Application crash via uninitialized network buffer

NULL pointer dereference in SANE Backends before 1.0.30 allows remote attackers to crash scanner applications via a malicious scanner response. The sanei_epson_net_read function trusts an attacker-controlled payload size and writes network data through an uninitialized s->netbuf pointer when the response size differs from the requested length. The attacker must present a malicious scanner or computer on the victim's local network; opening simple-scan reaches discovery immediately and terminates the application.