CVE-2017-12998/IS-IS: Check for 2 bytes if we're going to fetch 2 bytes.

Probably a copy-and-pasteo.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).