Security fixes.

- Don't overflow the small cs_start buffer (reported by Niels
  Thykier via the debian tracker (Jakub Wilk), found with a
  fuzzer ("American fuzzy lop")).

- Cast arguments to <ctype.h> functions to unsigned char.
fatal_error(const char *message, ...)
{
  va_list val;
  va_start(val, message);
  fprintf(stderr, "%s: ", program_name);
  vfprintf(stderr, message, val);
  putc('\n', stderr);
  va_end(val);
  exit(1);
}

fatal_error(const char *message, ...)
{
  va_list val;
  va_start(val, message);
  fprintf(stderr, "%s: ", program_name);
  vfprintf(stderr, message, val);
  putc('\n', stderr);
  va_end(val);
  exit(1);
}
