A good policy is to not estimate bug fixes, to not associate any points at all with them. It creates a drag on velocity, but it's honest.

If you need to fix a bug, it means that you are correcting an error from a past (implicit or otherwise) user story that shouldn't have been accepted as complete anyway.