# Segfault in ui.c for backends with array integer options Some Backends offer options that are an array of TYPE_INT values. So opt.size \> sizeof(int). The code in ui.c then calls ``` sane_option_get_value( id - ID_BASE, &i ); ``` In ui.c:181 and expects one integer value to be transfered to i, but a whole array of integers is transfered, overwriting the stack and causing a segmentation fault. # Reproducting the crash Notably the test-Backend offers "red-gamma-table". Just uncomment "test" in ``` /etc/sane.d/dll.conf ``` And try to open the TWAIN user interface and a segfault occurs. But there are also other SANE backends with such options. # Solution For integer options with a size != sizeof(int), no controls for editing are to be generated. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/9483