Local crash via unchecked null configuration token

Null pointer dereference in SANE Project sane-backends 1.2.1 allows local users to crash scanimage via a crafted configuration file. The sanei_configure_attach() parser passes a null token returned by sanei_config_get_string() to strncmp() when an invalid line yields no token. Exploitation requires scanimage to load an attacker-controlled backend configuration file, a condition disputed as outside the expected trust model; the demonstrated consequence is a process crash, not arbitrary code execution.