"Add bounds checking to some DMA operations"
https://github.com/mupen64plus/mupen64plus-core/pull/1122

Index: src/device/cart/cart_rom.c
--- src/device/cart/cart_rom.c.orig
+++ src/device/cart/cart_rom.c
@@ -28,6 +28,7 @@
 #include "device/memory/memory.h"
 #include "device/r4300/r4300_core.h"
 #include "device/rcp/pi/pi_controller.h"
+#include "device/rdram/rdram.h"
 
 #define __STDC_FORMAT_MACROS
 #include <inttypes.h>
@@ -101,7 +102,7 @@ unsigned int cart_rom_dma_write(void* opaque, uint8_t*
 
     if (cart_addr + length < cart_rom->rom_size)
     {
-        for(i = 0; i < length; ++i) {
+        for(i = 0; i < length && (dram_addr+i) < cart_rom->r4300->rdram->dram_size; ++i) {
             dram[(dram_addr+i)^S8] = mem[(cart_addr+i)^S8];
         }
     }
@@ -111,10 +112,10 @@ unsigned int cart_rom_dma_write(void* opaque, uint8_t*
             ? 0
             : cart_rom->rom_size - cart_addr;
 
-        for (i = 0; i < diff; ++i) {
+        for (i = 0; i < diff && (dram_addr+i) < cart_rom->r4300->rdram->dram_size; ++i) {
             dram[(dram_addr+i)^S8] = mem[(cart_addr+i)^S8];
         }
-        for (; i < length; ++i) {
+        for (; i < length && (dram_addr+i) < cart_rom->r4300->rdram->dram_size; ++i) {
             dram[(dram_addr+i)^S8] = 0;
         }
     }
