From: Andrey Andreev <narf@devilix.net>
Date: Mon, 16 Jan 2017 13:51:13 +0000 (+0200)
Subject: Disallow non-crypto hashes in HMAC and PBKDF2
X-Git-Tag: php-7.2.0alpha1~502
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d89d149edf39cf4ce9ab41979f246e82510d43a5;p=php

Disallow non-crypto hashes in HMAC and PBKDF2

For this purpose add is_crypto flag to php_hash_ops.
---

diff --git a/UPGRADING b/UPGRADING
index 7766d4e363..6b429dae79 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -42,6 +42,10 @@ PHP 7.2 UPGRADE NOTES
     such, its behavior now follows fmod() rather than the `%` operator. For
     example `bcmod('4', '3.5')` now returns '0.5' instead of '1'.
 
+- Hash:
+  . The hash_hmac(), hash_hmac_file() and hash_pbkdf2() functions no longer
+    accept non-cryptographic hashes.
+
 - PCRE:
   . preg_match() and other PCRE functions now distinguish between unmatched
     subpatterns and empty matches by reporting NULL and "" (empty string),
diff --git a/ext/hash/hash.c b/ext/hash/hash.c
index 06c9f36705..8040732d53 100644
--- a/ext/hash/hash.c
+++ b/ext/hash/hash.c
@@ -248,6 +248,11 @@ static void php_hash_do_hash_hmac(INTERNAL_FUNCTION_PARAMETERS, int isfilename,
 		php_error_docref(NULL, E_WARNING, "Unknown hashing algorithm: %s", algo);
 		RETURN_FALSE;
 	}
+	else if (!ops->is_crypto) {
+		php_error_docref(NULL, E_WARNING, "Non-cryptographic hashing algorithm: %s", algo);
+		RETURN_FALSE;
+	}
+
 	if (isfilename) {
 		if (CHECK_NULL_PATH(data, data_len)) {
 			php_error_docref(NULL, E_WARNING, "Invalid path");
@@ -597,25 +602,6 @@ PHP_FUNCTION(hash_algos)
 }
 /* }}} */
 
-static inline zend_bool php_hash_is_crypto(const char *algo, size_t algo_len) {
-
-	char *blacklist[] = { "adler32", "crc32", "crc32b", "fnv132", "fnv1a32", "fnv164", "fnv1a64", "joaat", NULL };
-	char *lower = zend_str_tolower_dup(algo, algo_len);
-	int i = 0;
-
-	while (blacklist[i]) {
-		if (strcmp(lower, blacklist[i]) == 0) {
-			efree(lower);
-			return 0;
-		}
-
-		i++;
-	}
-
-	efree(lower);
-	return 1;
-}
-
 /* {{{ proto string hash_hkdf(string algo, string ikm [, int length = 0, string info = '', string salt = ''])
 RFC5869 HMAC-based key derivation function */
 PHP_FUNCTION(hash_hkdf)
@@ -636,8 +622,8 @@ PHP_FUNCTION(hash_hkdf)
 		php_error_docref(NULL, E_WARNING, "Unknown hashing algorithm: %s", ZSTR_VAL(algo));
 		RETURN_FALSE;
 	}
-	
-	if (!php_hash_is_crypto(ZSTR_VAL(algo), ZSTR_LEN(algo))) {
+
+	if (!ops->is_crypto) {
 		php_error_docref(NULL, E_WARNING, "Non-cryptographic hashing algorithm: %s", ZSTR_VAL(algo));
 		RETURN_FALSE;
 	}
@@ -736,6 +722,10 @@ PHP_FUNCTION(hash_pbkdf2)
 		php_error_docref(NULL, E_WARNING, "Unknown hashing algorithm: %s", algo);
 		RETURN_FALSE;
 	}
+	else if (!ops->is_crypto) {
+		php_error_docref(NULL, E_WARNING, "Non-cryptographic hashing algorithm: %s", algo);
+		RETURN_FALSE;
+	}
 
