fitsverify: fix wrtserr reading one row past its message array

[cruzzil]

A7 from an audit of the fitsverify sources (INSPECTION there). Confirmed real, and
reachable: CFITSIO's error stack holds up to 25 messages (errmsgsiz in
fitscore.c), so a broken enough file can hand wrtserr more than the 20 rows
it has.

The bug

utilities/fvrf_misc.c:wrtserr():

char tmp[20][80];
...
while(nstack < 20) {
    tmp[nstack][0] = '\0';
    i = fits_read_errmsg(tmp[nstack]);
    if(!i && tmp[nstack][0]=='\0') break;
    nstack++;
}
...
for(i=0; i<=nstack; i++) fprintf(out,errfmt,tmp[i]);

The inclusive print bound is deliberate — when the read loop breaks,
tmp[nstack] is the empty string it just cleared, and printing it emits the
trailing blank line the report format expects. But when the stack holds 20+
messages the loop exits on its own condition with nstack == 20, and the print
loop reads tmp[20], 80 bytes past the array.

Second, fits_read_errmsg writes up to FLEN_ERRMSG (81) bytes into rows that
are only 80 wide, so a maximum-length message overruns into the next row and
truncates the message stored there.

The fix

char tmp[21][FLEN_ERRMSG] fixes both, plus one line to terminate the row the
print loop ends on — without it the array access is in bounds but the contents
are still uninitialised when the read loop stopped on its own count, so the
report would print stack garbage instead of the blank line.

Test

tests/test_fitsverify.c already #includes fvrf_misc.c, so wrtserr() can
be called directly: with 2, 25, and one maximum-length message on the stack.
Before each call the test leaves a known 'Z' pattern on the stack where tmp
will sit, so the out-of-bounds read is deterministic rather than dependent on
what happened to be there — without the fix the report ends in a row of Zs
and the test fails. The maximum-length case checks that the message after it is
still intact.

Merge order

A stacked set of eight fitsverify fixes on top of a build-system base,
all targeting develop. Merge in this order:

0. Make the checked-in Makefile.in reproducible from Makefile.am #170 - Makefile.in reproducible from Makefile.am (build system, no code change)
1. fitsverify: fix NULL dereference in get_cmp on a complex value with no comma #160 - get_cmp NULL dereference
2. fitsverify: do not divide by a zero TFORM substring width #161 - TFORM zero substring width
3. fitsverify: bound the bit column justification report #162 - bit column report overflow
4. fitsverify: report the real card number in init_hdu diagnostics #163 - uninitialised keyword index
5. fitsverify: keep test_agap's column template inside the row #164 - test_agap column template
6. fitsverify: stop scanning table data after a failed read #165 - test_agap short read
7. fitsverify: fix wrtserr reading one row past its message array #166 - wrtserr message array <- this PR
8. fitsverify: bound the naxes[] accesses on a binary table #167 - naxes[] bounds

#170 is split out so that the Makefile.in regeneration is reviewable on
its own; the eight fixes share tests/test_fitsverify.c, which is why they
are stacked on each other rather than independent. Merged in this order
there are no conflicts. Until the ones before it are merged this PR's diff
also shows their commits; it shrinks to just its own change as they go in.

Provenance

Found by an agent, fixed by an agent, reviewed by a human. The defect list came
out of automated analysis, the reproducer, the fix and the test were written by
an agent, and a human reviewed the change on the fork
(cruzzil#16) before it was sent here.