diff --git a/daemon/9p.c b/daemon/9p.c
index 024ac2479..fefbb714a 100644
--- a/daemon/9p.c
+++ b/daemon/9p.c
@@ -64,8 +64,10 @@ do_list_9p (void)
   }
 
   while (1) {
+    struct dirent *d;
+
     errno = 0;
-    struct dirent *d = readdir (dir);
+    d = readdir (dir);
     if (d == NULL) break;
 
     if (STRPREFIX (d->d_name, "virtio")) {
diff --git a/daemon/base64.c b/daemon/base64.c
index 04b29fd63..35a5d2fa8 100644
--- a/daemon/base64.c
+++ b/daemon/base64.c
@@ -46,6 +46,7 @@ do_base64_in (const char *file)
   int err, r;
   FILE *fp;
   CLEANUP_FREE char *cmd = NULL;
+  int fd;
 
   if (asprintf_nowarn (&cmd, "%s -d -i > %R", str_base64, file) == -1) {
     err = errno;
@@ -70,7 +71,7 @@ do_base64_in (const char *file)
   /* The semantics of fwrite are too undefined, so write to the
    * file descriptor directly instead.
    */
-  int fd = fileno (fp);
+  fd = fileno (fp);
 
   r = receive_file (write_cb, &fd);
   if (r == -1) {		/* write error */
diff --git a/daemon/blkid.c b/daemon/blkid.c
index d52f6c5ca..83ff355d6 100644
--- a/daemon/blkid.c
+++ b/daemon/blkid.c
@@ -35,6 +35,7 @@ get_blkid_tag (const char *device, const char *tag)
   char *out;
   CLEANUP_FREE char *err = NULL;
   int r;
+  size_t len;
 
   r = commandr (&out, &err,
                 str_blkid,
@@ -59,7 +60,7 @@ get_blkid_tag (const char *device, const char *tag)
   }
 
   /* Trim trailing \n if present. */
-  size_t len = strlen (out);
+  len = strlen (out);
   if (len > 0 && out[len-1] == '\n')
     out[len-1] = '\0';
 
@@ -157,13 +158,14 @@ blkid_with_p_i_opt (const char *device)
    * PART_ENTRY_DISK=8:0
    */
   for (i = 0; lines[i] != NULL; ++i) {
+    char *eq;
     char *line = lines[i];
 
     /* Skip blank lines (shouldn't happen) */
     if (line[0] == '\0') continue;
 
     /* Split the line in 2 at the equals sign */
-    char *eq = strchr (line, '=');
+    eq = strchr (line, '=');
     if (eq) {
       *eq = '\0'; eq++;
 
diff --git a/daemon/btrfs.c b/daemon/btrfs.c
index a0c154223..7a4d43daf 100644
--- a/daemon/btrfs.c
+++ b/daemon/btrfs.c
@@ -96,12 +96,6 @@ do_mkfs_btrfs (char *const *devices,
                int nodesize, int sectorsize)
 {
   size_t nr_devices = count_strings (devices);
-
-  if (nr_devices == 0) {
-    reply_with_error ("list of devices must be non-empty");
-    return -1;
-  }
-
   size_t MAX_ARGS = nr_devices + 64;
   const char *argv[MAX_ARGS];
   size_t i = 0, j;
@@ -113,6 +107,11 @@ do_mkfs_btrfs (char *const *devices,
   char nodesize_s[64];
   char sectorsize_s[64];
 
+  if (nr_devices == 0) {
+    reply_with_error ("list of devices must be non-empty");
+    return -1;
+  }
+
   ADD_ARG (argv, i, str_mkfs_btrfs);
 
   /* Optional arguments. */
@@ -311,6 +310,9 @@ guestfs_int_btrfssubvolume_list *
 do_btrfs_subvolume_list (const mountable_t *fs)
 {
   char **lines;
+  size_t i = 0;
+  const size_t MAX_ARGS = 64;
+  const char *argv[MAX_ARGS];
 
   /* Execute 'btrfs subvolume list <fs>', and split the output into lines */
   {
@@ -351,9 +353,6 @@ do_btrfs_subvolume_list (const mountable_t *fs)
       }
     }
 
-    size_t i = 0;
-    const size_t MAX_ARGS = 64;
-    const char *argv[MAX_ARGS];
     ADD_ARG (argv, i, str_btrfs);
     ADD_ARG (argv, i, "subvolume");
     ADD_ARG (argv, i, "list");
diff --git a/generator/c.ml b/generator/c.ml
index c3185bea3..4b244a586 100644
--- a/generator/c.ml
+++ b/generator/c.ml
@@ -1034,6 +1034,8 @@ and generate_client_structs_copy () =
         pr "copy_%s (const struct guestfs_%s *inp, struct guestfs_%s *out)\n"
           typ typ typ;
         pr "{\n";
+        pr "  int err;\n";
+        pr "\n";
         List.iter (
           function
           | name, FString
@@ -1076,7 +1078,7 @@ and generate_client_structs_copy () =
         pr "  return 0;\n";
         pr "\n";
         pr "error: ;\n";
-        pr "  int err = errno;\n";
+        pr "  err = errno;\n";
         pr "  free_%s (out);\n" typ;
         pr "  errno = err;\n";
         pr "  return -1;\n";
@@ -1104,7 +1106,9 @@ and generate_client_structs_copy () =
       pr "\n";
       if has_boxed_cols then (
         pr "  if (copy_%s (inp, ret) == -1) {\n" typ;
-        pr "    int err = errno;\n";
+        pr "    int err;\n";
+        pr "\n";
+        pr "    err = errno;\n";
         pr "    free (ret);\n";
         pr "    errno = err;\n";
         pr "    return NULL;\n";
@@ -1120,8 +1124,11 @@ and generate_client_structs_copy () =
       pr "GUESTFS_DLL_PUBLIC struct guestfs_%s_list *\n" typ;
       pr "guestfs_copy_%s_list (const struct guestfs_%s_list *inp)\n" typ typ;
       pr "{\n";
+      pr "  int err;\n";
       pr "  struct guestfs_%s_list *ret;\n" typ;
       pr "  size_t i = 0;\n";
+      if has_boxed_cols then
+        pr "  size_t j;\n";
       pr "\n";
       pr "  ret = malloc (sizeof *ret);\n";
       pr "  if (ret == NULL)\n";
@@ -1144,9 +1151,8 @@ and generate_client_structs_copy () =
       pr "  return ret;\n";
       pr "\n";
       pr "error: ;\n";
-      pr "  int err = errno;\n";
+      pr "  err = errno;\n";
       if has_boxed_cols then (
-        pr "  size_t j;\n";
         pr "  for (j = 0; j < i; ++j)\n";
         pr "    free_%s (&ret->val[j]);\n" typ
       );
@@ -1837,8 +1843,9 @@ and generate_client_actions hash () =
     pr "\n";
 
