Security fixes.

- Don't overflow the small cs_start buffer (reported by Niels
  Thykier via the debian tracker (Jakub Wilk), found with a
  fuzzer ("American fuzzy lop")).

- Cast arguments to <ctype.h> functions to unsigned char.
static int CDECL command_compare(const void *key, const void *item)
{
  return strcmp((const char *) key, ((const struct command *) item)->name);
}

static int CDECL command_compare(const void *key, const void *item)
{
  return strcmp((const char *) key, ((const struct command *) item)->name);
}
