From 56e0b865591c81cd748100e5f384fe68199e5357 Mon Sep 17 00:00:00 2001
From: kub <derkub@gmail.com>
Date: Mon, 9 May 2022 21:45:59 +0200
Subject: [PATCH] core vdp, fix out-of-bounds vram access for save/load

---
 pico/videoport.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pico/videoport.c b/pico/videoport.c
index 07b16b51..7f567f17 100644
--- a/pico/videoport.c
+++ b/pico/videoport.c
@@ -1105,8 +1105,9 @@ void PicoVideoCacheSAT(int load)
 
   // rebuild SAT cache XXX wrong since cache and memory can differ
   for (l = 0; load && l < 80; l++) {
-    ((u16 *)VdpSATCache)[l*2    ] = PicoMem.vram[(SATaddr>>1) + l*4    ];
-    ((u16 *)VdpSATCache)[l*2 + 1] = PicoMem.vram[(SATaddr>>1) + l*4 + 1];
+    u16 addr = SATaddr + l*8;
+    ((u16 *)VdpSATCache)[l*2    ] = PicoMem.vram[(addr>>1)    ];
+    ((u16 *)VdpSATCache)[l*2 + 1] = PicoMem.vram[(addr>>1) + 1];
   }
 
   Pico.est.rendstatus |= PDRAW_SPRITES_MOVED;
-- 
2.39.2