diff --git a/opendnssec-1.4.0a1-deleterr.patch b/opendnssec-1.4.0a1-deleterr.patch
new file mode 100644
index 0000000..1f39ec5
--- /dev/null
+++ b/opendnssec-1.4.0a1-deleterr.patch
@@ -0,0 +1,12 @@
+diff -Naur opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c opendnssec-1.4.0a1/signer/src/signer/namedb.c
+--- opendnssec-1.4.0a1-orig/signer/src/signer/namedb.c	2012-03-15 13:25:45.000000000 -0400
++++ opendnssec-1.4.0a1/signer/src/signer/namedb.c	2012-05-16 11:32:52.123793809 -0400
+@@ -834,7 +834,7 @@
+     if (!denial || !db || !db->denials) {
+         return NULL;
+     }
+-    if (denial->rrset->rr_count) {
++    if (denial->rrset && denial->rrset->rr_count) {
+         ods_log_error("[%s] unable to delete denial: denial in use [#%u]",
+             db_str, denial->rrset->rr_count);
+         log_dname(denial->dname, "ERR -DENIAL", LOG_ERR);
diff --git a/opendnssec.spec b/opendnssec.spec
index c423b27..3fa8c18 100644
--- a/opendnssec.spec
+++ b/opendnssec.spec
@@ -32,7 +32,6 @@ name server. It requires a PKCS#11 crypto module library, such as softhsm
 %setup -q -n %{name}-%{version}a2
 %patch1 -p1 -b .ksmutil
 
-
 %build
 # for snapshots enable below
 sh ./autogen.sh
@@ -126,6 +125,9 @@ fi
 - ksm-utils patch for ods-ksmutil to die sooner when it can't lock
   the HSM.
 
+* Wed May 16 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.3
+- Patch for crasher with deleted RRsets and NSEC3/OPTOUT chains
+
 * Mon Mar 26 2012 Paul Wouters <pwouters@redhat.com> - 1.4.0-0.a1.2
 - Added opendnssec LICENSE file from trunk (Thanks Jakob!)