Index: iterator/iter_scrub.c
===================================================================
--- iterator/iter_scrub.c	(revision 2571)
+++ iterator/iter_scrub.c	(working copy)
@@ -187,11 +187,14 @@
 	size_t* snamelen)
 {
 	if(rrset->rr_count != 1) {
+		struct rr_parse* sig;
 		verbose(VERB_ALGO, "Found CNAME rrset with "
 			"size > 1: %u", (unsigned)rrset->rr_count);
 		/* use the first CNAME! */
 		rrset->rr_count = 1;
 		rrset->size = rrset->rr_first->size;
+		for(sig=rrset->rrsig_first; sig; sig=sig->next)
+			rrset->size += sig->size;
 		rrset->rr_last = rrset->rr_first;
 		rrset->rr_first->next = NULL;
 	}
Index: validator/val_nsec3.c
===================================================================
--- validator/val_nsec3.c	(revision 2573)
+++ validator/val_nsec3.c	(working copy)
@@ -1227,6 +1227,10 @@
 	 * covering NSEC3 was opt-out -- the proveClosestEncloser step already
 	 * checked to see if the closest encloser was a delegation or DNAME.
 	 */
+	if(!ce.nc_rrset) {
+		verbose(VERB_ALGO, "nsec3 nodata proof: no next closer nsec3");
+		return sec_status_bogus;
+	}
 	log_assert(ce.nc_rrset);
 	if(!nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
 		verbose(VERB_ALGO, "nsec3 provenods: covering NSEC3 was not "