fix potential RSP DMA buffer overflows, based on change from parallel-n64

Author: richard42

src/device/rcp/rsp/rsp_core.c

@@ -56,12 +56,12 @@ static void do_sp_dma(struct rsp_core* sp, const struct sp_dma* dma)
     {
         for(j=0; j<count; j++) {
             for(i=0; i<length; i++) {
-                dram[dramaddr^S8] = spmem[memaddr^S8];
+                dram[(dramaddr^S8) & 0x7fffff] = spmem[(memaddr^S8) & 0xfff];
                 memaddr++;
                 dramaddr++;
             }
-
-            post_framebuffer_write(&sp->dp->fb, dramaddr - length, length);
+            if (dramaddr <= 0x800000)
+                post_framebuffer_write(&sp->dp->fb, dramaddr - length, length);
             dramaddr+=skip;
         }
 
@@ -72,10 +72,11 @@ static void do_sp_dma(struct rsp_core* sp, const struct sp_dma* dma)
     else
     {
         for(j=0; j<count; j++) {
-            pre_framebuffer_read(&sp->dp->fb, dramaddr);
+            if (dramaddr < 0x800000)
+                pre_framebuffer_read(&sp->dp->fb, dramaddr);
 
             for(i=0; i<length; i++) {
-                spmem[memaddr^S8] = dram[dramaddr^S8];
+                spmem[(memaddr^S8) & 0xfff] = dram[(dramaddr^S8) & 0x7fffff];
                 memaddr++;
                 dramaddr++;
             }