 	if (iterations <= 0) {
 		php_error_docref(NULL, E_WARNING, "Iterations must be a positive integer: " ZEND_LONG_FMT, iterations);
diff --git a/ext/hash/hash_adler32.c b/ext/hash/hash_adler32.c
index 3cb9ddfb7e..a989df592b 100644
--- a/ext/hash/hash_adler32.c
+++ b/ext/hash/hash_adler32.c
@@ -69,7 +69,8 @@ const php_hash_ops php_hash_adler32_ops = {
 	(php_hash_copy_func_t) PHP_ADLER32Copy,
 	4, /* what to say here? */
 	4,
-	sizeof(PHP_ADLER32_CTX)
+	sizeof(PHP_ADLER32_CTX),
+	0
 };
 
 /*
diff --git a/ext/hash/hash_crc32.c b/ext/hash/hash_crc32.c
index ee3afa78e4..63f5de3c76 100644
--- a/ext/hash/hash_crc32.c
+++ b/ext/hash/hash_crc32.c
@@ -79,7 +79,8 @@ const php_hash_ops php_hash_crc32_ops = {
 	(php_hash_copy_func_t) PHP_CRC32Copy,
 	4, /* what to say here? */
 	4,
-	sizeof(PHP_CRC32_CTX)
+	sizeof(PHP_CRC32_CTX),
+	0
 };
 
 const php_hash_ops php_hash_crc32b_ops = {
@@ -89,7 +90,8 @@ const php_hash_ops php_hash_crc32b_ops = {
 	(php_hash_copy_func_t) PHP_CRC32Copy,
 	4, /* what to say here? */
 	4,
-	sizeof(PHP_CRC32_CTX)
+	sizeof(PHP_CRC32_CTX),
+	0
 };
 
 /*
diff --git a/ext/hash/hash_fnv.c b/ext/hash/hash_fnv.c
index 4a7619de16..d11b6880cd 100644
--- a/ext/hash/hash_fnv.c
+++ b/ext/hash/hash_fnv.c
@@ -31,17 +31,19 @@ const php_hash_ops php_hash_fnv132_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	4,
 	4,
-	sizeof(PHP_FNV132_CTX)
+	sizeof(PHP_FNV132_CTX),
+	0
 };
 
-	const php_hash_ops php_hash_fnv1a32_ops = {
+const php_hash_ops php_hash_fnv1a32_ops = {
 	(php_hash_init_func_t) PHP_FNV132Init,
 	(php_hash_update_func_t) PHP_FNV1a32Update,
  	(php_hash_final_func_t) PHP_FNV132Final,
 	(php_hash_copy_func_t) php_hash_copy,
 	4,
 	4,
-	sizeof(PHP_FNV132_CTX)
+	sizeof(PHP_FNV132_CTX),
+	0
 };
 
 const php_hash_ops php_hash_fnv164_ops = {
@@ -51,7 +53,8 @@ const php_hash_ops php_hash_fnv164_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	8,
 	4,
-	sizeof(PHP_FNV164_CTX)
+	sizeof(PHP_FNV164_CTX),
+	0
 };
 
 const php_hash_ops php_hash_fnv1a64_ops = {
@@ -61,7 +64,8 @@ const php_hash_ops php_hash_fnv1a64_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	8,
 	4,
-	sizeof(PHP_FNV164_CTX)
+	sizeof(PHP_FNV164_CTX),
+	0
 };
 
 /* {{{ PHP_FNV132Init
diff --git a/ext/hash/hash_gost.c b/ext/hash/hash_gost.c
index 7961fc6c3a..1ce8beefd4 100644
--- a/ext/hash/hash_gost.c
+++ b/ext/hash/hash_gost.c
@@ -316,7 +316,8 @@ const php_hash_ops php_hash_gost_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	32,
 	32,
-	sizeof(PHP_GOST_CTX)
+	sizeof(PHP_GOST_CTX),
+	1
 };
 
 const php_hash_ops php_hash_gost_crypto_ops = {
@@ -326,7 +327,8 @@ const php_hash_ops php_hash_gost_crypto_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	32,
 	32,
-	sizeof(PHP_GOST_CTX)
+	sizeof(PHP_GOST_CTX),
+	1
 };
 
