file_list: return NULL from the at-offset accessors for an index past size

file_list_get_userdata_at_offset and file_list_get_actiondata_at_offset
checked the list pointer but not the index, so any caller with a stale
or computed index read item_file fields past the end of the allocation.
Every menu driver resolves nodes through these accessors with indices
derived from a different list than the one being indexed (selection
ordinals, entry_idx values, name-match loop cursors), and each such
site has had to carry its own bounds check; the ones that did not are
the ozone icon lookups fixed in the previous commit, one of which
crashed in the wild. An out-of-range index now resolves to NULL, the
same answer callers already take for a missing node.

The call-site guards stay: they are one compare, they document why the
index can be out of range at each site, and they keep the sites correct
against any other accessor. The header-icon comment that pointed at the
unchecked accessor is reworded to match.

libretro-common/lists/file_list.c

@@ -328,14 +328,14 @@ void file_list_sort_on_type(file_list_t *list)
 
 void *file_list_get_userdata_at_offset(const file_list_t *list, size_t idx)
 {
-   if (!list)
+   if (!list || idx >= list->size)
       return NULL;
    return list->list[idx].userdata;
 }
 
 void *file_list_get_actiondata_at_offset(const file_list_t *list, size_t idx)
 {
-   if (!list)
+   if (!list || idx >= list->size)
       return NULL;
    return list->list[idx].actiondata;
 }

menu/drivers/ozone.c

@@ -13115,10 +13115,8 @@ static void ozone_set_header(ozone_handle_t *ozone)
                   break;
             }
 
-            /* A missed match must resolve to no node; the accessor
-             * does not bounds-check, so indexing with offset ==
-             * size reads one entry past the end of the list and the
-             * garbage is then dereferenced below. */
+            /* A missed match leaves offset == size and must resolve
+             * to no node. */
             node = (offset < ozone->horizontal_list.size)
                   ? (ozone_node_t*)file_list_get_userdata_at_offset(
                         &ozone->horizontal_list, offset)