vim-patch:8.2.3611: crash when using CTRL-W f without finding a file name

Problem:    Crash when using CTRL-W f without finding a file name.
Solution:   Bail out when the file name length is zero.
https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847

4 files changed, 23 insertions, 2 deletions

diff --git a/src/nvim/file_search.c b/src/nvim/file_search.c
index b2cd5c510b..df48370ce1 100644
--- a/src/nvim/file_search.c
+++ b/src/nvim/file_search.c
@@ -1433,6 +1433,10 @@ char_u *find_file_in_path_option(char_u *ptr, size_t len, int options, int first
     rel_fname = NULL;
   }
 
+  if (len == 0) {
+    return NULL;
+  }
+
   if (first == TRUE) {
     // copy file name into NameBuff, expanding environment variables
     save_char = ptr[len];
diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index 418ba133bd..1f528ce98a 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -4472,8 +4472,13 @@ bool get_visual_text(cmdarg_T *cap, char_u **pp, size_t *lenp)
       *pp = ml_get_pos(&VIsual);
       *lenp = (size_t)curwin->w_cursor.col - (size_t)VIsual.col + 1;
     }
-    // Correct the length to include the whole last character.
-    *lenp += (size_t)(utfc_ptr2len(*pp + (*lenp - 1)) - 1);
+    if (**pp == NUL) {
+      *lenp = 0;
+    }
+    if (*lenp > 0) {
+      // Correct the length to include all bytes of the last character.
+      *lenp += (size_t)(utfc_ptr2len(*pp + (*lenp - 1)) - 1);
+    }
   }
   reset_VIsual_and_resel();
   return true;
diff --git a/src/nvim/path.c b/src/nvim/path.c
index 674d67e21a..8b110d0ded 100644
--- a/src/nvim/path.c
+++ b/src/nvim/path.c
@@ -1682,6 +1682,10 @@ char_u *find_file_name_in_path(char_u *ptr, size_t len, int options, long count,
   char_u *file_name;
   char_u *tofree = NULL;
 
+  if (len == 0) {
+    return NULL;
+  }
+
   if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL) {
     tofree = (char_u *)eval_includeexpr((char *)ptr, len);
     if (tofree != NULL) {
diff --git a/src/nvim/testdir/test_visual.vim b/src/nvim/testdir/test_visual.vim
index 2e26da4947..e1e7765e06 100644
--- a/src/nvim/testdir/test_visual.vim
+++ b/src/nvim/testdir/test_visual.vim
@@ -1123,6 +1123,14 @@ func Test_visual_block_with_virtualedit()
   call delete('XTest_block')
 endfunc
 
+func Test_visual_block_ctrl_w_f()
+  " Emtpy block selected in new buffer should not result in an error.
+  au! BufNew foo sil norm f
+  edit foo
+
+  au! BufNew
+endfunc
+
 func Test_visual_reselect_with_count()
   " this was causing an illegal memory access
   let lines =<< trim END