From 50b2e1d2d4ae8f1e522cb5954b0ff97d8cda06f1 Mon Sep 17 00:00:00 2001
From: Todd A Ouska <todd@yassl.com>
Date: Wed, 27 Apr 2011 17:31:08 -0700
Subject: [PATCH] fix gcc lots of warnings for build

---
 ctaocrypt/include/config.h  |  2 +-
 ctaocrypt/include/integer.h |  3 ---
 ctaocrypt/include/types.h   |  5 +++++
 ctaocrypt/src/aes.c         |  4 ++--
 ctaocrypt/src/asn.c         | 25 +++++++++++++------------
 ctaocrypt/src/des3.c        |  2 +-
 ctaocrypt/src/integer.c     |  6 +++++-
 ctaocrypt/src/logging.c     |  3 +++
 ctaocrypt/src/pwdbased.c    | 12 ++++++------
 ctaocrypt/src/rsa.c         | 12 +++++++++---
 include/cyassl_int.h        |  9 +++++++++
 src/cyassl_int.c            | 33 ++++++++++++++++++++++++---------
 src/keys.c                  |  8 +-------
 src/ssl.c                   | 11 +++++++++--
 src/tls.c                   |  6 +++---
 15 files changed, 91 insertions(+), 50 deletions(-)

diff --git a/ctaocrypt/include/config.h b/ctaocrypt/include/config.h
index 7146f116b..7d7b8a938 100644
--- a/ctaocrypt/include/config.h
+++ b/ctaocrypt/include/config.h
@@ -42,7 +42,7 @@
 
 /* Define to 1 or 0, depending whether the compiler supports simple visibility
    declarations. */
-#define HAVE_VISIBILITY 1
+#define HAVE_VISIBILITY 0
 
 /* Define to the sub-directory in which libtool stores uninstalled libraries.
    */
diff --git a/ctaocrypt/include/integer.h b/ctaocrypt/include/integer.h
index 248772bb6..6840dea0c 100644
--- a/ctaocrypt/include/integer.h
+++ b/ctaocrypt/include/integer.h
@@ -247,10 +247,8 @@ void mp_clamp (mp_int * a);
 void mp_exch (mp_int * a, mp_int * b);
 void mp_rshd (mp_int * a, int b);
 int  mp_mod_2d (mp_int * a, int b, mp_int * c);
-int  mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
 int  mp_mul_2d (mp_int * a, int b, mp_int * c);
 int  mp_lshd (mp_int * a, int b);
-int  mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y);
 int  mp_abs (mp_int * a, mp_int * b);
 int  mp_invmod (mp_int * a, mp_int * b, mp_int * c);
 int  fast_mp_invmod (mp_int * a, mp_int * b, mp_int * c);
@@ -266,7 +264,6 @@ int  mp_add (mp_int * a, mp_int * b, mp_int * c);
 int  s_mp_add (mp_int * a, mp_int * b, mp_int * c);
 int  s_mp_sub (mp_int * a, mp_int * b, mp_int * c);
 int  mp_sub (mp_int * a, mp_int * b, mp_int * c);
-int  mp_init (mp_int * a);
 int  mp_reduce_is_2k_l(mp_int *a);
 int  mp_reduce_is_2k(mp_int *a);
 int  mp_dr_is_modulus(mp_int *a);
diff --git a/ctaocrypt/include/types.h b/ctaocrypt/include/types.h
index 6849c96ae..f4c79b0aa 100644
--- a/ctaocrypt/include/types.h
+++ b/ctaocrypt/include/types.h
@@ -188,6 +188,11 @@ enum {
     DYNAMIC_TYPE_OPENSSL    = 20 
 };
 
+/* stack protection */
+enum {
+    MIN_STACK_BUFFER = 8
+};
+
 
 #ifdef __cplusplus
     }   /* extern "C" */
diff --git a/ctaocrypt/src/aes.c b/ctaocrypt/src/aes.c
index bf2073274..deb2c7e8d 100644
--- a/ctaocrypt/src/aes.c
+++ b/ctaocrypt/src/aes.c
@@ -968,7 +968,7 @@ int AesSetKey(Aes* aes, const byte* userKey, word32 keylen, const byte* iv,
 }
 
