coverity#736572: possible memory leak and memory corruption + docu

Change-Id: I2f1aad214481903866cd496542d961245fae47d1

3 files changed, 17 insertions, 6 deletions

diff --git a/vcl/inc/vcl/gdimtf.hxx b/vcl/inc/vcl/gdimtf.hxx
index ecefb903c467..4e7f38e1f952 100644
--- a/vcl/inc/vcl/gdimtf.hxx
+++ b/vcl/inc/vcl/gdimtf.hxx
@@ -199,6 +199,9 @@ public:
     MetaAction*     NextAction();
     MetaAction*     GetAction( size_t nAction ) const;
     MetaAction*     GetCurAction() const { return GetAction( nCurrentActionElement ); }
+    /**
+     * @param pAction takes ownership
+     */
     MetaAction*     ReplaceAction( MetaAction* pAction, size_t nAction );
 
     const Size&     GetPrefSize() const { return aPrefSize; }
diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 2427d9928e95..869f726cda80 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -627,12 +627,13 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                             // Subdivided for better quality for older usages
                             if(1 == aInputPolyPolygon.Count())
                             {
-                                rMtf.ReplaceAction(
+                                MetaAction* pAction = rMtf.ReplaceAction(
                                     new MetaPolyLineAction(
                                         aInputPolyPolygon.GetObject(0),
                                         pPolyLineAction->GetLineInfo()),
                                     nLastPolygonAction);
-                                pPolyLineAction->Delete();
+                                if(pAction)
+                                    pAction->Delete();
                             }
                         }
                         else
@@ -645,11 +646,12 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                                 // same sub-polygon count
                                 if(pPolyPolygonAction->GetPolyPolygon().Count() == aInputPolyPolygon.Count())
                                 {
-                                    rMtf.ReplaceAction(
+                                    MetaAction* pAction = rMtf.ReplaceAction(
                                         new MetaPolyPolygonAction(
                                             aInputPolyPolygon),
                                         nLastPolygonAction);
-                                    pPolyPolygonAction->Delete();
+                                    if(pAction)
+                                        pAction->Delete();
                                 }
                             }
                             else
@@ -661,11 +663,12 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                                     // replace MetaPolygonAction
                                     if(1 == aInputPolyPolygon.Count())
                                     {
-                                        rMtf.ReplaceAction(
+                                        MetaAction* pAction = rMtf.ReplaceAction(
                                             new MetaPolygonAction(
                                                 aInputPolyPolygon.GetObject(0)),
                                             nLastPolygonAction);
-                                        pPolygonAction->Delete();
+                                        if(pAction)
+                                            pAction->Delete();
                                     }
                                 }
                             }
diff --git a/vcl/source/gdi/gdimtf.cxx b/vcl/source/gdi/gdimtf.cxx
index a1d2c36052f4..ab53ac867712 100644
--- a/vcl/source/gdi/gdimtf.cxx
+++ b/vcl/source/gdi/gdimtf.cxx
@@ -210,7 +210,12 @@ MetaAction* GDIMetaFile::NextAction()
 MetaAction* GDIMetaFile::ReplaceAction( MetaAction* pAction, size_t nAction )
 {
     if ( nAction >= aList.size() )
+    {
+        // this method takes ownership of pAction and is
+        // therefore responsible for deleting it
+        pAction->Delete();
         return NULL;
+    }
     //fdo#39995 This does't increment the incoming action ref-count nor does it
     //decrement the outgoing action ref-count
     std::swap(pAction, aList[nAction]);