avcodec/truemotion2: Fix several integer overflows in tm2_motion_block()