 
-void AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
+static void AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
 {
     word32 s0, s1, s2, s3;
     word32 t0, t1, t2, t3;
@@ -1106,7 +1106,7 @@ void AesEncrypt(Aes* aes, const byte* inBlock, byte* outBlock)
 }
 
 
-void AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
+static void AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
 {
     word32 s0, s1, s2, s3;
     word32 t0, t1, t2, t3;
diff --git a/ctaocrypt/src/asn.c b/ctaocrypt/src/asn.c
index 14896411b..54d1f35cb 100644
--- a/ctaocrypt/src/asn.c
+++ b/ctaocrypt/src/asn.c
@@ -272,7 +272,7 @@ CPU_INT32S NetSecure_ValidateDateHandler(CPU_INT08U *date, CPU_INT08U format,
 #endif /* MICRIUM */
 
 
-int GetLength(const byte* input, word32* inOutIdx, int* len)
+static int GetLength(const byte* input, word32* inOutIdx, int* len)
 {
     int     length = 0;
     word32  i = *inOutIdx;
@@ -296,7 +296,7 @@ int GetLength(const byte* input, word32* inOutIdx, int* len)
 }
 
 
-int GetSequence(const byte* input, word32* inOutIdx, int* len)
+static int GetSequence(const byte* input, word32* inOutIdx, int* len)
 {
     int    length = -1;
     word32 idx    = *inOutIdx;
@@ -312,7 +312,7 @@ int GetSequence(const byte* input, word32* inOutIdx, int* len)
 }
 
 
-int GetSet(const byte* input, word32* inOutIdx, int* len)
+static int GetSet(const byte* input, word32* inOutIdx, int* len)
 {
     int    length = -1;
     word32 idx    = *inOutIdx;
@@ -329,7 +329,7 @@ int GetSet(const byte* input, word32* inOutIdx, int* len)
 
 
 /* winodws header clash for WinCE using GetVersion */
-int GetMyVersion(const byte* input, word32* inOutIdx, int* version)
+static int GetMyVersion(const byte* input, word32* inOutIdx, int* version)
 {
     word32 idx = *inOutIdx;
 
@@ -347,7 +347,7 @@ int GetMyVersion(const byte* input, word32* inOutIdx, int* version)
 
 
 /* Get small count integer, 32 bits or less */
-int GetShortInt(const byte* input, word32* inOutIdx, int* number)
+static int GetShortInt(const byte* input, word32* inOutIdx, int* number)
 {
     word32 idx = *inOutIdx;
     word32 len;
@@ -372,7 +372,7 @@ int GetShortInt(const byte* input, word32* inOutIdx, int* number)
 
 
 /* May not have one, not an error */
-int GetExplicitVersion(const byte* input, word32* inOutIdx, int* version)
+static int GetExplicitVersion(const byte* input, word32* inOutIdx, int* version)
 {
     word32 idx = *inOutIdx;
 
@@ -388,7 +388,7 @@ int GetExplicitVersion(const byte* input, word32* inOutIdx, int* version)
 }
 
 
-int GetInt(mp_int* mpi, const byte* input, word32* inOutIdx )
+static int GetInt(mp_int* mpi, const byte* input, word32* inOutIdx )
 {
     word32 i = *inOutIdx;
     byte   b = input[i++];
@@ -632,7 +632,7 @@ static int DecryptKey(const char* password, int passwordSz, byte* salt,
         int  i, idx = 0;
         byte unicodePasswd[MAX_UNICODE_SZ];
 