     pr "  if (hdr.status == GUESTFS_STATUS_ERROR) {\n";
-    trace_return_error ~indent:4 name style errcode;
     pr "    int errnum = 0;\n";
+    pr "\n";
+    trace_return_error ~indent:4 name style errcode;
     pr "    if (err.errno_string[0] != '\\0')\n";
     pr "      errnum = guestfs___string_to_errno (err.errno_string);\n";
     pr "    if (errnum <= 0)\n";
@@ -1971,8 +1978,10 @@ and generate_client_actions_variants () =
     pr "{\n";
     pr "  va_list optargs;\n";
     pr "\n";
+    pr "  %sr;\n" rtype;
+    pr "\n";
     pr "  va_start (optargs, %s);\n" last_arg;
-    pr "  %sr = guestfs_%s_va " rtype c_name;
+    pr "  r = guestfs_%s_va " c_name;
     generate_c_call_args ~handle:"g" ~implicit_size_ptr:"size_r" style;
     pr ";\n";
     pr "  va_end (optargs);\n";
@@ -1987,6 +1996,7 @@ and generate_client_actions_variants () =
     pr "  struct guestfs_%s_argv optargs_s;\n" c_name;
     pr "  struct guestfs_%s_argv *optargs = &optargs_s;\n" c_name;
     pr "  int i;\n";
+    pr "  uint64_t i_mask;\n";
     pr "\n";
     pr "  optargs_s.bitmask = 0;\n";
     pr "\n";
@@ -2020,7 +2030,7 @@ and generate_client_actions_variants () =
     pr "      return %s;\n" (string_of_errcode errcode);
     pr "    }\n";
     pr "\n";
-    pr "    uint64_t i_mask = UINT64_C(1) << i;\n";
+    pr "    i_mask = UINT64_C(1) << i;\n";
     pr "    if (optargs_s.bitmask & i_mask) {\n";
     pr "      error (g, \"%%s: same optional argument specified more than once\",\n";
     pr "             \"%s\");\n" name;
diff --git a/src/alloc.c b/src/alloc.c
index e513d48ae..a7acdd340 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -116,9 +116,10 @@ guestfs___safe_asprintf (guestfs_h *g, const char *fs, ...)
 {
   va_list args;
   char *msg;
+  int err;
 
   va_start (args, fs);
-  int err = vasprintf (&msg, fs, args);
+  err = vasprintf (&msg, fs, args);
   va_end (args);
 
   if (err == -1)
diff --git a/src/command.c b/src/command.c
index 02e580135..4bb469b04 100644
--- a/src/command.c
+++ b/src/command.c
@@ -179,9 +179,10 @@ guestfs___cmd_add_arg_format (struct command *cmd, const char *fs, ...)
 {
   va_list args;
   char *arg;
+  int err;
 
   va_start (args, fs);
-  int err = vasprintf (&arg, fs, args);
+  err = vasprintf (&arg, fs, args);
   va_end (args);
 
   if (err < 0)
diff --git a/src/errors.c b/src/errors.c
index 008267f49..c51c4fa6a 100644
--- a/src/errors.c
+++ b/src/errors.c
@@ -118,9 +118,10 @@ guestfs___error_errno (guestfs_h *g, int errnum, const char *fs, ...)
 {
   va_list args;
   CLEANUP_FREE char *msg = NULL;
+  int err;
 
   va_start (args, fs);
-  int err = vasprintf (&msg, fs, args);
+  err = vasprintf (&msg, fs, args);
   va_end (args);
 
   if (err < 0) return;
@@ -138,14 +139,15 @@ guestfs___perrorf (guestfs_h *g, const char *fs, ...)
   va_list args;
   CLEANUP_FREE char *msg = NULL;
   int errnum = errno;
+  int err;
+  char buf[256];
 
   va_start (args, fs);
-  int err = vasprintf (&msg, fs, args);
+  err = vasprintf (&msg, fs, args);
   va_end (args);
 
   if (err < 0) return;
 
-  char buf[256];
   strerror_r (errnum, buf, sizeof buf);
 
   msg = safe_realloc (g, msg, strlen (msg) + 2 + strlen (buf) + 1);
diff --git a/src/filearch.c b/src/filearch.c
index 797814139..17f9e3885 100644
--- a/src/filearch.c
+++ b/src/filearch.c
@@ -81,6 +81,7 @@ static char *
 canonical_elf_arch (guestfs_h *g, const char *elf_arch)
 {
   const char *r;
+  char *ret;
 
   if (strstr (elf_arch, "Intel 80386"))
     r = "i386";
@@ -103,7 +104,7 @@ canonical_elf_arch (guestfs_h *g, const char *elf_arch)
   else
     r = elf_arch;
 
-  char *ret = safe_strdup (g, r);
+  ret = safe_strdup (g, r);
   return ret;
 }
 
