diff -up hplip-3.11.7/scan/sane/bb_ledm.c.sane-crash hplip-3.11.7/scan/sane/bb_ledm.c
--- hplip-3.11.7/scan/sane/bb_ledm.c.sane-crash	2011-07-24 21:01:23.000000000 +0200
+++ hplip-3.11.7/scan/sane/bb_ledm.c	2011-09-06 16:58:04.101315124 +0200
@@ -808,10 +808,10 @@ int bb_start_scan(struct ledm_session *p
     len = snprintf(buf, sizeof(buf), CREATE_SCAN_JOB_REQUEST,
   		ps->currentResolution,
   		ps->currentResolution,
-    	(int) (ps->currentTlx / 5548.7133 ),
+    	(int) (ps->currentTlx / 5548.7133),
     	(int) (ps->currentTly / 5548.7133),
-    	(int) (ps->currentBrx / 5548.7133),
-    	(int) (ps->currentBry / 5548.7133),
+    	(int) ((ps->currentBrx / 5548.7133) - (ps->currentTlx / 5548.7133)),
+    	(int) ((ps->currentBry / 5548.7133) - (ps->currentTly / 5548.7133)),
     	"Jpeg",
     	(! strcmp(ce_element[ps->currentScanMode], "Color8")) ? "Color" : (! strcmp(ce_element[ps->currentScanMode], "Gray8")) ? "Gray" : "Gray",
     	((! strcmp(ce_element[ps->currentScanMode], "Color8")) || (! strcmp(ce_element[ps->currentScanMode], "Gray8"))) ? 8: 8,
@@ -844,6 +844,7 @@ int bb_start_scan(struct ledm_session *p
 
   	char joblist[64];
   	char* jl=strstr(buf, "Location:");
+  	if (!jl) goto bugout;
   	jl=jl+10;
 	
   	int i=0;