AnalyzeTag doesn't check the value of `length` fits within the read buffer