@@ -193,10 +194,15 @@ cpio_arch (guestfs_h *g, const char *file, const char *path)
       safe_asprintf (g, "%s/%s", dir, initrd_binaries[i]);
 
     if (is_regular_file (bin)) {
-      int flags = g->verbose ? MAGIC_DEBUG : 0;
+      int flags;
+      magic_t m;
+      const char *line;
+      CLEANUP_FREE char *elf_arch = NULL;
+
+      flags = g->verbose ? MAGIC_DEBUG : 0;
       flags |= MAGIC_ERROR | MAGIC_RAW;
 
-      magic_t m = magic_open (flags);
+      m = magic_open (flags);
       if (m == NULL) {
         perrorf (g, "magic_open");
         goto out;
@@ -208,14 +214,14 @@ cpio_arch (guestfs_h *g, const char *file, const char *path)
         goto out;
       }
 
-      const char *line = magic_file (m, bin);
+      line = magic_file (m, bin);
       if (line == NULL) {
         perrorf (g, "magic_file: %s", bin);
         magic_close (m);
         goto out;
       }
 
-      CLEANUP_FREE char *elf_arch = match1 (g, line, re_file_elf);
+      elf_arch = match1 (g, line, re_file_elf);
       if (elf_arch != NULL) {
         ret = canonical_elf_arch (g, elf_arch);
         magic_close (m);
diff --git a/src/fuse.c b/src/fuse.c
index caf8719e9..dd63729cd 100644
--- a/src/fuse.c
+++ b/src/fuse.c
@@ -89,6 +89,7 @@ static struct guestfs_xattr_list *
 copy_xattr_list (guestfs_h *g, const struct guestfs_xattr *first, size_t num)
 {
   struct guestfs_xattr_list *xattrs;
+  size_t i;
 
   xattrs = malloc (sizeof *xattrs);
   if (xattrs == NULL) {
@@ -104,7 +105,6 @@ copy_xattr_list (guestfs_h *g, const struct guestfs_xattr *first, size_t num)
     return NULL;
   }
 
-  size_t i;
   for (i = 0; i < num; ++i) {
     xattrs->val[i].attrname = strdup (first[i].attrname);
     xattrs->val[i].attrval_len = first[i].attrval_len;
@@ -119,20 +119,21 @@ static int
 mount_local_readdir (const char *path, void *buf, fuse_fill_dir_t filler,
                      off_t offset, struct fuse_file_info *fi)
 {
+  time_t now;
+  size_t i;
+  char **names;
+  CLEANUP_FREE_DIRENT_LIST struct guestfs_dirent_list *ents = NULL;
   DECL_G ();
   DEBUG_CALL ("%s, %p, %ld", path, buf, (long) offset);
 
-  time_t now;
   time (&now);
 
   dir_cache_remove_all_expired (g, now);
 
-  CLEANUP_FREE_DIRENT_LIST struct guestfs_dirent_list *ents =
-    guestfs_readdir (g, path);
+  ents = guestfs_readdir (g, path);
   if (ents == NULL)
     RETURN_ERRNO;
 
-  size_t i;
   for (i = 0; i < ents->len; ++i) {
     struct stat stat;
     memset (&stat, 0, sizeof stat);
@@ -162,14 +163,17 @@ mount_local_readdir (const char *path, void *buf, fuse_fill_dir_t filler,
   /* Now prepopulate the directory caches.  This step is just an
    * optimization, don't worry if it fails.
    */
-  char **names = malloc ((ents->len + 1) * sizeof (char *));
+  names = malloc ((ents->len + 1) * sizeof (char *));
   if (names) {
+    CLEANUP_FREE_STAT_LIST struct guestfs_stat_list *ss = NULL;
+    CLEANUP_FREE_XATTR_LIST struct guestfs_xattr_list *xattrs = NULL;
+    char **links;
+
     for (i = 0; i < ents->len; ++i)
       names[i] = ents->val[i].name;
     names[i] = NULL;
 
-    CLEANUP_FREE_STAT_LIST struct guestfs_stat_list *ss =
-      guestfs_lstatlist (g, path, names);
+    ss = guestfs_lstatlist (g, path, names);
     if (ss) {
       for (i = 0; i < ss->len; ++i) {
         if (ss->val[i].ino >= 0) {
@@ -195,12 +199,12 @@ mount_local_readdir (const char *path, void *buf, fuse_fill_dir_t filler,
       }
     }
 
-    CLEANUP_FREE_XATTR_LIST struct guestfs_xattr_list *xattrs =
-      guestfs_lxattrlist (g, path, names);
+    xattrs = guestfs_lxattrlist (g, path, names);
     if (xattrs) {
       size_t ni, num;
       struct guestfs_xattr *first;
       struct guestfs_xattr_list *copy;
+
       for (i = 0, ni = 0; i < xattrs->len; ++i, ++ni) {
         /* assert (strlen (xattrs->val[i].attrname) == 0); */
         if (xattrs->val[i].attrval_len > 0) {
@@ -219,7 +223,7 @@ mount_local_readdir (const char *path, void *buf, fuse_fill_dir_t filler,
       }
     }
 
-    char **links = guestfs_readlinklist (g, path, names);
+    links = guestfs_readlinklist (g, path, names);
     if (links) {
       for (i = 0; names[i] != NULL; ++i) {
         if (links[i][0])
@@ -241,18 +245,18 @@ mount_local_readdir (const char *path, void *buf, fuse_fill_dir_t filler,
 static int
 mount_local_getattr (const char *path, struct stat *statbuf)
 {
+  const struct stat *buf;
+  CLEANUP_FREE_STAT struct guestfs_stat *r = NULL;
   DECL_G ();
   DEBUG_CALL ("%s, %p", path, statbuf);
 
-  const struct stat *buf;
-
   buf = lsc_lookup (g, path);
   if (buf) {
     memcpy (statbuf, buf, sizeof *statbuf);
     return 0;
   }
 
-  CLEANUP_FREE_STAT struct guestfs_stat *r = guestfs_lstat (g, path);
+  r = guestfs_lstat (g, path);
   if (r == NULL)
     RETURN_ERRNO;
 
