menu/cbs/menu_cbs_ok: NULL-check file_transfer_t allocs in network content and download paths

Three unchecked file_transfer_t allocations in menu_cbs_ok.c,
all on user-triggered menu navigation paths.  Same underlying
pattern across all three: alloc -> immediate ->field write or
strlcpy(-> path, ...) which NULL-derefs on OOM.

=== cb_net_generic parent-dir transfer (line ~5163) ===

    file_transfer_t *transf = (file_transfer_t*)malloc(sizeof(*transf));
    parent_dir_encoded[0]   = '\0';

    transf->enum_idx        = MSG_UNKNOWN;     /* NULL-deref on OOM */
    _len = fill_pathname_parent_dir(transf->path, ...);
    ...

Fires during 'index_dirs' navigation (online updater subdir
browsing).  Void-returning function, easy to degrade.

Fix: wrap the transf-using block in 'if (transf) { ... }'.
OOM skips the parent-dir HTTP probe but doesn't crash; the
user sees the current listing without a 'go up a level'
parent entry.  They can retry by navigating back and re-
entering the online updater menu.

=== generic_action_ok_network (line ~5268) ===

    transf = (file_transfer_t*)calloc(1, sizeof(*transf));
    strlcpy(transf->path, url_path, sizeof(transf->path));  /* NULL-deref */

    task_push_http_transfer_file(url_path_encoded, ...);
    return generic_action_ok_displaylist_push(...);

Fires on every 'fetch online core / content / thumbnail list'
menu action.  Function returns an int from
generic_action_ok_displaylist_push which runs after the
transfer queueing.

Fix: wrap the HTTP transfer block in 'if (transf) { ... }'
so the displaylist push still runs (showing an empty list
until retry).  Preserves the menu's navigation position and
return-int contract.

=== action_ok_download_generic (line ~5606) ===

    transf           = (file_transfer_t*)calloc(1, sizeof(*transf));
    transf->enum_idx = enum_idx;                    /* NULL-deref on OOM */
    strlcpy(transf->path, path, sizeof(transf->path));

Fires on every user-initiated download (assets, cores, shader
presets, thumbnails, overlays, etc.).

Fix: 'if (!transf) return 0;' - same return code as the success
path at the bottom of the function.  Not using -1 because the
menu dispatch treats negative returns as hard failures that may
reset navigation state; 0 matches the normal return and leaves
the user where they were to retry.

=== Not a bug, verified clean ===

Other alloc sites in menu/cbs/ audited during this pass:

  * menu_cbs_ok.c:5141 - menu->core_buf malloc, NULL-checked
    with goto finish.
  * menu_cbs_ok.c:6870 - room_data malloc, NULL-checked with
    goto done.
  * menu_cbs_ok.c:6884 - net_st->room_list calloc, NULL-checked
    with if (room_list) guard around the memcpy loop.
  * menu_cbs_ok.c:6944 - net_st->room_list calloc in discovered-
    hosts callback, NULL-checked with goto done.
  * The 9 cheat_manager_realloc() call sites between lines
    4526-4830 are function calls into a previously-patched
    realloc contract (see '8fe1c05 cheat_manager: fix three
    OOM bug clusters...') not raw allocations.

strdup-based sites checked but not patched (graceful degrade):

  * menu_cbs_deferred_push.c:84, 339, 342 - info->path_b /
    info->path / info->label reassignments.  Callers free the
    old string first; a NULL replacement represents 'not set'
    which downstream displaylist consumers tolerate (menu
    iteration already handles missing path/label gracefully).
  * menu_cbs_deferred_push.c:464 - info->exts strdup feeds
    dir_list_append at menu_displaylist.c:4433 which gates on
    'if (ext)' before parsing (see libretro-common/lists/
    dir_list.c:326-331).  NULL exts = no ext filter, still
    returns a valid listing.
  * menu_cbs_info.c:54 - info.label for the DISPLAYLIST_HELP
    screen.  Same reasoning as the deferred_push cases; NULL
    label is treated as 'default help title' by downstream
    consumers.

Leaving those strdup sites alone keeps the diff minimal and
avoids introducing behavioural changes to paths that weren't
actually crashing.

=== Thread-safety ===

All three fixed functions run on the main thread during menu
interaction.  HTTP transfer tasks queued via
task_push_http_transfer_file run on the task worker thread but
we only queue them after the transf payload is fully populated
(the NULL-check guards skip queueing, which is what we want -
an unqueued task is a no-op).  No lock discipline changes.

