exif: read from the correct pointer

`vptr` points to the current value being iterated over, not `value`, see
other switch cases.

Closes GH-22249.

Author: ndossche

NEWS

@@ -14,6 +14,9 @@ PHP                                                                        NEWS
   . Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve
     xs:QName with prefix from imported schema). (David Carlier)
 
+- Exif:
+  . Read correct value for single and double tags. (ndossche)
+
 - GD:
   . Fixed bug GH-22121 (Double free in gdImageSetStyle() after
     overflow-triggered early return). (iliaal)

ext/exif/exif.c

@@ -2306,13 +2306,13 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type single");
 #endif
-						info_value->f = php_ifd_get_float(value);
+						info_value->f = php_ifd_get_float(vptr);
 						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type double");
 #endif
-						info_value->d = php_ifd_get_double(value);
+						info_value->d = php_ifd_get_double(vptr);
 						break;
 				}
 			}