@@ -281,11 +285,12 @@ mount_local_getattr (const char *path, struct stat *statbuf)
 static int
 mount_local_access (const char *path, int mask)
 {
-  DECL_G ();
-  DEBUG_CALL ("%s, %d", path, mask);
-
   struct stat statbuf;
   int r;
+  struct fuse_context *fuse;
+  int ok = 1;
+  DECL_G ();
+  DEBUG_CALL ("%s, %d", path, mask);
 
   if (g->ml_read_only && (mask & W_OK))
     return -EROFS;
@@ -294,8 +299,7 @@ mount_local_access (const char *path, int mask)
   if (r < 0 || mask == F_OK)
     return r;
 
-  struct fuse_context *fuse = fuse_get_context ();
-  int ok = 1;
+  fuse = fuse_get_context ();
 
   if (mask & R_OK)
     ok = ok &&
@@ -319,11 +323,11 @@ mount_local_access (const char *path, int mask)
 static int
 mount_local_readlink (const char *path, char *buf, size_t size)
 {
-  DECL_G ();
-  DEBUG_CALL ("%s, %p, %zu", path, buf, size);
-
   const char *r;
   int free_it = 0;
+  size_t len;
+  DECL_G ();
+  DEBUG_CALL ("%s, %p, %zu", path, buf, size);
 
   r = rlc_lookup (g, path);
   if (!r) {
@@ -336,7 +340,7 @@ mount_local_readlink (const char *path, char *buf, size_t size)
   /* Note this is different from the real readlink(2) syscall.  FUSE wants
    * the string to be always nul-terminated, even if truncated.
    */
-  size_t len = strlen (r);
+  len = strlen (r);
   if (len > size - 1)
     len = size - 1;
 
@@ -354,11 +358,10 @@ mount_local_readlink (const char *path, char *buf, size_t size)
 static int
 mount_local_mknod (const char *path, mode_t mode, dev_t rdev)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, 0%o, 0x%lx", path, mode, (long) rdev);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -373,11 +376,10 @@ mount_local_mknod (const char *path, mode_t mode, dev_t rdev)
 static int
 mount_local_mkdir (const char *path, mode_t mode)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, 0%o", path, mode);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -392,11 +394,10 @@ mount_local_mkdir (const char *path, mode_t mode)
 static int
 mount_local_unlink (const char *path)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s", path);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -411,11 +412,10 @@ mount_local_unlink (const char *path)
 static int
 mount_local_rmdir (const char *path)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s", path);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -430,11 +430,10 @@ mount_local_rmdir (const char *path)
 static int
 mount_local_symlink (const char *from, const char *to)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %s", from, to);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, to);
@@ -449,11 +448,10 @@ mount_local_symlink (const char *from, const char *to)
 static int
 mount_local_rename (const char *from, const char *to)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %s", from, to);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, from);
@@ -469,11 +467,10 @@ mount_local_rename (const char *from, const char *to)
 static int
 mount_local_link (const char *from, const char *to)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %s", from, to);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, from);
@@ -489,11 +486,10 @@ mount_local_link (const char *from, const char *to)
 static int
 mount_local_chmod (const char *path, mode_t mode)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, 0%o", path, mode);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -508,11 +504,10 @@ mount_local_chmod (const char *path, mode_t mode)
 static int
 mount_local_chown (const char *path, uid_t uid, gid_t gid)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %ld, %ld", path, (long) uid, (long) gid);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -527,11 +522,10 @@ mount_local_chown (const char *path, uid_t uid, gid_t gid)
 static int
 mount_local_truncate (const char *path, off_t size)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %ld", path, (long) size);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -546,20 +540,21 @@ mount_local_truncate (const char *path, off_t size)
 static int
 mount_local_utimens (const char *path, const struct timespec ts[2])
 {
+  int r;
+  time_t atsecs, mtsecs;
+  long atnsecs, mtnsecs;
   DECL_G ();
   DEBUG_CALL ("%s, [{ %ld, %ld }, { %ld, %ld }]",
               path, ts[0].tv_sec, ts[0].tv_nsec, ts[1].tv_sec, ts[1].tv_nsec);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
 
-  time_t atsecs = ts[0].tv_sec;
-  long atnsecs = ts[0].tv_nsec;
-  time_t mtsecs = ts[1].tv_sec;
-  long mtnsecs = ts[1].tv_nsec;
+  atsecs = ts[0].tv_sec;
+  atnsecs = ts[0].tv_nsec;
+  mtsecs = ts[1].tv_sec;
+  mtnsecs = ts[1].tv_nsec;
 
 #ifdef UTIME_NOW
   if (atnsecs == UTIME_NOW)
@@ -591,11 +586,10 @@ mount_local_utimens (const char *path, const struct timespec ts[2])
 static int
 mount_local_open (const char *path, struct fuse_file_info *fi)
 {
+  int flags = fi->flags & O_ACCMODE;
   DECL_G ();
   DEBUG_CALL ("%s, 0%o", path, fi->flags);
 
-  int flags = fi->flags & O_ACCMODE;
-
   if (g->ml_read_only && flags != O_RDONLY)
     return -EROFS;
 
@@ -606,17 +600,16 @@ static int
 mount_local_read (const char *path, char *buf, size_t size, off_t offset,
                   struct fuse_file_info *fi)
 {
-  DECL_G ();
-  DEBUG_CALL ("%s, %p, %zu, %ld", path, buf, size, (long) offset);
-
   char *r;
   size_t rsize;
+  const size_t limit = 2 * 1024 * 1024;
+  DECL_G ();
+  DEBUG_CALL ("%s, %p, %zu, %ld", path, buf, size, (long) offset);
 
   /* The guestfs protocol limits size to somewhere over 2MB.  We just
    * reduce the requested size here accordingly and push the problem
    * up to every user.  http://www.jwz.org/doc/worse-is-better.html
    */
-  const size_t limit = 2 * 1024 * 1024;
   if (size > limit)
     size = limit;
 