=== Reachability ===

Every fix site is triggered by direct user action in the menu:
  * generic_action_ok_network + action_ok_download_generic fire
    on every content/core/thumbnail download attempt from the
    Online Updater submenu.
  * cb_net_generic parent-dir transfer fires as a follow-up
    when entering a subdirectory in the Online Updater.

Author: LibretroAdmin

menu/cbs/menu_cbs_ok.c

@@ -5161,20 +5161,29 @@ static void cb_net_generic(retro_task_t *task,
       size_t _len;
       char parent_dir_encoded[DIR_MAX_LENGTH];
       file_transfer_t *transf     = (file_transfer_t*)malloc(sizeof(*transf));
-      parent_dir_encoded[0]       = '\0';
+      /* NULL-check transf: the field writes below (->enum_idx,
+       * ->path via strlcpy through fill_pathname_parent_dir)
+       * NULL-deref on OOM.  On failure skip the parent-dir
+       * HTTP transfer entirely - the 'index_dirs' feature
+       * degrades gracefully (no parent-dir nav up from the
+       * current listing) rather than crashing. */
+      if (transf)
+      {
+         parent_dir_encoded[0]       = '\0';
 
-      transf->enum_idx            = MSG_UNKNOWN;
+         transf->enum_idx            = MSG_UNKNOWN;
 
-      _len = fill_pathname_parent_dir(transf->path,
-            state->path, sizeof(transf->path));
-      strlcpy(transf->path       + _len,
-            FILE_PATH_INDEX_DIRS_URL,
-            sizeof(transf->path) - _len);
+         _len = fill_pathname_parent_dir(transf->path,
+               state->path, sizeof(transf->path));
+         strlcpy(transf->path       + _len,
+               FILE_PATH_INDEX_DIRS_URL,
+               sizeof(transf->path) - _len);
 
-      net_http_urlencode_full(parent_dir_encoded, transf->path,
-            sizeof(parent_dir_encoded));
-      task_push_http_transfer_file(parent_dir_encoded, true,
-            "index_dirs", cb_net_generic_subdir, transf);
+         net_http_urlencode_full(parent_dir_encoded, transf->path,
+               sizeof(parent_dir_encoded));
+         task_push_http_transfer_file(parent_dir_encoded, true,
+               "index_dirs", cb_net_generic_subdir, transf);
+      }
    }
 
    if (state)
@@ -5257,10 +5266,19 @@ static int generic_action_ok_network(const char *path,
    generic_action_ok_command(CMD_EVENT_NETWORK_INIT);
 
    transf           = (file_transfer_t*)calloc(1, sizeof(*transf));
-   strlcpy(transf->path, url_path, sizeof(transf->path));
+   /* NULL-check transf: strlcpy(transf->path, ...) on the next
+    * line NULL-derefs on OOM.  Skip the HTTP transfer entirely -
+    * the displaylist push below still runs but will show an
+    * empty content list until the user retries.  Degrading to
+    * 'no network content available this session' is strictly
+    * better than crashing mid-menu-navigation. */
+   if (transf)
+   {
+      strlcpy(transf->path, url_path, sizeof(transf->path));
 
-   net_http_urlencode_full(url_path_encoded, url_path, sizeof(url_path_encoded));
-   task_push_http_transfer_file(url_path_encoded, suppress_msg, url_label, callback, transf);
+      net_http_urlencode_full(url_path_encoded, url_path, sizeof(url_path_encoded));
+      task_push_http_transfer_file(url_path_encoded, suppress_msg, url_label, callback, transf);
+   }
 
    return generic_action_ok_displaylist_push(
          path, NULL,
@@ -5586,6 +5604,12 @@ static int action_ok_download_generic(const char *path,
    fill_pathname_join_special(s2, s, path, sizeof(s2));
 
    transf           = (file_transfer_t*)calloc(1, sizeof(*transf));
+   /* NULL-check transf: the ->enum_idx write and strlcpy(transf->
+    * path, ...) below NULL-deref on OOM.  Return 0 (same as the
+    * success path below) to leave the menu state unchanged; the
+    * user can re-trigger the download once memory is available. */
+   if (!transf)
+      return 0;
    transf->enum_idx = enum_idx;
    strlcpy(transf->path, path, sizeof(transf->path));