From 02af9a9787a8e965cc9f37ddaabc86c4639c9526 Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Mon, 26 Jun 2023 11:01:18 -0700
Subject: [PATCH] VLAN: Fix length checking for non-Ethernet type 2 frames

(cherry picked from commit c579eb7b7cf3ca1d9008e74d7934155866c7e4f7)
---
 src/packet_analysis/protocol/vlan/VLAN.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/packet_analysis/protocol/vlan/VLAN.cc b/src/packet_analysis/protocol/vlan/VLAN.cc
index e57d7810a7..4d65ca0601 100644
--- a/src/packet_analysis/protocol/vlan/VLAN.cc
+++ b/src/packet_analysis/protocol/vlan/VLAN.cc
@@ -38,7 +38,8 @@ bool VLANAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet
 		len -= 4;
 		data += 4;
 
-		if ( len < protocol )
+		// Need at least two bytes to check the packet types below.
+		if ( len < 2 )
 			{
 			Weird("truncated_vlan_frame", packet);
 			return false;