[mhafaneh]

Core_open() copies the core's valid_extensions into a 128-byte buffer with strcpy(). The VICE cores report 128 to 142 characters, so the copy overflows and leaves the list unterminated. On an RG28XX, the cheat lookup for a C64 game.zip then tries game.tcrtgame.cht instead of game.tcrt.cht. Some cores that run without content, such as 2048, leave the list NULL, which segfaults.

This copies with a bound, treats NULL as an empty list, and raises the buffer to 256 bytes so the VICE lists fit. The two local copies in Game_open() and Cheat_getPaths() are sized to match. The other 23 cores in v6.15.0 report fewer than 128 characters, so nothing changes for them.

I tested it on my RG28XX with the v6.15.0 runtime and cores, and on the desktop build. The RG28XX has no second card for a full install, so I started minarch from a script. With this change, 2048 no longer crashes and the VICE lists are copied whole: the C64 lookup tries game.tcrt.cht, and VIC-20 reaches game.rom.cht. Zip extraction is unchanged.

Not changed here: Game_open() collects extensions into a 32-entry array without checking its size. That predates this change, and no shipped core fills it.

Fixes #879

I ran into the NULL case while loading libretro's 2048 core in a desktop build, and looking into it turned up the VICE overflow. I used Claude Code (Claude Opus 5.5, xhigh effort) to investigate this, write the fix and set up the device test.