 /*
diff --git a/ext/hash/hash_haval.c b/ext/hash/hash_haval.c
index 2b10e5f2c2..1848e2d240 100644
--- a/ext/hash/hash_haval.c
+++ b/ext/hash/hash_haval.c
@@ -255,7 +255,7 @@ const php_hash_ops php_hash_##p##haval##b##_ops = { \
 	(php_hash_update_func_t) PHP_HAVALUpdate, \
 	(php_hash_final_func_t) PHP_HAVAL##b##Final, \
 	(php_hash_copy_func_t) php_hash_copy, \
-	((b) / 8), 128, sizeof(PHP_HAVAL_CTX) }; \
+	((b) / 8), 128, sizeof(PHP_HAVAL_CTX), 1 }; \
 PHP_HASH_API void PHP_##p##HAVAL##b##Init(PHP_HAVAL_CTX *context) \
 {	int i; context->count[0] = 	context->count[1] = 	0; \
 	for(i = 0; i < 8; i++) context->state[i] = D0[i]; \
diff --git a/ext/hash/hash_joaat.c b/ext/hash/hash_joaat.c
index 43199465b5..530f73ea90 100644
--- a/ext/hash/hash_joaat.c
+++ b/ext/hash/hash_joaat.c
@@ -32,7 +32,8 @@ const php_hash_ops php_hash_joaat_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	4,
 	4,
-	sizeof(PHP_JOAAT_CTX)
+	sizeof(PHP_JOAAT_CTX),
+	0
 };
 
 PHP_HASH_API void PHP_JOAATInit(PHP_JOAAT_CTX *context)
diff --git a/ext/hash/hash_md.c b/ext/hash/hash_md.c
index 073715d196..06afc4a08e 100644
--- a/ext/hash/hash_md.c
+++ b/ext/hash/hash_md.c
@@ -28,7 +28,8 @@ const php_hash_ops php_hash_md5_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	16,
 	64,
-	sizeof(PHP_MD5_CTX)
+	sizeof(PHP_MD5_CTX),
+	1
 };
 
 const php_hash_ops php_hash_md4_ops = {
@@ -38,7 +39,8 @@ const php_hash_ops php_hash_md4_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	16,
 	64,
-	sizeof(PHP_MD4_CTX)
+	sizeof(PHP_MD4_CTX),
+	1
 };
 
 const php_hash_ops php_hash_md2_ops = {
@@ -48,7 +50,8 @@ const php_hash_ops php_hash_md2_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	16,
 	16,
-	sizeof(PHP_MD2_CTX)
+	sizeof(PHP_MD2_CTX),
+	1
 };
 
 /* MD common stuff */
diff --git a/ext/hash/hash_ripemd.c b/ext/hash/hash_ripemd.c
index d08cfe43c2..b7f2ef4bd8 100644
--- a/ext/hash/hash_ripemd.c
+++ b/ext/hash/hash_ripemd.c
@@ -32,7 +32,8 @@ const php_hash_ops php_hash_ripemd128_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	16,
 	64,
-	sizeof(PHP_RIPEMD128_CTX)
+	sizeof(PHP_RIPEMD128_CTX),
+	1
 };
 
 const php_hash_ops php_hash_ripemd160_ops = {
@@ -42,7 +43,8 @@ const php_hash_ops php_hash_ripemd160_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	20,
 	64,
-	sizeof(PHP_RIPEMD160_CTX)
+	sizeof(PHP_RIPEMD160_CTX),
+	1
 };
 
 const php_hash_ops php_hash_ripemd256_ops = {
@@ -52,7 +54,8 @@ const php_hash_ops php_hash_ripemd256_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	32,
 	64,
-	sizeof(PHP_RIPEMD256_CTX)
+	sizeof(PHP_RIPEMD256_CTX),
+	1
 };
 
 const php_hash_ops php_hash_ripemd320_ops = {
@@ -62,7 +65,8 @@ const php_hash_ops php_hash_ripemd320_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	40,
 	64,
-	sizeof(PHP_RIPEMD320_CTX)
+	sizeof(PHP_RIPEMD320_CTX),
+	1
 };
 
