thrift php extension,when giving data not a correct type,it will seperate it,but when running function "SEPARATE_ZVAL()",the real data pointer is changed,real data will loss.

code position:
file::thrift-0.9.0/lib/php/src/ext/thrift_protocol/php_thrift_protocol.cpp

void binary_serialize(.....)
{
.
.
.
if (Z_TYPE_PP(value) != IS_LONG)

{ SEPARATE_ZVAL(value); convert_to_long(*value); }

.
.
.
}

php client have a function:
$lmflag = array("3");
public function GetStaet($lmflag)

thrift file define this function:

ReturnResult GetState(1:list<i32> lmflag);

now we use php extension(thrift_protocol.so) to call function "GetState()",as parameter lmflag data type inconsistent,so the extension will seperate it use function "SEPARATE_ZVAL(value)", then the pointer "value" will change it point,now we can find that real data pointer is missing,the real data is lost.