Adjacent-network code execution via unchecked size

SANE Backends before 1.0.30 allows remote attackers to execute arbitrary code via a malicious scanner on the same local network. The epsonds_net_read function trusts an attacker-controlled payload size and writes that amount into the heap buffer s->netbuf without a bounds check, causing a heap buffer overflow. Exploitation requires a malicious network-connected device and a client that communicates with the epsonds backend; successful exploitation can execute code in the client process.