avcodec/tiertexseqv: keep the block pointer within the block

A code table whose lengths add up to more than the block size advanced
dst and dst_size past the end of the block. The copies were already
limited to the block, so no memory was written out of bounds, but forming
a pointer beyond one past the end of an array is undefined behaviour.

This is not a security issue.

libavcodec/tiertexseqv.c

@@ -69,6 +69,7 @@ static const unsigned char *seq_unpack_rle_block(const unsigned char *src,
             memcpy(dst, src, FFMIN(len, dst_size));
             src += len;
         }
+        len = FFMIN(len, dst_size);
         dst += len;
         dst_size -= len;
     }