movsub_bsf: Fix mov2textsub regression

The mov flavour of timed text uses the first two bytes of the packet as
a length field. And up until 11bef2fe said length field has been read
correctly in the mov2textsub bsf. But since then the next two bytes are
read as if they were the length field. This is fixed in this commit.
Reviewed-by: Philip Langdale <philipl@overt.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 800f618a)

libavcodec/movsub_bsf.c

@@ -75,8 +75,8 @@ static int mov2textsub(AVBSFContext *ctx, AVPacket *pkt)
        return AVERROR_INVALIDDATA;
     }
 
-    pkt->data += 2;
     pkt->size  = FFMIN(pkt->size - 2, AV_RB16(pkt->data));
+    pkt->data += 2;
 
     return 0;
 }