diff --git a/sane-backends-1.0.23-genesys-gl646.patch b/sane-backends-1.0.23-genesys-gl646.patch
new file mode 100644
index 0000000..d5ecd13
--- /dev/null
+++ b/sane-backends-1.0.23-genesys-gl646.patch
@@ -0,0 +1,116 @@
+From 60380826afe0f04bd56e88842b90916e6d030714 Mon Sep 17 00:00:00 2001
+From: Nils Philippsen <nils@redhat.com>
+Date: Fri, 12 Jul 2013 11:47:56 +0200
+Subject: [PATCH] patch: genesys-gl646
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Squashed commit of the following:
+
+commit 7efcf373058f6031643db3db289014faee6acc35
+Author: Stéphane Voltz <stef.dev@free.fr>
+Date:   Mon Jun 3 06:33:08 2013 +0200
+
+    bug 314293 fix
+
+    - don't use non-existent end of records
+
+    (cherry picked from commit 9a8b640d8da2190ff1695169bfa45ce633b5e8c2)
+
+    Conflicts:
+    	ChangeLog
+
+commit 4762f1cd02f7c43748af2b069186d467b6a8f1e2
+Author: Stéphane Voltz <stef.dev@free.fr>
+Date:   Mon May 27 10:41:32 2013 +0200
+
+    fix bug #314261
+
+    (cherry picked from commit 40b5d75aa3e1cc033d9a489d64ff6c7b05c388cf)
+
+    Conflicts:
+    	ChangeLog
+---
+ backend/genesys_gl646.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/backend/genesys_gl646.c b/backend/genesys_gl646.c
+index a97f887..7d3ef3c 100644
+--- a/backend/genesys_gl646.c
++++ b/backend/genesys_gl646.c
+@@ -551,7 +551,7 @@ get_lowest_resolution (int sensor, SANE_Bool color)
+   i = 0;
+   dpi = 9600;
+   nb = sizeof (sensor_master) / sizeof (Sensor_Master);
+-  while (sensor_master[i].sensor != -1 && i < nb)
++  while (i < nb)
+     {
+       /* computes distance and keep mode if it is closer than previous */
+       if (sensor == sensor_master[i].sensor
+@@ -585,7 +585,7 @@ get_closest_resolution (int sensor, int required, SANE_Bool color)
+   dpi = 0;
+   dist = 9600;
+   nb = sizeof (sensor_master) / sizeof (Sensor_Master);
+-  while (sensor_master[i].sensor != -1 && i < nb)
++  while (i < nb)
+     {
+       /* exit on perfect match */
+       if (sensor == sensor_master[i].sensor
+@@ -628,7 +628,7 @@ is_half_ccd (int sensor, int required, SANE_Bool color)
+ 
+   i = 0;
+   nb = sizeof (sensor_master) / sizeof (Sensor_Master);
+-  while (sensor_master[i].sensor != -1 && i < nb)
++  while (i < nb)
+     {
+       /* exit on perfect match */
+       if (sensor == sensor_master[i].sensor
+@@ -659,7 +659,7 @@ get_cksel (int sensor, int required, SANE_Bool color)
+ 
+   i = 0;
+   nb = sizeof (sensor_master) / sizeof (Sensor_Master);
+-  while (sensor_master[i].sensor != -1 && i < nb)
++  while (i < nb)
+     {
+       /* exit on perfect match */
+       if (sensor == sensor_master[i].sensor
+@@ -745,7 +745,7 @@ gl646_setup_registers (Genesys_Device * dev,
+    * sensor mode setting */
+   i = 0;
+   nb = sizeof (sensor_master) / sizeof (Sensor_Master);
+-  while (sensor_master[i].sensor != -1 && i < nb)
++  while (i < nb)
+     {
+       if (dev->model->ccd_type == sensor_master[i].sensor
+ 	  && sensor_master[i].dpi == xresolution
+@@ -767,7 +767,7 @@ gl646_setup_registers (Genesys_Device * dev,
+    * motor mode setting */
+   i = 0;
+   nb = sizeof (motor_master) / sizeof (Motor_Master);
+-  while (motor_master[i].motor != -1 && i < nb)
++  while (i < nb)
+     {
+       if (dev->model->motor_type == motor_master[i].motor
+ 	  && motor_master[i].dpi == resolution
+@@ -788,7 +788,7 @@ gl646_setup_registers (Genesys_Device * dev,
+   /* now we can search for the specific sensor settings */
+   i = 0;
+   nb = sizeof (sensor_settings) / sizeof (Sensor_Settings);
+-  while (sensor_settings[i].sensor != -1 && i < nb)
++  while (i < nb)
+     {
+       if (sensor->sensor == sensor_settings[i].sensor
+ 	  && sensor->cksel == sensor_settings[i].cksel)
+@@ -5082,7 +5082,7 @@ simple_scan (Genesys_Device * dev, Genesys_Settings settings, SANE_Bool move,
+       DBG (DBG_error,
+ 	   "simple_scan: failed to bulk write registers: %s\n",
+ 	   sane_strstatus (status));
+-      free (data);
++      free (*data);
+       return status;
+     }
+ 
+-- 
+1.8.3.1
+
diff --git a/sane-backends.spec b/sane-backends.spec
index a60f15f..7b4806e 100644
--- a/sane-backends.spec
+++ b/sane-backends.spec
@@ -30,7 +30,7 @@
 Summary: Scanner access software
 Name: sane-backends
 Version: 1.0.23
-Release: 12%{?dist}
+Release: 13%{?dist}
 # lib/ is LGPLv2+, backends are GPLv2+ with exceptions
 # Tools are GPLv2+, docs are public domain
 # see LICENSE for details
@@ -60,6 +60,11 @@ Patch7: sane-backends-1.0.23-scanimage-man.patch
 # Add short help message to saned.
 # Upstream commit: fab378a6817c5df72b3991d160d48a23f24a1111
 Patch8: sane-backends-1.0.23-saned-help.patch
+# Fix crash in genesys (gl646) backend (#983694)
+# Upstream commits:
+# 9a8b640d8da2190ff1695169bfa45ce633b5e8c2
+# 40b5d75aa3e1cc033d9a489d64ff6c7b05c388cf
+Patch9: sane-backends-1.0.23-genesys-gl646.patch
 
 URL: http://www.sane-project.org
 
@@ -170,6 +175,7 @@ This package contains backend drivers to access digital cameras through SANE.
 %patch6 -p1 -b .coolscan-multiscan
 %patch7 -p1 -b .scanimage-man
 %patch8 -p1 -b .saned-help
+%patch9 -p1 -b .genesys-gl646
 
 %build
 CFLAGS="%optflags -fno-strict-aliasing"
@@ -277,6 +283,9 @@ popd
 %{_libdir}/sane/*gphoto2.so*
 
 %changelog
+* Fri Jul 12 2013 Nils Philippsen <nils@redhat.com> - 1.0.23-13
+- fix crash in genesys (gl646) backend (#983694)
+
 * Mon Jul 08 2013 Nils Philippsen <nils@redhat.com> - 1.0.23-12
 - describe missing flag "-b" in scanimage man page
 - add short help message to saned