@@ -640,6 +633,8 @@ static int
 mount_local_write (const char *path, const char *buf, size_t size,
                    off_t offset, struct fuse_file_info *fi)
 {
+  const size_t limit = 2 * 1024 * 1024;
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %p, %zu, %ld", path, buf, size, (long) offset);
 
@@ -648,11 +643,9 @@ mount_local_write (const char *path, const char *buf, size_t size,
   dir_cache_invalidate (g, path);
 
   /* See mount_local_read. */
-  const size_t limit = 2 * 1024 * 1024;
   if (size > limit)
     size = limit;
 
-  int r;
   r = guestfs_pwrite (g, path, buf, size, offset);
   if (r == -1)
     RETURN_ERRNO;
@@ -663,10 +656,11 @@ mount_local_write (const char *path, const char *buf, size_t size,
 static int
 mount_local_statfs (const char *path, struct statvfs *stbuf)
 {
+  CLEANUP_FREE_STATVFS struct guestfs_statvfs *r;
   DECL_G ();
   DEBUG_CALL ("%s, %p", path, stbuf);
 
-  CLEANUP_FREE_STATVFS struct guestfs_statvfs *r = guestfs_statvfs (g, path);
+  r = guestfs_statvfs (g, path);
   if (r == NULL)
     RETURN_ERRNO;
 
@@ -702,11 +696,10 @@ static int
 mount_local_fsync (const char *path, int isdatasync,
                    struct fuse_file_info *fi)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %d", path, isdatasync);
 
-  int r;
-
   r = guestfs_sync (g);
   if (r == -1)
     RETURN_ERRNO;
@@ -718,11 +711,10 @@ static int
 mount_local_setxattr (const char *path, const char *name, const char *value,
              size_t size, int flags)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %s, %p, %zu", path, name, value, size);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -743,13 +735,12 @@ static int
 mount_local_getxattr (const char *path, const char *name, char *value,
                       size_t size)
 {
-  DECL_G ();
-  DEBUG_CALL ("%s, %s, %p, %zu", path, name, value, size);
-
   const struct guestfs_xattr_list *xattrs;
   int free_attrs = 0;
   ssize_t r;
   size_t i, sz;
+  DECL_G ();
+  DEBUG_CALL ("%s, %s, %p, %zu", path, name, value, size);
 
   xattrs = xac_lookup (g, path);
   if (xattrs == NULL) {
@@ -802,11 +793,14 @@ out:
 static int
 mount_local_listxattr (const char *path, char *list, size_t size)
 {
-  DECL_G ();
-  DEBUG_CALL ("%s, %p, %zu", path, list, size);
-
   const struct guestfs_xattr_list *xattrs;
   int free_attrs = 0;
+  size_t space = 0;
+  size_t len;
+  size_t i;
+  ssize_t r;
+  DECL_G ();
+  DEBUG_CALL ("%s, %p, %zu", path, list, size);
 
   xattrs = xac_lookup (g, path);
   if (xattrs == NULL) {
@@ -817,9 +811,6 @@ mount_local_listxattr (const char *path, char *list, size_t size)
   }
 
   /* Calculate how much space is required to hold the result. */
-  size_t space = 0;
-  size_t len;
-  size_t i;
   for (i = 0; i < xattrs->len; ++i) {
     len = strlen (xattrs->val[i].attrname) + 1;
     space += len;
@@ -832,7 +823,6 @@ mount_local_listxattr (const char *path, char *list, size_t size)
    * copy as much as possible and return -ERANGE if there's not enough
    * space in the buffer.
    */
-  ssize_t r;
   if (list == NULL) {
     r = space;
     goto out;
@@ -862,11 +852,10 @@ mount_local_listxattr (const char *path, char *list, size_t size)
 static int
 mount_local_removexattr(const char *path, const char *name)
 {
+  int r;
   DECL_G ();
   DEBUG_CALL ("%s, %s", path, name);
 
-  int r;
-
   if (g->ml_read_only) return -EROFS;
 
   dir_cache_invalidate (g, path);
@@ -1305,6 +1294,7 @@ lsc_insert (guestfs_h *g,
             struct stat const *statbuf)
 {
   struct lsc_entry *entry;
+  size_t len;
 
   entry = malloc (sizeof *entry);
   if (entry == NULL) {
@@ -1312,7 +1302,7 @@ lsc_insert (guestfs_h *g,
     return -1;
   }
 
-  size_t len = strlen (path) + strlen (name) + 2;
+  len = strlen (path) + strlen (name) + 2;
   entry->c.pathname = malloc (len);
   if (entry->c.pathname == NULL) {
     perrorf (g, "malloc");
@@ -1337,6 +1327,7 @@ xac_insert (guestfs_h *g,
             struct guestfs_xattr_list *xattrs)
 {
   struct xac_entry *entry;
+  size_t len;
 
   entry = malloc (sizeof *entry);
   if (entry == NULL) {
@@ -1344,7 +1335,7 @@ xac_insert (guestfs_h *g,
     return -1;
   }
 
-  size_t len = strlen (path) + strlen (name) + 2;
+  len = strlen (path) + strlen (name) + 2;
   entry->c.pathname = malloc (len);
   if (entry->c.pathname == NULL) {
     perrorf (g, "malloc");
@@ -1369,6 +1360,7 @@ rlc_insert (guestfs_h *g,
             char *link)
 {
   struct rlc_entry *entry;
+  size_t len;
 
   entry = malloc (sizeof *entry);
   if (entry == NULL) {
@@ -1376,7 +1368,7 @@ rlc_insert (guestfs_h *g,
     return -1;
   }
 
-  size_t len = strlen (path) + strlen (name) + 2;
+  len = strlen (path) + strlen (name) + 2;
   entry->c.pathname = malloc (len);
   if (entry->c.pathname == NULL) {
     perrorf (g, "malloc");
diff --git a/src/inspect-apps.c b/src/inspect-apps.c
index 74446a4d0..dd2b3dbd6 100644
--- a/src/inspect-apps.c
+++ b/src/inspect-apps.c
@@ -114,12 +114,11 @@ guestfs__inspect_list_applications (guestfs_h *g, const char *root)
 struct guestfs_application2_list *
 guestfs__inspect_list_applications2 (guestfs_h *g, const char *root)
 {
+  struct guestfs_application2_list *ret = NULL;
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
   if (!fs)
     return NULL;
 
