -3069,6 +3069,8 @@ int mncc_tx_to_cc(struct gsm_network *net, int msg_type, void *arg)
 
 		/* If subscriber has no lchan */
 		if (!conn) {
+			struct gsm_trans *transt;
+
 			/* find transaction with this subscriber already paging */
 			llist_for_each_entry(transt, &net->trans_list, entry) {
 				/* Transaction of our lchan? */
diff --git a/openbsc/src/libmsc/transaction.c b/openbsc/src/libmsc/transaction.c
index e425e67..cde303f 100644
--- a/openbsc/src/libmsc/transaction.c
+++ b/openbsc/src/libmsc/transaction.c
@@ -125,7 +125,7 @@ int trans_assign_trans_id(struct gsm_subscriber *subscr,
 	struct gsm_network *net = subscr->net;
 	struct gsm_trans *trans;
 	unsigned int used_tid_bitmask = 0;
-	int i, j, h;
+	int i, h;
 
 	if (ti_flag)
 		ti_flag = 0x8;
@@ -144,7 +144,7 @@ int trans_assign_trans_id(struct gsm_subscriber *subscr,
 		if (used_tid_bitmask & (1 << (h | ti_flag)))
 			break;
 	for (i = 0; i < 7; i++) {
-		j = ((h + i) % 7) | ti_flag;
+		int j = ((h + i) % 7) | ti_flag;
 		if ((used_tid_bitmask & (1 << j)) == 0)
 			return j;
 	}
diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c
index 143bfa0..0b42b8d 100644
--- a/openbsc/src/libtrau/rtp_proxy.c
+++ b/openbsc/src/libtrau/rtp_proxy.c
@@ -111,11 +111,9 @@ static int rtp_decode(struct msgb *msg, uint32_t callref, struct msgb **data)
 	struct msgb *new_msg;
 	struct gsm_data_frame *frame;
 	struct rtp_hdr *rtph = (struct rtp_hdr *)msg->data;
-	struct rtp_x_hdr *rtpxh;
 	uint8_t *payload;
 	int payload_len;
 	int msg_type;
-	int x_len;
 
 	if (msg->len < 12) {
 		DEBUGPC(DLMUX, "received RTP frame too short (len = %d)\n",
@@ -135,6 +133,9 @@ static int rtp_decode(struct msgb *msg, uint32_t callref, struct msgb **data)
 		return -EINVAL;
 	}
 	if (rtph->extension) {
+		struct rtp_x_hdr *rtpxh;
+		int x_len;
+
 		if (payload_len < sizeof(struct rtp_x_hdr)) {
 			DEBUGPC(DLMUX, "received RTP frame too short for "
 				"extension header\n");
diff --git a/openbsc/src/libtrau/trau_mux.c b/openbsc/src/libtrau/trau_mux.c
index fd1895f..8ad045b 100644
--- a/openbsc/src/libtrau/trau_mux.c
+++ b/openbsc/src/libtrau/trau_mux.c
@@ -155,10 +155,10 @@ int trau_mux_map_lchan(const struct gsm_lchan *src,
 /* unmap one particular subslot from another subslot */
 int trau_mux_unmap(const struct gsm_e1_subslot *ss, uint32_t callref)
 {
-	struct map_entry *me, *me2;
 	struct upqueue_entry *ue, *ue2;
 
-	if (ss)
+	if (ss) {
+		struct map_entry *me, *me2;
 		llist_for_each_entry_safe(me, me2, &ss_map, list) {
 			if (!memcmp(&me->src, ss, sizeof(*ss)) ||
 			    !memcmp(&me->dst, ss, sizeof(*ss))) {
@@ -166,6 +166,8 @@ int trau_mux_unmap(const struct gsm_e1_subslot *ss, uint32_t callref)
 				return 0;
 			}
 		}
+	}
+
 	llist_for_each_entry_safe(ue, ue2, &ss_upqueue, list) {
 		if (ue->callref == callref) {
 			llist_del(&ue->list);
@@ -327,7 +329,6 @@ int trau_mux_input(struct gsm_e1_subslot *src_e1_ss,
 	uint8_t trau_bits_out[TRAU_FRAME_BITS];
 	struct gsm_e1_subslot *dst_e1_ss = lookup_trau_mux_map(src_e1_ss);
 	struct subch_mux *mx;
-	struct upqueue_entry *ue;
 	int rc;
 
 	/* decode TRAU, change it to downlink, re-encode */
@@ -337,6 +338,8 @@ int trau_mux_input(struct gsm_e1_subslot *src_e1_ss,
 
 	if (!dst_e1_ss) {
 		struct msgb *msg = NULL;
+		struct upqueue_entry *ue;
+
 		/* frame shall be sent to upqueue */
 		if (!(ue = lookup_trau_upqueue(src_e1_ss)))
 			return -EINVAL;
diff --git a/openbsc/src/osmo-bsc/osmo_bsc_filter.c b/openbsc/src/osmo-bsc/osmo_bsc_filter.c
index 608f525..229a59d 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_filter.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_filter.c
@@ -317,7 +317,6 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
 	struct osmo_msc_data *msc;
 	struct gsm_network *net;
-	struct gsm48_loc_area_id *lai;
 	struct gsm48_hdr *gh;
 	uint8_t mtype;
 	int length = msgb_l3len(msg);
@@ -336,6 +335,7 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg)
 
