diff --git a/fix-hp3900_sane-string-option-sizes.diff b/fix-hp3900_sane-string-option-sizes.diff
new file mode 100644
index 0000000..fea7fc4
--- /dev/null
+++ b/fix-hp3900_sane-string-option-sizes.diff
@@ -0,0 +1,36 @@
+--- a/backend/hp3900_sane.c
++++ b/backend/hp3900_sane.c
+@@ -1189,6 +1189,7 @@ options_init (TScanner * scanner)
+       scanner->rng_vertical.quant = 1;
+ 
+       /* allocate option lists */
++      bknd_info (scanner);
+       bknd_colormodes (scanner, RTS_Debug->dev_model);
+       bknd_depths (scanner, RTS_Debug->dev_model);
+       bknd_models (scanner);
+@@ -1562,6 +1563,7 @@ options_init (TScanner * scanner)
+ 	      pDesc->constraint_type = SANE_CONSTRAINT_NONE;
+ 	      pDesc->cap = SANE_CAP_ADVANCED | SANE_CAP_SOFT_DETECT;
+ 	      pVal->s = strdup (SANE_I18N ("Unknown"));
++	      pDesc->size = strlen(pVal->s) + 1;
+ 	      break;
+ 
+ 	    case opt_chipid:
+@@ -1981,7 +1983,8 @@ option_get (TScanner * scanner, SANE_Int optid, void *result)
+ 	case opt_scantype:
+ 	case opt_model:
+ 	case opt_chipname:
+-	  strcpy (result, scanner->aValues[optid].s);
++	  strncpy (result, scanner->aValues[optid].s, scanner->aOptions[optid].size);
++	  ((char*)result)[scanner->aOptions[optid].size-1] = '\0';
+ 	  break;
+ 
+ 	  /* scanner buttons */
+@@ -2113,6 +2116,7 @@ option_set (TScanner * scanner, SANE_Int optid, void *value, SANE_Int * pInfo)
+ 		      Load_Config (device);
+ 
+ 		      /* update options according to selected device */
++		      bknd_info (scanner);
+ 		      bknd_colormodes (scanner, model);
+ 		      bknd_depths (scanner, model);
+ 		      bknd_resolutions (scanner, model);
diff --git a/fix-lexmark_low-memory-leak.patch b/fix-lexmark_low-memory-leak.patch
new file mode 100644
index 0000000..494bb4c
--- /dev/null
+++ b/fix-lexmark_low-memory-leak.patch
@@ -0,0 +1,11 @@
+--- backend/lexmark_low.c.orig	2009-02-26 17:11:17.000000000 +0100
++++ backend/lexmark_low.c	2009-09-30 12:38:02.000000000 +0200
+@@ -2560,6 +2560,8 @@ sanei_lexmark_low_find_start_line (Lexma
+ 	}
+     }				/* end for buffer */
+ 
++  free (buffer);
++
+   DBG (2, "sanei_lexmark_low_find_start_line: end.\n");
+   return whiteLineCount;
+ }
diff --git a/sane-backends.changes b/sane-backends.changes
index e12921f..0cad38e 100644
--- a/sane-backends.changes
+++ b/sane-backends.changes
@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Wed Sep 30 12:59:12 CEST 2009 - jsmeix@suse.de
+
+- fix-lexmark_low-memory-leak.patch adds a missing call to free
+  in sanei_lexmark_low_find_start_line in backend/lexmark_low.c
+  (see Novell/Suse Bugzilla bnc#542341).
+- fix-hp3900_sane-string-option-sizes.diff fixes option sizes
+  because otherwise the frontend (e.g. xsane) may crash
+  (see Novell/Suse Bugzilla bnc#535752).
+
 -------------------------------------------------------------------
 Fri Sep 18 12:53:45 CEST 2009 - jsmeix@suse.de
 
diff --git a/sane-backends.spec b/sane-backends.spec
index 6289edf..7c2dbd0 100644
--- a/sane-backends.spec
+++ b/sane-backends.spec
@@ -56,14 +56,13 @@ Source110:      models.dat
 # Source200 and Source201 generate the 56-sane-backends-autoconfig.rules file
 # for automated scanner driver activation via udev ("scanner autoconfiguration").
 # Source200 is a copy of /usr/lib/YaST2/bin/create_scanner_database
-# to avoid yast2-scanner in BuildRequires which would drag almost the whole YaST:
+# to avoid yast2-scanner in BuildRequires which would drag in almost the whole YaST:
 Source200:      create_scanner_database
 # Source201 actually generates the 56-sane-backends-autoconfig.rules file
 # by reading scanner.database which was created before by create_scanner_database
 # to extract the needed info from which create_sane-backends-autoconfig.rules
 # generates the 56-sane-backends-autoconfig.rules file:
 Source201:      create_sane-backends-autoconfig.rules
-# based upon the data which is 
 # Patch1 does locale rename: no -> nb:
 # Patch1 is obsolete since sane-backends-1.0.19 because it uses 'nb'.
 # Patch2 fixes too small arrays in backend/niash.c:
@@ -92,6 +91,14 @@ Patch10:        fix-mustek_pp_ccd300.c.patch
 # Patch11 adds missing call to closedir to sane-desc.c
 # see https://bugzilla.novell.com/show_bug.cgi?id=530313
 Patch11:        sane-desc_closedir.patch
+# Patch12 adds a missing call to free in backend/lexmark_low.c
+# in the sanei_lexmark_low_find_start_line function
+# see https://bugzilla.novell.com/show_bug.cgi?id=542341
+Patch12:        fix-lexmark_low-memory-leak.patch
+# Patch13 fixes option sizes in backend/hp3900_sane.c
+# because otherwise the frontend (e.g. xsane) may crash
+# see https://bugzilla.novell.com/show_bug.cgi?id=535752
+Patch13:        fix-hp3900_sane-string-option-sizes.diff
 # Patch100... is SUSE specific stuff:
 # Patch100 lets the "canon" backend do scanner auto-recognition:
 Patch100:       canon-backend-autoprobing.patch
@@ -303,6 +310,10 @@ Authors:
 %patch10
 # Patch11 adds missing call to closedir to sane-desc.c:
 %patch11
+# Patch12 adds a missing call to free in backend/lexmark_low.c:
+%patch12
+# Patch13 fixes option sizes in backend/hp3900_sane.c
+%patch13 -p1
 # Patch100... is SUSE specific stuff:
 # Patch100 lets the "canon" backend do scanner auto-recognition:
 %patch100