-  struct guestfs_application2_list *ret = NULL;
-
   /* Presently we can only list applications for installed disks.  It
    * is possible in future to get lists of packages from installers.
    */
@@ -400,11 +399,6 @@ static struct guestfs_application2_list *
 list_applications_deb (guestfs_h *g, struct inspect_fs *fs)
 {
   CLEANUP_FREE char *status = NULL;
-  status = guestfs___download_to_tmp (g, fs, "/var/lib/dpkg/status", "status",
-                                      MAX_PKG_DB_SIZE);
-  if (status == NULL)
-    return NULL;
-
   struct guestfs_application2_list *apps = NULL, *ret = NULL;
   FILE *fp;
   char line[1024];
@@ -412,6 +406,11 @@ list_applications_deb (guestfs_h *g, struct inspect_fs *fs)
   CLEANUP_FREE char *name = NULL, *version = NULL, *release = NULL, *arch = NULL;
   int installed_flag = 0;
 
+  status = guestfs___download_to_tmp (g, fs, "/var/lib/dpkg/status", "status",
+                                      MAX_PKG_DB_SIZE);
+  if (status == NULL)
+    return NULL;
+
   fp = fopen (status, "r");
   if (fp == NULL) {
     perrorf (g, "fopen: %s", status);
@@ -498,19 +497,16 @@ list_applications_windows (guestfs_h *g, struct inspect_fs *fs)
 {
   size_t len = strlen (fs->windows_systemroot) + 64;
   char software[len];
+  CLEANUP_FREE char *software_path;
+  struct guestfs_application2_list *ret = NULL;
+
   snprintf (software, len, "%s/system32/config/software",
             fs->windows_systemroot);
 
-  CLEANUP_FREE char *software_path = guestfs_case_sensitive_path (g, software);
+  software_path = guestfs_case_sensitive_path (g, software);
   if (!software_path)
     return NULL;
 
-  struct guestfs_application2_list *ret = NULL;
-  const char *hivepath[] =
-    { "Microsoft", "Windows", "CurrentVersion", "Uninstall" };
-  const char *hivepath2[] =
-    { "WOW6432node", "Microsoft", "Windows", "CurrentVersion", "Uninstall" };
-
   if (guestfs_hivex_open (g, software_path,
                           GUESTFS_HIVEX_OPEN_VERBOSE, g->verbose, -1) == -1)
     return NULL;
@@ -521,12 +517,16 @@ list_applications_windows (guestfs_h *g, struct inspect_fs *fs)
   ret->val = NULL;
 
   /* Ordinary native applications. */
+  const char *hivepath[] =
+    { "Microsoft", "Windows", "CurrentVersion", "Uninstall" };
   list_applications_windows_from_path (g, ret, hivepath,
                                        sizeof hivepath / sizeof hivepath[0]);
 
   /* 32-bit emulated Windows apps running on the WOW64 emulator.
    * http://support.microsoft.com/kb/896459 (RHBZ#692545).
    */
+  const char *hivepath2[] =
+    { "WOW6432node", "Microsoft", "Windows", "CurrentVersion", "Uninstall" };
   list_applications_windows_from_path (g, ret, hivepath2,
                                        sizeof hivepath2 / sizeof hivepath2[0]);
 
diff --git a/src/inspect-fs-unix.c b/src/inspect-fs-unix.c
index c70960a56..17b0b5f4d 100644
--- a/src/inspect-fs-unix.c
+++ b/src/inspect-fs-unix.c
@@ -404,6 +404,7 @@ int
 guestfs___check_linux_root (guestfs_h *g, struct inspect_fs *fs)
 {
   int r;
+  char *major, *minor;
 
   fs->type = OS_TYPE_LINUX;
 
@@ -423,7 +424,6 @@ guestfs___check_linux_root (guestfs_h *g, struct inspect_fs *fs)
     if (parse_release_file (g, fs, "/etc/redhat-release") == -1)
       return -1;
 
-    char *major, *minor;
     if ((major = match1 (g, fs->product_name, re_fedora)) != NULL) {
       fs->distro = OS_DISTRO_FEDORA;
       fs->major_version = guestfs___parse_unsigned_int (g, major);
@@ -923,8 +923,13 @@ check_fstab (guestfs_h *g, struct inspect_fs *fs)
   }
 
   for (entry = entries; *entry != NULL; entry++) {
+    CLEANUP_FREE char *spec = NULL;
+    CLEANUP_FREE char *mp = NULL;
+    CLEANUP_FREE char *mountable = NULL;
+    CLEANUP_FREE char *vfstype = NULL;
+
     snprintf (augpath, sizeof augpath, "%s/spec", *entry);
-    CLEANUP_FREE char *spec = guestfs_aug_get (g, augpath);
+    spec = guestfs_aug_get (g, augpath);
     if (spec == NULL)
       return -1;
 
@@ -940,7 +945,7 @@ check_fstab (guestfs_h *g, struct inspect_fs *fs)
       continue;
 
     snprintf (augpath, sizeof augpath, "%s/file", *entry);
-    CLEANUP_FREE char *mp = guestfs_aug_get (g, augpath);
+    mp = guestfs_aug_get (g, augpath);
     if (mp == NULL)
       return -1;
 
@@ -957,7 +962,6 @@ check_fstab (guestfs_h *g, struct inspect_fs *fs)
       continue;
 
     /* Resolve UUID= and LABEL= to the actual device. */
-    CLEANUP_FREE char *mountable = NULL;
     if (STRPREFIX (spec, "UUID="))
       mountable = guestfs_findfs_uuid (g, &spec[5]);
     else if (STRPREFIX (spec, "LABEL="))
@@ -977,24 +981,29 @@ check_fstab (guestfs_h *g, struct inspect_fs *fs)
       continue;
 
     snprintf (augpath, sizeof augpath, "%s/vfstype", *entry);
-    CLEANUP_FREE char *vfstype = guestfs_aug_get (g, augpath);
+    vfstype = guestfs_aug_get (g, augpath);
     if (vfstype == NULL) return -1;
 
     if (STREQ (vfstype, "btrfs")) {
+      char **opt;
+
       snprintf (augpath, sizeof augpath, "%s/opt", *entry);
       CLEANUP_FREE_STRING_LIST char **opts = guestfs_aug_match (g, augpath);
       if (opts == NULL) return -1;
 
-      for (char **opt = opts; *opt; opt++) {
+      for (opt = opts; *opt; opt++) {
         CLEANUP_FREE char *optname = guestfs_aug_get (g, augpath);
         if (optname == NULL) return -1;
 
         if (STREQ (optname, "subvol")) {
+          CLEANUP_FREE char *subvol = NULL;
+          char *new;
+
           snprintf (augpath, sizeof augpath, "%s/value", *opt);
-          CLEANUP_FREE char *subvol = guestfs_aug_get (g, augpath);
+          subvol = guestfs_aug_get (g, augpath);
           if (subvol == NULL) return -1;
 
-          char *new = safe_asprintf (g, "btrfsvol:%s/%s", mountable, subvol);
+          new = safe_asprintf (g, "btrfsvol:%s/%s", mountable, subvol);
           free (mountable);
           mountable = new;
         }
@@ -1049,9 +1058,10 @@ static size_t
 uuid_hash(const void *x, size_t table_size)
 {
   const md_uuid *a = x;
+  size_t h, i;
 
-  size_t h = a->uuid[0];
-  for (size_t i = 1; i < 4; i++) {
+  h = a->uuid[0];
+  for (i = 1; i < 4; i++) {
     h ^= a->uuid[i];
   }
 
@@ -1063,8 +1073,9 @@ uuid_cmp(const void *x, const void *y)
 {
   const md_uuid *a = x;
   const md_uuid *b = y;
+  size_t i;
 
-  for (size_t i = 0; i < 1; i++) {
+  for (i = 0; i < 1; i++) {
     if (a->uuid[i] != b->uuid[i]) return 0;
   }
 
@@ -1120,6 +1131,7 @@ map_app_md_devices (guestfs_h *g, Hash_table **map)
 {
   CLEANUP_FREE_STRING_LIST char **mds = NULL;
   size_t n = 0;
+  char **md;
 
   /* A hash mapping uuids to md device names */
   *map = hash_initialize(16, NULL, uuid_hash, uuid_cmp, md_uuid_free);
@@ -1128,22 +1140,24 @@ map_app_md_devices (guestfs_h *g, Hash_table **map)
   mds = guestfs_list_md_devices(g);
   if (mds == NULL) goto error;
 
-  for (char **md = mds; *md != NULL; md++) {
+  for (md = mds; *md != NULL; md++) {
+    char **i;
     CLEANUP_FREE_STRING_LIST char **detail = guestfs_md_detail (g, *md);
     if (detail == NULL) goto error;
 
     /* Iterate over keys until we find uuid */
-    char **i;
     for (i = detail; *i != NULL; i += 2) {
       if (STREQ(*i, "uuid")) break;
     }
 
     /* We found it */
     if (*i) {
+      md_uuid *entry;
+
       /* Next item is the uuid value */
       i++;
 
-      md_uuid *entry = safe_malloc(g, sizeof(md_uuid));
+      entry = safe_malloc(g, sizeof(md_uuid));
       entry->path = safe_strdup(g, *md);
 
       if (parse_uuid(*i, entry->uuid) == -1) {
diff --git a/src/inspect.c b/src/inspect.c
index 46bb4ab9d..49bf765d0 100644
--- a/src/inspect.c
+++ b/src/inspect.c
@@ -41,6 +41,9 @@
 char **
 guestfs__inspect_os (guestfs_h *g)
 {
+  CLEANUP_FREE_STRING_LIST char **fses = NULL;
+  char **fs, **ret;
+
   /* Remove any information previously stored in the handle. */
   guestfs___free_inspect_info (g);
 
@@ -51,10 +54,10 @@ guestfs__inspect_os (guestfs_h *g)
    * and add that information to the handle.
    */
 
-  CLEANUP_FREE_STRING_LIST char **fses = guestfs_list_filesystems (g);
+  fses = guestfs_list_filesystems (g);
   if (fses == NULL) return NULL;
 
-  for (char **fs = fses; *fs; fs += 2) {
+  for (fs = fses; *fs; fs += 2) {
     if (guestfs___check_for_filesystem_on (g, *fs)) {
       guestfs___free_inspect_info (g);
       return NULL;
@@ -66,7 +69,7 @@ guestfs__inspect_os (guestfs_h *g)
    * filesystems which are root devices and return that to the user.
    * Fall through to guestfs_inspect_get_roots to do that.
    */
-  char **ret = guestfs_inspect_get_roots (g);
+  ret = guestfs_inspect_get_roots (g);
   if (ret == NULL)
     guestfs___free_inspect_info (g);
   return ret;
@@ -105,10 +108,11 @@ char *
 guestfs__inspect_get_type (guestfs_h *g, const char *root)
 {
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
+  char *ret = NULL;
+
   if (!fs)
     return NULL;
 
-  char *ret = NULL;
   switch (fs->type) {
   case OS_TYPE_DOS: ret = safe_strdup (g, "dos"); break;
   case OS_TYPE_FREEBSD: ret = safe_strdup (g, "freebsd"); break;
@@ -140,10 +144,11 @@ char *
 guestfs__inspect_get_distro (guestfs_h *g, const char *root)
 {
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
+  char *ret = NULL;
+
   if (!fs)
     return NULL;
 
