When checking cross references with -Tlint, ultimately fall back to

looking in the current working directory.  Not a security issue
because the files are never open(2)ed, only access(2)ed.
Requested by jmc@ and inspired by mdoclint(1).

This cannot be perfect because it only works for files having the
exact filename ./pagename.sec - mandoc has no way to figure out
which files might contain a manual for multiple names, or that files
in autohell might be called ./pagename.man.in instead, or which
subdirectories might contain additional source files.  Also, it may
hide messages if you have bogus stuff lying around in the directory
where you run mandoc -Tlint.  But jmc@ considers it important, and
good enough for everyday use.

Also avoid leaking the memory for the file name while here.

1 files changed, 12 insertions, 3 deletions

diff --git a/usr.bin/mandoc/main.c b/usr.bin/mandoc/main.c
index 8d7ac029169..23e79aa7e05 100644
--- a/usr.bin/mandoc/main.c
+++ b/usr.bin/mandoc/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.198 2017/07/01 12:00:12 schwarze Exp $ */
+/*	$OpenBSD: main.c,v 1.199 2017/07/01 12:53:56 schwarze Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2010-2012, 2014-2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -633,14 +633,23 @@ fs_lookup(const struct manpaths *paths, size_t ipath,
 	if (globres == 0)
 		file = mandoc_strdup(*globinfo.gl_pathv);
 	globfree(&globinfo);
-	if (globres != 0)
+	if (globres == 0)
+		goto found;
+	if (res != NULL || ipath + 1 != paths->sz)
 		return 0;
 
+	mandoc_asprintf(&file, "%s.%s", name, sec);
+	globres = access(file, R_OK);
+	free(file);
+	return globres != -1;
+
 found:
 	warnx("outdated mandoc.db lacks %s(%s) entry, run makewhatis %s",
 	    name, sec, paths->paths[ipath]);
-	if (res == NULL)
+	if (res == NULL) {
+		free(file);
 		return 1;
+	}
 	*res = mandoc_reallocarray(*res, ++*ressz, sizeof(struct manpage));
 	page = *res + (*ressz - 1);
 	page->file = file;