-        if ( (passwordSz * 2 + 2) > sizeof(unicodePasswd))
+        if ( (passwordSz * 2 + 2) > (int)sizeof(unicodePasswd))
             return UNICODE_SIZE_E; 
 
         for (i = 0; i < passwordSz; i++) {
@@ -701,7 +701,7 @@ static int DecryptKey(const char* password, int passwordSz, byte* salt,
 int ToTraditionalEnc(byte* input, word32 sz,const char* password,int passwordSz)
 {
     word32 inOutIdx = 0, oid;
-    int    type, first, second, length, iterations, saltSz, id;
+    int    first, second, length, iterations, saltSz, id;
     int    version;
     byte   salt[MAX_SALT_SIZE];
     byte   cbcIv[MAX_IV_SIZE];
@@ -1034,7 +1034,7 @@ static int GetCertHeader(DecodedCert* cert, word32 inSz)
         return ASN_PARSE_E;
 
     len = mp_unsigned_bin_size(&mpi);
-    if (len < sizeof(serialTmp)) {
+    if (len < (int)sizeof(serialTmp)) {
         if (mp_to_unsigned_bin(&mpi, serialTmp) == MP_OKAY) {
             if (len > EXTERNAL_SERIAL_SIZE)
                 len = EXTERNAL_SERIAL_SIZE;
@@ -1922,7 +1922,7 @@ int ParseCert(DecodedCert* cert, word32 inSz, int type, int verify,
 
 
 /* from SSL proper, for locking can't do find here anymore */
-Signer* GetCA(Signer* signers, byte* hash);
+CYASSL_LOCAL Signer* GetCA(Signer* signers, byte* hash);
 
 
 int ParseCertRelative(DecodedCert* cert, word32 inSz, int type, int verify,
@@ -1931,7 +1931,6 @@ int ParseCertRelative(DecodedCert* cert, word32 inSz, int type, int verify,
     word32 confirmOID;
     int    ret;
     int    badDate = 0;
-    int    confirm = 0;
 
     if ((ret = DecodeToKey(cert, inSz, verify)) < 0) {
         if (ret == ASN_BEFORE_DATE_E || ret == ASN_AFTER_DATE_E)
@@ -1987,6 +1986,7 @@ Signer* MakeSigner(void* heap)
         signer->publicKey = 0;
         signer->next      = 0;
     }
+    (void)heap;
 
     return signer;
 }
@@ -2002,6 +2002,7 @@ void FreeSigners(Signer* signer, void* heap)
         XFREE(signer->publicKey, heap, DYNAMIC_TYPE_PUBLIC_KEY);
         XFREE(signer, heap, DYNAMIC_TYPE_SIGNER);
     }
+    (void)heap;
 }
 
 
diff --git a/ctaocrypt/src/des3.c b/ctaocrypt/src/des3.c
index d7792fc30..de088d7c6 100644
--- a/ctaocrypt/src/des3.c
+++ b/ctaocrypt/src/des3.c
@@ -341,7 +341,7 @@ void Des3_SetKey(Des3* des, const byte* key, const byte* iv, int dir)
 }
 
 
-void DesRawProcessBlock(word32* lIn, word32* rIn, const word32* kptr)
+static void DesRawProcessBlock(word32* lIn, word32* rIn, const word32* kptr)
 {
     word32 l = *lIn, r = *rIn, i;
 
diff --git a/ctaocrypt/src/integer.c b/ctaocrypt/src/integer.c
index 470f3c9f6..ff95cfb39 100644
--- a/ctaocrypt/src/integer.c
+++ b/ctaocrypt/src/integer.c
@@ -3591,7 +3591,7 @@ int fast_s_mp_mul_high_digs (mp_int * a, mp_int * b, mp_int * c, int digs)
 }
 
 
-#if defined(CYASSL_KEY_GEN) || defined(HAVE_ECC) || !defined(NO_PWDBASED)
+#if defined(HAVE_ECC)
 
 /* c = a * a (mod b) */
 int mp_sqrmod (mp_int * a, mp_int * b, mp_int * c)
@@ -3612,6 +3612,10 @@ int mp_sqrmod (mp_int * a, mp_int * b, mp_int * c)
   return res;
 }
 
