Valgrind读取大小为1

Question

我一直在抓我的头发，但似乎无法找到以下代码的错误。这是它生成的valgrind输出的小片段

valgrind --leak-check=full --show-reachable=yes --track-origins=yes ./main
==9968== Memcheck, a memory error detector
==9968== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==9968== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==9968== Command: ./main
==9968== 
==9968== Invalid read of size 1
==9968==    at 0x404B77: operator*(float, Color const&) (Color.h:30)
==9968==    by 0x403532: Image<Color>::bilinearScale(unsigned short, unsigned short) const (Image.h:533)
==9968==    by 0x404109: main (main.cpp:86)
==9968==  Address 0x5dce722 is 2 bytes after a block of size 14,400 alloc'd
==9968==    at 0x4C2AFE7: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9968==    by 0x404CD7: Image<Color>::Image(unsigned short const&, unsigned short const&) (Image.h:173)
==9968==    by 0x402E20: Image<Color>::readPPM(std::istream&) (Image.h:456)
==9968==    by 0x4040D3: main (main.cpp:85)
==9968== 
==9968== Invalid read of size 1
==9968==    at 0x404B92: operator*(float, Color const&) (Color.h:30)
==9968==    by 0x403532: Image<Color>::bilinearScale(unsigned short, unsigned short) const (Image.h:533)
==9968==    by 0x404109: main (main.cpp:86)
==9968==  Address 0x5dce721 is 1 bytes after a block of size 14,400 alloc'd
==9968==    at 0x4C2AFE7: operator new[](unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9968==    by 0x404CD7: Image<Color>::Image(unsigned short const&, unsigned short const&) (Image.h:173)
==9968==    by 0x402E20: Image<Color>::readPPM(std::istream&) (Image.h:456)
==9968==    by 0x4040D3: main (main.cpp:85)

这是我的bilinearScale方法

template <>
Image<Color>* Image<Color>::bilinearScale(ushort w, ushort h) const
{
    Image<Color> *gi = new Image<Color>(w, h);

    for(ushort _y = 0; _y <h ; _y++) { /* y' .. */
        for(ushort _x=0; _x < w; _x++) { /* .. et x' */

            float x =  (width * (float)_x) / w;
            float y = (height * (float)_y)/ h;
            ushort i = ushort(x);
            ushort j = ushort(y);
            float lambda = float(x-i);
            float mu = float(y -j);

            ushort iplus = ( i+1 >= w ? i : i+1);
            ushort jplus = ( j+1 >= h ? j : j+1);

            const Color &p1 = pixel(i, j);
            const Color &p2 = pixel(iplus, j);
            const Color &p3 = pixel(i, jplus);
            const Color &p4 = pixel(iplus, jplus);

            gi->pixel(_x, _y) = (1-lambda) * ( ((1-mu)* p1)+ mu*p3 ) + lambda * ( ((1-mu) * p2) + mu * p4);
        }
    }

    return gi;
}

有人可以告诉我为什么看到无效的读物吗？

双线性的533行是：

gi->pixel(_x, _y) = (1-lambda) * ( ((1-mu)* p1)+ mu*p3 ) + lambda * ( ((1-mu) * p2) + mu * p4);

这是我的班级颜色：

typedef unsigned char ubyte;

class Color
{
public:

    ubyte red, green, blue;

    inline Color(ubyte r=0, ubyte g=0, ubyte b = 0) : red(r), green(g), blue(b)
    {}

    friend Color operator + ( float d, const Color& v )
    {
        return Color( ubyte(v.red+d), ubyte(v.green+d), ubyte(v.blue+d));
    }

    friend Color operator * ( float d, const Color& v )
    {
        return Color( ubyte(v.red*d), ubyte(v.green*d), ubyte(v.blue*d) );
    }

    Color operator + ( const Color& v );




};

Color Color::operator + ( const Color& c )
{
    return Color( red+c.red, green+c.green, blue+c.blue );
}