Index: unbound-1.4.12/iterator/iter_scrub.c
===================================================================
--- unbound-1.4.12.orig/iterator/iter_scrub.c	2011-07-18 15:48:57.000000000 -0400
+++ unbound-1.4.12/iterator/iter_scrub.c	2011-12-23 00:17:12.416911374 -0500
@@ -187,11 +187,14 @@
 	size_t* snamelen)
 {
 	if(rrset->rr_count != 1) {
+		struct rr_parse* sig;
 		verbose(VERB_ALGO, "Found CNAME rrset with "
 			"size > 1: %u", (unsigned)rrset->rr_count);
 		/* use the first CNAME! */
 		rrset->rr_count = 1;
 		rrset->size = rrset->rr_first->size;
+		for(sig=rrset->rrsig_first; sig; sig=sig->next)
+			rrset->size += sig->size;
 		rrset->rr_last = rrset->rr_first;
 		rrset->rr_first->next = NULL;
 	}
Index: unbound-1.4.12/validator/val_nsec3.c
===================================================================
--- unbound-1.4.12.orig/validator/val_nsec3.c	2011-07-18 15:48:57.000000000 -0400
+++ unbound-1.4.12/validator/val_nsec3.c	2011-12-23 00:17:12.420911375 -0500
@@ -1196,6 +1196,10 @@
 	 * can see the ordinary unsigned data from a zone beneath an
 	 * insecure delegation under an optout here */
 
+	if(!ce.nc_rrset) {
+		verbose(VERB_ALGO, "nsec3 nodata proof: no next closer nsec3");
+		return sec_status_bogus;
+	}
 	/* We need to make sure that the covering NSEC3 is opt-out. */
 	log_assert(ce.nc_rrset);
 	if(!nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