+#endif
+
+
+#if defined(CYASSL_KEY_GEN) || defined(HAVE_ECC) || !defined(NO_PWDBASED)
 
 int mp_sub_d (mp_int* a, mp_digit b, mp_int* c);
 
diff --git a/ctaocrypt/src/logging.c b/ctaocrypt/src/logging.c
index 68414eadc..949d9af74 100644
--- a/ctaocrypt/src/logging.c
+++ b/ctaocrypt/src/logging.c
@@ -26,6 +26,9 @@
 #include "error.h"
 
 
+CYASSL_API int  CyaSSL_Debugging_ON(void);
+CYASSL_API void CyaSSL_Debugging_OFF(void);
+
 /* Set these to default values initially. */
 static CyaSSL_Logging_cb log_function = 0;
 static int loggingEnabled = 0;
diff --git a/ctaocrypt/src/pwdbased.c b/ctaocrypt/src/pwdbased.c
index 727096295..c2b04d328 100644
--- a/ctaocrypt/src/pwdbased.c
+++ b/ctaocrypt/src/pwdbased.c
@@ -217,9 +217,9 @@ int PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,const byte* salt,
 
     XMEMSET(D, id, dLen);
 
-    for (i = 0; i < sLen; i++)
+    for (i = 0; i < (int)sLen; i++)
         S[i] = salt[i % saltLen];
-    for (i = 0; i < pLen; i++)
+    for (i = 0; i < (int)pLen; i++)
         P[i] = passwd[i % passLen];
 
     while (kLen > 0) {
@@ -247,7 +247,7 @@ int PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,const byte* salt,
         }
 #endif
 
-        for (i = 0; i < v; i++)
+        for (i = 0; i < (int)v; i++)
             B[i] = Ai[i % u];
 
         mp_init(&B1);
@@ -259,7 +259,7 @@ int PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,const byte* salt,
             break;
         }
 
-        for (i = 0; i < iLen; i += v) {
+        for (i = 0; i < (int)iLen; i += v) {
             int    outSz;
             mp_int i1;
             mp_int res;
@@ -274,13 +274,13 @@ int PKCS12_PBKDF(byte* output, const byte* passwd, int passLen,const byte* salt,
             else if ( (outSz = mp_unsigned_bin_size(&res)) < 0)
                 ret = MP_TO_E;
             else {
-                if (outSz > v) {
+                if (outSz > (int)v) {
                     /* take off MSB */
                     byte  tmp[129];
                     mp_to_unsigned_bin(&res, tmp);
                     XMEMCPY(I + i, tmp + 1, v);
                 }
-                else if (outSz < v) {
+                else if (outSz < (int)v) {
                     XMEMSET(I + i, 0, v - outSz);
                     mp_to_unsigned_bin(&res, I + i + v - outSz);
                 }
diff --git a/ctaocrypt/src/rsa.c b/ctaocrypt/src/rsa.c
index 25333928b..97804cb8f 100644
--- a/ctaocrypt/src/rsa.c
+++ b/ctaocrypt/src/rsa.c
@@ -288,7 +288,10 @@ int RsaPrivateDecrypt(const byte* in, word32 inLen, byte* out, word32 outLen,
         XFREE(tmp, key->heap, DYNAMIC_TYPE_RSA);
         return ret;
     }
-    XMEMCPY(out, pad, plainLen);
+    if (plainLen > (int)outLen)
+        plainLen = BAD_FUNC_ARG;
+    else
+        XMEMCPY(out, pad, plainLen);
     XMEMSET(tmp, 0x00, inLen); 
 
     XFREE(tmp, key->heap, DYNAMIC_TYPE_RSA);
@@ -328,8 +331,11 @@ int RsaSSL_Verify(const byte* in, word32 inLen, byte* out, word32 outLen,
         XFREE(tmp, key->heap, DYNAMIC_TYPE_RSA);
         return ret;
     }
-  
-    XMEMCPY(out, pad, plainLen);
+
+    if (plainLen > (int)outLen)
+        plainLen = BAD_FUNC_ARG;
+    else 
+        XMEMCPY(out, pad, plainLen);
     XMEMSET(tmp, 0x00, inLen); 
 
