oleaut32: Free connection point on destruction of the picture object.

dlls/oleaut32/olepicture.c

@@ -279,7 +279,13 @@ static OLEPictureImpl* OLEPictureImpl_Construct(LPPICTDESC pictDesc, BOOL fOwn)
   newObject->lpvtblIPersistStream = &OLEPictureImpl_IPersistStream_VTable;
   newObject->lpvtblIConnectionPointContainer = &OLEPictureImpl_IConnectionPointContainer_VTable;
 
+  newObject->pCP = NULL;
   CreateConnectionPoint((IUnknown*)newObject,&IID_IPropertyNotifySink,&newObject->pCP);
+  if (!newObject->pCP)
+  {
+    HeapFree(GetProcessHeap(), 0, newObject);
+    return NULL;
+  }
 
   /*
    * Start with one reference count. The caller of this function
@@ -349,6 +355,9 @@ static void OLEPictureImpl_Destroy(OLEPictureImpl* Obj)
 {
   TRACE("(%p)\n", Obj);
 
+  if (Obj->pCP)
+    IConnectionPoint_Release(Obj->pCP);
+
   if(Obj->fOwn) { /* We need to destroy the picture */
     switch(Obj->desc.picType) {
     case PICTYPE_BITMAP: