Index: iterator/iter_scrub.c
===================================================================
--- iterator/iter_scrub.c	(revision 2571)
+++ iterator/iter_scrub.c	(working copy)
@@ -187,11 +187,14 @@
 	size_t* snamelen)
 {
 	if(rrset->rr_count != 1) {
+		struct rr_parse* sig;
 		verbose(VERB_ALGO, "Found CNAME rrset with "
 			"size > 1: %u", (unsigned)rrset->rr_count);
 		/* use the first CNAME! */
 		rrset->rr_count = 1;
 		rrset->size = rrset->rr_first->size;
+		for(sig=rrset->rrsig_first; sig; sig=sig->next)
+			rrset->size += sig->size;
 		rrset->rr_last = rrset->rr_first;
 		rrset->rr_first->next = NULL;
 	}
Index: validator/val_nsec3.c
===================================================================
--- validator/val_nsec3.c	(revision 2571)
+++ validator/val_nsec3.c	(working copy)
@@ -1209,6 +1209,10 @@
 	/* Due to forwarders, cnames, and other collating effects, we
 	 * can see the ordinary unsigned data from a zone beneath an
 	 * insecure delegation under an optout here */
+	if(!ce.nc_rrset) {
+		verbose(VERB_ALGO, "nsec3 nodata proof: no next closer nsec3");
+		return sec_status_bogus;
+	}
 
 	/* We need to make sure that the covering NSEC3 is opt-out. */
 	log_assert(ce.nc_rrset);