     XFREE(tmp, key->heap, DYNAMIC_TYPE_RSA);
diff --git a/include/cyassl_int.h b/include/cyassl_int.h
index 444f1018a..91c0b0b15 100644
--- a/include/cyassl_int.h
+++ b/include/cyassl_int.h
@@ -1206,6 +1206,15 @@ CYASSL_LOCAL int IsAtLeastTLSv1_2(const SSL* ssl);
 
 CYASSL_LOCAL void ShrinkInputBuffer(SSL* ssl, int forcedFree);
 CYASSL_LOCAL void ShrinkOutputBuffer(SSL* ssl);
+CYASSL_LOCAL int SendHelloVerifyRequest(SSL* ssl);
+CYASSL_LOCAL Signer* GetCA(Signer* signers, byte* hash);
+#ifndef NO_TLS
+    CYASSL_LOCAL int  MakeTlsMasterSecret(SSL*);
+    CYASSL_LOCAL void TLS_hmac(SSL* ssl, byte* digest, const byte* buffer,
+                               word32 sz, int content, int verify);
+    CYASSL_LOCAL void BuildTlsFinished(SSL* ssl, Hashes* hashes,
+                                       const byte* sender);
+#endif
 
 #ifndef NO_CYASSL_CLIENT
     CYASSL_LOCAL int SendClientHello(SSL*);
diff --git a/src/cyassl_int.c b/src/cyassl_int.c
index 00a83fe53..da4250ce7 100644
--- a/src/cyassl_int.c
+++ b/src/cyassl_int.c
@@ -84,7 +84,6 @@ static void Hmac(SSL* ssl, byte* digest, const byte* buffer, word32 sz,
 static void BuildCertHashes(SSL* ssl, Hashes* hashes);
 
 
-void BuildTlsFinished(SSL* ssl, Hashes* hashes, const byte* sender);
 
 
 #ifndef min
@@ -402,6 +401,9 @@ void InitSuites(Suites* suites, ProtocolVersion pv, byte haveDH, byte havePSK,
     int    haveRSA = 1;
 
     (void)tls;  /* shut up compiler */
+    (void)haveDH;
+    (void)havePSK;
+    (void)haveNTRU;
 
     if (side == SERVER_END && haveECDSA)
         haveRSA = 0;   /* can't do RSA with ECDSA cert */
@@ -1010,6 +1012,7 @@ static void AddRecordHeader(byte* output, word32 length, byte type, SSL* ssl)
 static void AddHandShakeHeader(byte* output, word32 length, byte type, SSL* ssl)
 {
     HandShakeHeader* hs;
+    (void)ssl;
  
     /* handshake header */
     hs = (HandShakeHeader*)output;
@@ -1044,7 +1047,7 @@ static void AddHeaders(byte* output, word32 length, byte type, SSL* ssl)
 
 
 /* return bytes received, -1 on error */
-static int Receive(SSL* ssl, byte* buf, word32 sz, int flags)
+static int Receive(SSL* ssl, byte* buf, word32 sz)
 {
     int recvd;
 
@@ -1296,6 +1299,7 @@ static int GetRecordHeader(SSL* ssl, const byte* input, word32* inOutIdx,
         case application_data:
         case alert:
             break;
+        case no_type:
         default:
             CYASSL_MSG("Unknown Record Type"); 
             return UNKNOWN_RECORD_TYPE;
@@ -1309,6 +1313,7 @@ static int GetHandShakeHeader(SSL* ssl, const byte* input, word32* inOutIdx,
                               byte *type, word32 *size)
 {
     const byte *ptr = input + *inOutIdx;
+    (void)ssl;
     *inOutIdx += HANDSHAKE_HEADER_SZ;
     