 /* {{{ PHP_RIPEMD128Init
diff --git a/ext/hash/hash_sha.c b/ext/hash/hash_sha.c
index 6f4ff0ef7c..dee85fc473 100644
--- a/ext/hash/hash_sha.c
+++ b/ext/hash/hash_sha.c
@@ -73,7 +73,8 @@ const php_hash_ops php_hash_sha1_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	20,
 	64,
-	sizeof(PHP_SHA1_CTX)
+	sizeof(PHP_SHA1_CTX),
+	1
 };
 
 #ifdef PHP_HASH_SHA1_NOT_IN_CORE
@@ -415,7 +416,8 @@ const php_hash_ops php_hash_sha256_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	32,
 	64,
-	sizeof(PHP_SHA256_CTX)
+	sizeof(PHP_SHA256_CTX),
+	1
 };
 
 const php_hash_ops php_hash_sha224_ops = {
@@ -425,7 +427,8 @@ const php_hash_ops php_hash_sha224_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	28,
 	64,
-	sizeof(PHP_SHA224_CTX)
+	sizeof(PHP_SHA224_CTX),
+	1
 };
 
 #define ROTR32(b,x)		((x >> b) | (x << (32 - b)))
@@ -917,7 +920,8 @@ const php_hash_ops php_hash_sha384_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	48,
 	128,
-	sizeof(PHP_SHA384_CTX)
+	sizeof(PHP_SHA384_CTX),
+	1
 };
 
 /* {{{ PHP_SHA512Init
@@ -1089,7 +1093,8 @@ const php_hash_ops php_hash_sha512_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	64,
 	128,
-	sizeof(PHP_SHA512_CTX)
+	sizeof(PHP_SHA512_CTX),
+	1
 };
 
 const php_hash_ops php_hash_sha512_256_ops = {
@@ -1099,7 +1104,8 @@ const php_hash_ops php_hash_sha512_256_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	32,
 	128,
-	sizeof(PHP_SHA512_CTX)
+	sizeof(PHP_SHA512_CTX),
+	1
 };
 
 const php_hash_ops php_hash_sha512_224_ops = {
@@ -1109,7 +1115,8 @@ const php_hash_ops php_hash_sha512_224_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	28,
 	128,
-	sizeof(PHP_SHA512_CTX)
+	sizeof(PHP_SHA512_CTX),
+	1
 };
 
 /*
diff --git a/ext/hash/hash_sha3.c b/ext/hash/hash_sha3.c
index d6eb1a0f39..3999d45562 100644
--- a/ext/hash/hash_sha3.c
+++ b/ext/hash/hash_sha3.c
@@ -218,7 +218,8 @@ const php_hash_ops php_hash_sha3_##bits##_ops = { \
 	php_hash_copy, \
 	bits >> 3, \
 	(1600 - (2 * bits)) >> 3, \
-	sizeof(PHP_SHA3_##bits##_CTX) \
+	sizeof(PHP_SHA3_##bits##_CTX), \
+	1 \
 }
 
 DECLARE_SHA3_OPS(224);
diff --git a/ext/hash/hash_snefru.c b/ext/hash/hash_snefru.c
index 17f70d6450..5de2a283ff 100644
--- a/ext/hash/hash_snefru.c
+++ b/ext/hash/hash_snefru.c
@@ -200,7 +200,8 @@ const php_hash_ops php_hash_snefru_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	32,
 	32,
-	sizeof(PHP_SNEFRU_CTX)
+	sizeof(PHP_SNEFRU_CTX),
+	1
 };
 