-  char *ret = NULL;
   switch (fs->distro) {
   case OS_DISTRO_ARCHLINUX: ret = safe_strdup (g, "archlinux"); break;
   case OS_DISTRO_BUILDROOT: ret = safe_strdup (g, "buildroot"); break;
@@ -252,11 +257,11 @@ guestfs__inspect_get_windows_current_control_set (guestfs_h *g,
 char *
 guestfs__inspect_get_format (guestfs_h *g, const char *root)
 {
+  char *ret = NULL;
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
   if (!fs)
     return NULL;
 
-  char *ret = NULL;
   switch (fs->format) {
   case OS_FORMAT_INSTALLED: ret = safe_strdup (g, "installed"); break;
   case OS_FORMAT_INSTALLER: ret = safe_strdup (g, "installer"); break;
@@ -302,14 +307,17 @@ guestfs__inspect_is_multipart (guestfs_h *g, const char *root)
 char **
 guestfs__inspect_get_mountpoints (guestfs_h *g, const char *root)
 {
-  struct inspect_fs *fs = guestfs___search_for_root (g, root);
+  char **ret;
+  size_t i, count, nr;
+  struct inspect_fs *fs;
+
+  fs = guestfs___search_for_root (g, root);
   if (!fs)
     return NULL;
 
 #define CRITERION(fs, i) fs->fstab[i].mountpoint[0] == '/'
 
-  char **ret;
-  size_t i, count, nr = fs->nr_fstab;
+  nr = fs->nr_fstab;
 
   if (nr == 0)
     count = 1;
@@ -350,13 +358,14 @@ guestfs__inspect_get_mountpoints (guestfs_h *g, const char *root)
 char **
 guestfs__inspect_get_filesystems (guestfs_h *g, const char *root)
 {
+  char **ret;
+  size_t i, nr;
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
+
   if (!fs)
     return NULL;
 
-  char **ret;
-  size_t i, nr = fs->nr_fstab;
-
+  nr = fs->nr_fstab;
   ret = calloc (nr == 0 ? 2 : nr+1, sizeof (char *));
   if (ret == NULL) {
     perrorf (g, "calloc");
@@ -399,11 +408,11 @@ guestfs__inspect_get_drive_mappings (guestfs_h *g, const char *root)
 char *
 guestfs__inspect_get_package_format (guestfs_h *g, const char *root)
 {
+  char *ret = NULL;
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
   if (!fs)
     return NULL;
 
-  char *ret = NULL;
   switch (fs->package_format) {
   case OS_PACKAGE_FORMAT_RPM: ret = safe_strdup (g, "rpm"); break;
   case OS_PACKAGE_FORMAT_DEB: ret = safe_strdup (g, "deb"); break;
@@ -425,11 +434,11 @@ guestfs__inspect_get_package_format (guestfs_h *g, const char *root)
 char *
 guestfs__inspect_get_package_management (guestfs_h *g, const char *root)
 {
+  char *ret = NULL;
   struct inspect_fs *fs = guestfs___search_for_root (g, root);
   if (!fs)
     return NULL;
 
-  char *ret = NULL;
   switch (fs->package_management) {
   case OS_PACKAGE_MANAGEMENT_YUM: ret = safe_strdup (g, "yum"); break;
   case OS_PACKAGE_MANAGEMENT_UP2DATE: ret = safe_strdup (g, "up2date"); break;
@@ -463,7 +472,8 @@ guestfs__inspect_get_hostname (guestfs_h *g, const char *root)
 void
 guestfs___free_inspect_info (guestfs_h *g)
 {
-  size_t i;
+  size_t i, j;
+
   for (i = 0; i < g->nr_fses; ++i) {
     free (g->fses[i].mountable);
     free (g->fses[i].product_name);
@@ -472,7 +482,6 @@ guestfs___free_inspect_info (guestfs_h *g)
     free (g->fses[i].hostname);
     free (g->fses[i].windows_systemroot);
     free (g->fses[i].windows_current_control_set);
-    size_t j;
     for (j = 0; j < g->fses[i].nr_fstab; ++j) {
       free (g->fses[i].fstab[j].mountable);
       free (g->fses[i].fstab[j].mountpoint);
@@ -562,15 +571,15 @@ guestfs___download_to_tmp (guestfs_h *g, struct inspect_fs *fs,
 struct inspect_fs *
 guestfs___search_for_root (guestfs_h *g, const char *root)
 {
+  size_t i;
+
   if (g->nr_fses == 0) {
     error (g, _("no inspection data: call guestfs_inspect_os first"));
     return NULL;
   }
 
-  size_t i;
-  struct inspect_fs *fs;
   for (i = 0; i < g->nr_fses; ++i) {
-    fs = &g->fses[i];
+    struct inspect_fs *fs = &g->fses[i];
     if (fs->is_root && STREQ (root, fs->mountable))
       return fs;
   }
diff --git a/src/private-data.c b/src/private-data.c
index e13b4f7fa..74465afad 100644
--- a/src/private-data.c
+++ b/src/private-data.c
@@ -66,20 +66,22 @@ freer (void *x)
 void
 guestfs_set_private (guestfs_h *g, const char *key, void *data)
 {
+  struct pda_entry *new_entry, *old_entry, *entry;
+
   if (g->pda == NULL) {
     g->pda = hash_initialize (16, NULL, hasher, comparator, freer);
     if (g->pda == NULL)
       g->abort_cb ();
   }
 
-  struct pda_entry *new_entry = safe_malloc (g, sizeof *new_entry);
+  new_entry = safe_malloc (g, sizeof *new_entry);
   new_entry->key = safe_strdup (g, key);
   new_entry->data = data;
 
-  struct pda_entry *old_entry = hash_delete (g->pda, new_entry);
+  old_entry = hash_delete (g->pda, new_entry);
   freer (old_entry);
 
-  struct pda_entry *entry = hash_insert (g->pda, new_entry);
+  entry = hash_insert (g->pda, new_entry);
   if (entry == NULL)
     g->abort_cb ();
   assert (entry == new_entry);