 #ifdef CYASSL_DTLS
@@ -1414,7 +1419,6 @@ static int DoCertificate(SSL* ssl, byte* input, word32* inOutIdx)
     word32 listSz, i = *inOutIdx;
     int    ret = 0;
     int    anyError = 0;
-    int    firstTime = 1;     /* peer's is at front */
     int    totalCerts = 0;    /* number of certs in certs buffer */
     int    count;
     char   domain[ASN_NAME_MAX];
@@ -1489,10 +1493,14 @@ static int DoCertificate(SSL* ssl, byte* input, word32* inOutIdx)
             ret = AddCA(ssl->ctx, add);
             if (ret == 1) ret = 0;   /* SSL_SUCCESS for external */
         }
-        else if (ret != 0)
+        else if (ret != 0) {
             CYASSL_MSG("Failed to verify CA from chain");
-        else
+            (void)ret;
+        }
+        else {
             CYASSL_MSG("Verified CA from chain and already had it");
+            (void)ret;
+        }
 
         if (ret != 0 && anyError == 0)
             anyError = ret;   /* save error from last time */
@@ -1511,8 +1519,10 @@ static int DoCertificate(SSL* ssl, byte* input, word32* inOutIdx)
         InitDecodedCert(&dCert, myCert.buffer, ssl->heap);
         ret = ParseCertRelative(&dCert, myCert.length, CERT_TYPE,
                                 !ssl->options.verifyNone, ssl->ctx->caList);
-        if (ret != 0)
+        if (ret != 0) {
             CYASSL_MSG("Failed to verify Peer's cert");
+            (void)ret;
+        }
         ssl->options.havePeerCert = 1;
         /* set X509 format */
 #ifdef OPENSSL_EXTRA
@@ -2040,7 +2050,7 @@ static int GetInputData(SSL *ssl, word32 size)
         in = Receive(ssl, 
                      ssl->buffers.inputBuffer.buffer +
                      ssl->buffers.inputBuffer.length, 
-                     inSz, 0);
+                     inSz);
         if (in == -1)
             return SOCKET_ERROR_E;
    
@@ -2885,7 +2895,7 @@ int ReceiveData(SSL* ssl, byte* output, int sz)
 /* send alert message */
 int SendAlert(SSL* ssl, int severity, int type)
 {
-    byte input[ALERT_SIZE];
+    byte input[ALERT_SIZE + MAX_MSG_EXTRA];
     byte *output;
     int  sendSz;
     int  ret;
@@ -3893,6 +3903,9 @@ int SetCipherList(SSL_CTX* ctx, const char* list)
         word16 length;
         byte*  signature;
 
+        (void)length;
+        (void)ssl;
+        (void)input;
         sigLen    = 0;
         signature = 0;
 
@@ -4519,6 +4532,7 @@ int SetCipherList(SSL_CTX* ctx, const char* list)
     int SendServerKeyExchange(SSL* ssl)
     {
         int ret = 0;
+        (void)ssl;
 
         #ifndef NO_PSK
         if (ssl->specs.kea == psk_kea)
@@ -4954,7 +4968,7 @@ int SetCipherList(SSL_CTX* ctx, const char* list)
     }
 
 
-    /* process alert, return level */
+    /* process old style client hello, deprecate? */
     int ProcessOldClientHello(SSL* ssl, const byte* input, word32* inOutIdx,
                               word32 inSz, word16 sz)
     {
@@ -4965,6 +4979,7 @@ int SetCipherList(SSL_CTX* ctx, const char* list)
         ProtocolVersion pv;
         Suites          clSuites;
 
+        (void)inSz;
         CYASSL_MSG("Got old format client hello");
 #ifdef CYASSL_CALLBACKS
         if (ssl->hsInfoOn)
diff --git a/src/keys.c b/src/keys.c
index 4560aee54..be0de126c 100644
--- a/src/keys.c
+++ b/src/keys.c
@@ -28,12 +28,6 @@
 #endif
 
 
-#ifndef NO_TLS
-    int MakeTlsMasterSecret(SSL*);
-    void TLS_hmac(SSL* ssl, byte* digest, const byte* buffer, word32 sz,
-                  int content, int verify);
-#endif
-
 
 
 int SetCipherSpecs(SSL* ssl)
@@ -721,7 +715,7 @@ int DeriveKeys(SSL* ssl)
 }
 
 
-void CleanPreMaster(SSL* ssl)
+static void CleanPreMaster(SSL* ssl)
 {
     int i, sz = ssl->arrays.preMasterSz;
 
diff --git a/src/ssl.c b/src/ssl.c
index 4c83225fc..56e5450fb 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -307,7 +307,7 @@ int SSL_want_write(SSL* ssl)
 
 char* ERR_error_string(unsigned long errNumber, char* buffer)
 {
-    static char* msg = "Please supply a buffer for error string";
+    static const char* msg = "Please supply a buffer for error string";
 
     CYASSL_ENTER("ERR_error_string");
     if (buffer) {
@@ -315,7 +315,7 @@ char* ERR_error_string(unsigned long errNumber, char* buffer)
         return buffer;
     }
 
-    return msg;
+    return (char*)msg;
 }
 
 
@@ -490,6 +490,8 @@ int AddCA(SSL_CTX* ctx, buffer der)
         int   pkcs8Enc = 0;
         int   dynamicType;
 
+        (void)heap;
+
         if (type == CERT_TYPE || type == CA_TYPE)  {
             XSTRNCPY(header, "-----BEGIN CERTIFICATE-----", sizeof(header));
             XSTRNCPY(footer, "-----END CERTIFICATE-----", sizeof(footer));
@@ -986,6 +988,8 @@ int SSL_CTX_load_verify_locations(SSL_CTX* ctx, const char* file,
                                   const char* path)
 {
     CYASSL_ENTER("SSL_CTX_load_verify_locations");
+    (void)path;
+
     if (ProcessFile(ctx, file, SSL_FILETYPE_PEM, CA_TYPE, NULL) == SSL_SUCCESS)
         return SSL_SUCCESS;
 
@@ -1705,6 +1709,8 @@ static INLINE word32 HashSession(const byte* sessionID)
 void SSL_flush_sessions(SSL_CTX* ctx, long tm)
 {
     /* static table now, no flusing needed */
+    (void)ctx;
+    (void)tm;
 }
 
 
@@ -1897,6 +1903,7 @@ int CyaSSL_check_domain_name(SSL* ssl, const char* dn)
 int CyaSSL_set_compression(SSL* ssl)
 {
     CYASSL_ENTER("CyaSSL_set_compression");
+    (void)ssl;
 #ifdef HAVE_LIBZ
     ssl->options.usingCompression = 1;
     return 0;
diff --git a/src/tls.c b/src/tls.c
index 3f2874cc1..1c7bddfe7 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -52,8 +52,8 @@ static INLINE void get_xor(byte *digest, word32 digLen, byte* md5, byte* sha)
 
 
 /* compute p_hash for MD5, SHA-1, or SHA-256 for TLSv1 PRF */
-void p_hash(byte* result, word32 resLen, const byte* secret, word32 secLen,
-            const byte* seed, word32 seedLen, int hash)
+static void p_hash(byte* result, word32 resLen, const byte* secret,
+                   word32 secLen, const byte* seed, word32 seedLen, int hash)
 {
     word32   len = hash == md5_mac ? MD5_DIGEST_SIZE : hash == sha_mac ?
                                            SHA_DIGEST_SIZE : SHA256_DIGEST_SIZE;
@@ -239,7 +239,7 @@ int MakeTlsMasterSecret(SSL* ssl)
 /*** next for static INLINE s copied from cyassl_int.c ***/
 
 /* convert 16 bit integer to opaque */
-static void INLINE c16toa(word16 u16, byte* c)
+INLINE static void c16toa(word16 u16, byte* c)
 {
     c[0] = (u16 >> 8) & 0xff;
     c[1] =  u16 & 0xff;