Code execution via unchecked scanner image length

Heap buffer overflow in SANE Backends before 1.0.30 allows remote attackers on the local network to execute arbitrary code during scanning. The esci2_img function passes an attacker-controlled image-data length to eds_recv, which writes that many bytes into a fixed 64-byte heap buffer. A malicious scanner or computer must share the victim's network, and a user must select it and click Scan before code executes in the scanning application's context.