Adobe Flash: Out-of-bounds read in applyToRange(CVE-2017-11282)

The attached fuzzed file causes an out-of-bounds read in TextFormat.applyToRange. operator.swf...