When checking cross references with -Tlint, ultimately fall back to

looking in the current working directory.  Not a security issue
because the files are never open(2)ed, only access(2)ed.
Requested by jmc@ and inspired by mdoclint(1).

This cannot be perfect because it only works for files having the
exact filename ./pagename.sec - mandoc has no way to figure out
which files might contain a manual for multiple names, or that files
in autohell might be called ./pagename.man.in instead, or which
subdirectories might contain additional source files.  Also, it may
hide messages if you have bogus stuff lying around in the directory
where you run mandoc -Tlint.  But jmc@ considers it important, and
good enough for everyday use.

Also avoid leaking the memory for the file name while here.

1 files changed, 11 insertions, 2 deletions

diff --git a/main.c b/main.c
index f66a763a..bd994427 100644
--- a/main.c
+++ b/main.c
@@ -663,14 +663,23 @@ fs_lookup(const struct manpaths *paths, size_t ipath,
 	if (globres == 0)
 		file = mandoc_strdup(*globinfo.gl_pathv);
 	globfree(&globinfo);
-	if (globres != 0)
+	if (globres == 0)
+		goto found;
+	if (res != NULL || ipath + 1 != paths->sz)
 		return 0;
 
+	mandoc_asprintf(&file, "%s.%s", name, sec);
+	globres = access(file, R_OK);
+	free(file);
+	return globres != -1;
+
 found:
 	warnx("outdated mandoc.db lacks %s(%s) entry, run %s %s",
 	    name, sec, BINM_MAKEWHATIS, paths->paths[ipath]);
-	if (res == NULL)
+	if (res == NULL) {
+		free(file);
 		return 1;
+	}
 	*res = mandoc_reallocarray(*res, ++*ressz, sizeof(struct manpage));
 	page = *res + (*ressz - 1);
 	page->file = file;