core vdp, fix out-of-bounds vram access for save/load

diff --git a/pico/videoport.c b/pico/videoport.c
index 07b16b5..7f567f1 100644 (file)
--- a/pico/videoport.c
+++ b/pico/videoport.c
@@ -1105,8 +1105,9 @@ void PicoVideoCacheSAT(int load)
 \r
   // rebuild SAT cache XXX wrong since cache and memory can differ\r
   for (l = 0; load && l < 80; l++) {\r
-    ((u16 *)VdpSATCache)[l*2    ] = PicoMem.vram[(SATaddr>>1) + l*4    ];\r
-    ((u16 *)VdpSATCache)[l*2 + 1] = PicoMem.vram[(SATaddr>>1) + l*4 + 1];\r
+    u16 addr = SATaddr + l*8;\r
+    ((u16 *)VdpSATCache)[l*2    ] = PicoMem.vram[(addr>>1)    ];\r
+    ((u16 *)VdpSATCache)[l*2 + 1] = PicoMem.vram[(addr>>1) + 1];\r
   }\r
 \r
   Pico.est.rendstatus |= PDRAW_SPRITES_MOVED;\r