diff --git a/CMakeLists.txt b/CMakeLists.txt
index bd0367d..f46639a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -12,6 +12,9 @@
   if (GCC_VERSION VERSION_GREATER 4.5 OR GCC_VERSION VERSION_EQUAL 4.5)
       set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wlogical-op")
   endif()
+  if (GCC_VERSION VERSION_GREATER 4.8 OR GCC_VERSION VERSION_EQUAL 4.8)
+      set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wshadow")
+  endif()
   set(CMAKE_C_FLAGS_RELEASE     "-O2")
   set(CMAKE_C_FLAGS_DEBUG       "-O0 -g3")
   set(CMAKE_C_FLAGS_COVERAGE    "-O0 -g3 --coverage")
@@ -22,7 +25,7 @@
 endif(CMAKE_COMPILER_IS_GNUCC)
 
 if(CMAKE_COMPILER_IS_CLANG)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings -Wpointer-arith")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings -Wpointer-arith -Wshadow")
   set(CMAKE_C_FLAGS_RELEASE     "-O2")
   set(CMAKE_C_FLAGS_DEBUG       "-O0 -g3")
   set(CMAKE_C_FLAGS_COVERAGE    "-O0 -g3 --coverage")
diff --git a/ChangeLog b/ChangeLog
index 43dd6b2..2c369ce 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,7 @@
    * Fix bug in mbedtls_rsa_public() and mbedtls_rsa_private() that could
      result trying to unlock an unlocked mutex on invalid input (found by
      Fredrik Axelsson) (#257)
+   * Fix -Wshadow warnings (found by hnrkp) (#240)
 
 = mbed TLS 1.3.12 released 2015-08-11
 
diff --git a/library/entropy_poll.c b/library/entropy_poll.c
index e0f9ae2..7fd254b 100644
--- a/library/entropy_poll.c
+++ b/library/entropy_poll.c
@@ -133,7 +133,7 @@
                            unsigned char *output, size_t len, size_t *olen )
 {
     FILE *file;
-    size_t ret;
+    size_t read_len;
     ((void) data);
 
 #if defined(HAVE_GETRANDOM)
@@ -158,8 +158,8 @@
     if( file == NULL )
         return( POLARSSL_ERR_ENTROPY_SOURCE_FAILED );
 
-    ret = fread( output, 1, len, file );
-    if( ret != len )
+    read_len = fread( output, 1, len, file );
+    if( read_len != len )
     {
         fclose( file );
         return( POLARSSL_ERR_ENTROPY_SOURCE_FAILED );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index b8fb507..b8a5e6e 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -566,8 +566,6 @@
     }
     else
     {
-        int ret;
-
         /* Initialize HMAC contexts */
         if( ( ret = md_init_ctx( &transform->md_ctx_enc, md_info ) ) != 0 ||
             ( ret = md_init_ctx( &transform->md_ctx_dec, md_info ) ) != 0 )
@@ -1307,7 +1305,7 @@
             /*
              * Generate IV
              */
-            int ret = ssl->f_rng( ssl->p_rng, ssl->transform_out->iv_enc,
+            ret = ssl->f_rng( ssl->p_rng, ssl->transform_out->iv_enc,
                                   ssl->transform_out->ivlen );
             if( ret != 0 )
                 return( ret );
diff --git a/programs/test/benchmark.c b/programs/test/benchmark.c
index 1a308be..00abe52 100644
--- a/programs/test/benchmark.c
+++ b/programs/test/benchmark.c
@@ -113,26 +113,26 @@
 
 #define TIME_AND_TSC( TITLE, CODE )                                     \
 do {                                                                    \
-    unsigned long i, j, tsc;                                            \
+    unsigned long ii, jj, tsc;                                          \
                                                                         \
     polarssl_printf( HEADER_FORMAT, TITLE );                            \
     fflush( stdout );                                                   \
                                                                         \
     set_alarm( 1 );                                                     \
-    for( i = 1; ! alarmed; i++ )                                        \
+    for( ii = 1; ! alarmed; ii++ )                                      \
     {                                                                   \
         CODE;                                                           \
     }                                                                   \
                                                                         \
     tsc = hardclock();                                                  \
-    for( j = 0; j < 1024; j++ )                                         \
+    for( jj = 0; jj < 1024; jj++ )                                      \
     {                                                                   \
         CODE;                                                           \
     }                                                                   \
                                                                         \
     polarssl_printf( "%9lu Kb/s,  %9lu cycles/byte\n",                  \
-                     i * BUFSIZE / 1024,                                \
-                     ( hardclock() - tsc ) / ( j * BUFSIZE ) );         \
+                     ii * BUFSIZE / 1024,                               \
+                     ( hardclock() - tsc ) / ( jj * BUFSIZE ) );        \
 } while( 0 )
 
 #if defined(POLARSSL_ERROR_C)
@@ -154,7 +154,7 @@
 
 #define MEMORY_MEASURE_PRINT( title_len )                               \
     memory_buffer_alloc_max_get( &max_used, &max_blocks );              \
-    for( i = 12 - title_len; i != 0; i-- ) polarssl_printf( " " );      \
+    for( ii = 12 - title_len; ii != 0; ii-- ) polarssl_printf( " " );   \
     max_used -= prv_used;                                               \
     max_blocks -= prv_blocks;                                           \
     max_bytes = max_used + MEM_BLOCK_OVERHEAD * max_blocks;             \
@@ -167,7 +167,7 @@
 
 #define TIME_PUBLIC( TITLE, TYPE, CODE )                                \
 do {                                                                    \
-    unsigned long i;                                                    \
+    unsigned long ii;                                                   \
     int ret;                                                            \
     MEMORY_MEASURE_INIT;                                                \
                                                                         \
@@ -176,7 +176,7 @@
     set_alarm( 3 );                                                     \
                                                                         \
     ret = 0;                                                            \
-    for( i = 1; ! alarmed && ! ret ; i++ )                              \
+    for( ii = 1; ! alarmed && ! ret ; ii++ )                            \
     {                                                                   \
         CODE;                                                           \
     }                                                                   \
@@ -187,7 +187,7 @@
     }                                                                   \
     else                                                                \
     {                                                                   \
-        polarssl_printf( "%6lu " TYPE "/s", i / 3 );                    \
+        polarssl_printf( "%6lu " TYPE "/s", ii / 3 );                   \
         MEMORY_MEASURE_PRINT( sizeof( TYPE ) + 1 );                     \
         polarssl_printf( "\n" );                                        \
     }                                                                   \