Commit d4a9726a2f5 for php.net

commit d4a9726a2f58557b464ddd8af7d0ca8952d8727e
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Sun Jun 7 22:39:46 2026 +0200

    exif: read from the correct pointer

    `vptr` points to the current value being iterated over, not `value`, see
    other switch cases.

    Closes GH-22249.

diff --git a/NEWS b/NEWS
index ad5d3753b22..3ec0d319b7e 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,9 @@ PHP                                                                        NEWS
   . Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve
     xs:QName with prefix from imported schema). (David Carlier)

+- Exif:
+  . Read correct value for single and double tags. (ndossche)
+
 - GD:
   . Fixed bug GH-22121 (Double free in gdImageSetStyle() after
     overflow-triggered early return). (iliaal)
diff --git a/ext/exif/exif.c b/ext/exif/exif.c
index ab3948819e5..58e6d280105 100644
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@@ -2306,13 +2306,13 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type single");
 #endif
-						info_value->f = php_ifd_get_float(value);
+						info_value->f = php_ifd_get_float(vptr);
 						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type double");
 #endif
-						info_value->d = php_ifd_get_double(value);
+						info_value->d = php_ifd_get_double(vptr);
 						break;
 				}
 			}