 	if (mtype == GSM48_MT_MM_LOC_UPD_ACCEPT) {
 		if (msc->core_ncc != -1 || msc->core_mcc != -1) {
+			struct gsm48_loc_area_id *lai;
 			if (msgb_l3len(msg) >= sizeof(*gh) + sizeof(*lai)) {
 				lai = (struct gsm48_loc_area_id *) &gh->data[0];
 				gsm48_generate_lai(lai, net->country_code,
diff --git a/openbsc/src/osmo-bsc/osmo_bsc_msc.c b/openbsc/src/osmo-bsc/osmo_bsc_msc.c
index 0acc290..064977f 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_msc.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_msc.c
@@ -407,9 +407,8 @@ static void send_lacs(struct gsm_network *net, struct bsc_msc_connection *conn)
 
 static void initialize_if_needed(struct bsc_msc_connection *conn)
 {
-	struct msgb *msg;
-
 	if (!conn->is_authenticated) {
+		struct msgb *msg;
 		/* send a gsm 08.08 reset message from here */
 		msg = gsm0808_create_reset();
 		if (!msg) {
diff --git a/openbsc/src/osmo-bsc/osmo_bsc_sccp.c b/openbsc/src/osmo-bsc/osmo_bsc_sccp.c
index 3dd0a52..bc7a314 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_sccp.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_sccp.c
@@ -41,9 +41,9 @@ static LLIST_HEAD(active_connections);
 
 static void free_queued(struct osmo_bsc_sccp_con *conn)
 {
-	struct msgb *msg;
-
 	while (!llist_empty(&conn->sccp_queue)) {
+		struct msgb *msg;
+
 		/* this is not allowed to fail */
 		msg = msgb_dequeue(&conn->sccp_queue);
 		msgb_free(msg);
@@ -54,9 +54,9 @@ static void free_queued(struct osmo_bsc_sccp_con *conn)
 
 static void send_queued(struct osmo_bsc_sccp_con *conn)
 {
-	struct msgb *msg;
-
 	while (!llist_empty(&conn->sccp_queue)) {
+		struct msgb *msg;
+
 		/* this is not allowed to fail */
 		msg = msgb_dequeue(&conn->sccp_queue);
 		sccp_connection_write(conn->sccp, msg);
diff --git a/openbsc/src/osmo-bsc_mgcp/mgcp_main.c b/openbsc/src/osmo-bsc_mgcp/mgcp_main.c
index 14ec221..deda5cc 100644
--- a/openbsc/src/osmo-bsc_mgcp/mgcp_main.c
+++ b/openbsc/src/osmo-bsc_mgcp/mgcp_main.c
@@ -143,7 +143,6 @@ static int read_call_agent(struct osmo_fd *fd, unsigned int what)
 	socklen_t slen = sizeof(addr);
 	struct msgb *msg;
 	struct msgb *resp;
-	int i;
 
 	msg = (struct msgb *) fd->data;
 
@@ -170,6 +169,7 @@ static int read_call_agent(struct osmo_fd *fd, unsigned int what)
 	}
 
 	if (reset_endpoints) {
+		int i;
 		LOGP(DMGCP, LOGL_NOTICE,
 		     "Asked to reset endpoints: %d/%d\n",
 		     reset_trunk->trunk_nr, reset_trunk->trunk_type);
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat.c b/openbsc/src/osmo-bsc_nat/bsc_nat.c
index 1aef27e..dd9d25a 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat.c
@@ -441,10 +441,11 @@ static void bsc_send_con_release(struct bsc_connection *bsc,
 
 	/* 2. release the BSC side */
 	if (con->con_type == NAT_CON_TYPE_LU) {
-		struct msgb *payload, *udt;
+		struct msgb *payload;
 		payload = gsm48_create_loc_upd_rej(cause->lu_reject_cause);
 
 		if (payload) {
+			struct msgb *udt;
 			gsm0808_prepend_dtap_header(payload, 0);
 			udt = sccp_create_dt1(&con->real_ref, payload->data, payload->len);
 			if (udt)
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_vty.c b/openbsc/src/osmo-bsc_nat/bsc_nat_vty.c
index 261a194..672ba40 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat_vty.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat_vty.c
@@ -541,10 +541,9 @@ DEFUN(cfg_nat_no_imsi_black_list_fn,
 static int replace_rules(struct bsc_nat *nat, char **name,
 			 struct llist_head *head, const char *file)
 {
-	struct osmo_config_list *rewr = NULL;
-
 	bsc_replace_string(nat, name, file);
 	if (*name) {
+		struct osmo_config_list *rewr;
 		rewr = osmo_config_list_parse(nat, *name);
 		bsc_nat_num_rewr_entry_adapt(nat, head, rewr);
 		talloc_free(rewr);
diff --git a/openbsc/src/osmo-bsc_nat/bsc_ussd.c b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
index 5f073bf..66d863e 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_ussd.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
@@ -372,7 +372,6 @@ int bsc_ussd_check(struct nat_sccp_connection *con, struct bsc_nat_parsed *parse
 	uint8_t proto;
 	uint8_t ti;
 	struct gsm48_hdr *hdr48;
-	struct bsc_nat_acc_lst *lst;
 	struct ussd_request req;
 
 	/*
@@ -412,6 +411,7 @@ int bsc_ussd_check(struct nat_sccp_connection *con, struct bsc_nat_parsed *parse
 		return 0;
 
 	if (msg_type == GSM0480_MTYPE_REGISTER) {
+		struct bsc_nat_acc_lst *lst;
 
 		/* now check if it is a IMSI we care about */
 		lst = bsc_nat_acc_lst_find(con->bsc->nat,
