These were all caused by sprintf() appending a null char that was not actually used.
Fixes CVE-2021-30498 and CVE-2021-30499.

Fixes: #52 (CVE-2021-3410)

Fixes: #38 (CVE-2018-20546)
Fixes: #39 (CVE-2018-20547)

Fixes: #36 (CVE-2018-20544)

The slang internal auto-detection of utf8 is only executed by a call to
SLutf8_enable(-1).

- Only affect slang/ncurses.

The Xlib and ncurses libraries query the LC_CTYPE locale value to guess
the usable character set. If the calling program did not call setlocale(),
that character set will be severely limited. Extensive Unicode support
is a reasonable libcaca user expectation.

The locale is restored as soon as possible, once the window or terminal
have been initialised. Unfortunately, the effect of setlocale() is process-
wide, and may affect other threads. This is now documented.

Note also that both Xlib and ncurses ignore the effects of uselocale()
which would have been the thread-safe solution to this problem.

This fixes the path to source files in some unit tests and allows
to get rid of a few duplicate lines.

- Save and correctly restore console input mode, ie. do not
   change settings of the original console.
 - Fix hiding of cursor.
 - Free console again if the driver actually created a new one.
 - Default canvas size is current window size.
 - Base calculation on current font.
 - Properly handle press and release events of up to 5 mouse buttons.
 - Map right mouse button to button #3. This is a change in behaviour,
   which is desirable for cross-platform codes.
 - Generate two click events for double mouse clicks.
 - Mouse wheel support, creates button press events. Button numbers
   are identical to X11 mappings.
 - Handle window buffer resize events.

unit test for the problem. Bug found by Bastian Märkisch <bmaerkisch@web.de>.

outside the canvas.

sprintf_s uses that function and VS2010 does not strip it off even if it
is unused. Also do not use 64-bit integer division in the timer code because
that will create unwanted references to ___moddi3 and ___divdi3.

provide the deprecated snprintf(). The mingw32 runtime does not provide the
MS-specific sprintf_s(). Mingw-w64 copes with both. So we switch to sprintf_s
but also provide it as a weak symbol so that mingw32 does not complain.

specifiers; this is required for proper static link.

works with the VS2010 runtime, too. Also reduce the stack size requirements
to avoid depending on __chkstk_ms().

ship the static library and includes too.

gone for good.