avcodec/truemotion2: Fix 2 integer overflows in tm2_update_block()