Heap disclosure via reused source-length variable

Out-of-bounds heap read in Paul Evans Socket before 2.041 allows attackers to disclose adjacent heap data via a short source value. Socket.xs checks the source length before SvPVbyte reads that argument, leaving len equal to the preceding four-byte multiaddr length before a fixed-size copy into imr_sourceaddr. Exploitation requires consuming Perl code to pass an attacker-controlled source shorter than four bytes to pack_ip_mreq_source; the returned structure exposes at most three adjacent heap bytes.