Critical Auditor crashed for cacert.org when validating a nsec3 zone.
Looking at the tmp files for auditor there are duplicate types so there are more types then nsec3/optout and auditor reads one line from each so when it comes to the last lines in types there are no more lines in nsec3/optout so it crashes.
$ wc -l *.3831
52 audit.nsec3.3831
52 audit.optout.3831
54 audit.types.3831
54 audit.types.sorted.3831
$ cat audit.types.3831|awk '
{print $1}' |sort|uniq -c
...
1 td0po6ehub0bhvih36uneo1e51prbp2r.cacert.org
1 tmsjp1oe3ipltcnseblfockaq09qgnme.cacert.org
2 u5htgb6a0ec5tc3b88rohmah4oa08k8g.cacert.org
1 ugbmjhgiimpit67j54036qa6dvk491vv.cacert.org
2 vkipffitmcjgago86nuliq779pag9p7k.cacert.org
$ grep u5htgb6a0ec5tc3b88rohmah4oa08k8g.cacert.org audit.types.3831
u5htgb6a0ec5tc3b88rohmah4oa08k8g.cacert.org lists.cacert.org A RRSIG MX RRSIG TXT
u5htgb6a0ec5tc3b88rohmah4oa08k8g.cacert.org lists.cacert.org
$ grep vkipffitmcjgago86nuliq779pag9p7k.cacert.org audit.types.3831
vkipffitmcjgago86nuliq779pag9p7k.cacert.org svn.cacert.org A RRSIG
vkipffitmcjgago86nuliq779pag9p7k.cacert.org svn.cacert.org
Was able to replicate the problem using a clean setup of opendnssec 1.3.4 / softhsm 1.3.0, ods-ksmutil setup, softhsm init and just add the zone in the zonelist.
Start up everything and then run auditor manually on the files attached:
ods-auditor -z cacert.org -u cacert.org.inbound -s cacert.org.finalized
It will complain about NSEC3/DNSKEYs but it will crash all the same.