 /*
diff --git a/ext/hash/hash_tiger.c b/ext/hash/hash_tiger.c
index c7009a1b29..f3ea46344c 100644
--- a/ext/hash/hash_tiger.c
+++ b/ext/hash/hash_tiger.c
@@ -251,7 +251,8 @@ PHP_HASH_API void PHP_TIGER192Final(unsigned char digest[24], PHP_TIGER_CTX *con
 		(php_hash_copy_func_t) php_hash_copy, \
 		b/8, \
 		64, \
-		sizeof(PHP_TIGER_CTX) \
+		sizeof(PHP_TIGER_CTX), \
+		1 \
 	}
 
 PHP_HASH_TIGER_OPS(3, 128);
diff --git a/ext/hash/hash_whirlpool.c b/ext/hash/hash_whirlpool.c
index 415c346f99..425a89128a 100644
--- a/ext/hash/hash_whirlpool.c
+++ b/ext/hash/hash_whirlpool.c
@@ -440,7 +440,8 @@ const php_hash_ops php_hash_whirlpool_ops = {
 	(php_hash_copy_func_t) php_hash_copy,
 	64,
 	64,
-	sizeof(PHP_WHIRLPOOL_CTX)
+	sizeof(PHP_WHIRLPOOL_CTX),
+	1
 };
 
 /*
diff --git a/ext/hash/php_hash.h b/ext/hash/php_hash.h
index 45a598c4dd..b67b8c59a3 100644
--- a/ext/hash/php_hash.h
+++ b/ext/hash/php_hash.h
@@ -46,6 +46,7 @@ typedef struct _php_hash_ops {
 	int digest_size;
 	int block_size;
 	int context_size;
+	unsigned is_crypto: 1;
 } php_hash_ops;
 
 typedef struct _php_hash_data {
diff --git a/ext/hash/tests/hash_hmac_basic.phpt b/ext/hash/tests/hash_hmac_basic.phpt
index a0a49533d5..ad4e754e55 100644
--- a/ext/hash/tests/hash_hmac_basic.phpt
+++ b/ext/hash/tests/hash_hmac_basic.phpt
@@ -16,8 +16,6 @@ echo "*** Testing hash_hmac() : basic functionality ***\n";
 $content = "This is a sample string used to test the hash_hmac function with various hashing algorithms";
 $key = 'secret';
 
-echo "adler32: " . hash_hmac('adler32', $content, $key) . "\n";
-echo "crc32: " . hash_hmac('crc32', $content, $key) . "\n";
 echo "gost: " . hash_hmac('gost', $content, $key) . "\n";
 echo "haval128,3: " . hash_hmac('haval128,3', $content, $key) . "\n";
 echo "md2: " . hash_hmac('md2', $content, $key) . "\n";
@@ -34,7 +32,6 @@ echo "sha512: " . hash_hmac('sha512', $content, $key) . "\n";
 echo "snefru: " . hash_hmac('snefru', $content, $key) . "\n";
 echo "tiger192,3: " . hash_hmac('tiger192,3', $content, $key) . "\n";
 echo "whirlpool: " . hash_hmac('whirlpool', $content, $key) . "\n";
-echo "adler32(raw): " . bin2hex(hash_hmac('adler32', $content, $key, TRUE)) . "\n";
 echo "md5(raw): " . bin2hex(hash_hmac('md5', $content, $key, TRUE)) . "\n";
 echo "sha256(raw): " . bin2hex(hash_hmac('sha256', $content, $key, TRUE)) . "\n";
 
@@ -42,8 +39,6 @@ echo "sha256(raw): " . bin2hex(hash_hmac('sha256', $content, $key, TRUE)) . "\n"
 ===Done===
 --EXPECTF--
 *** Testing hash_hmac() : basic functionality ***
-adler32: 12c803f7
-crc32: 96859101
 gost: a4a3c80bdf3f8665bf07376a34dc9c1b11af7c813f4928f62e39f0c0dc564dad
 haval128,3: 4d1318607f0406bd1b7bd50907772672
 md2: 6d111dab563025e4cb5f4425c991fa12
@@ -60,7 +55,6 @@ sha512: 7de05636b18e2b0ca3427e03f53074af3a48a7b9df226daba4f22324c570638e7d7b2643
 snefru: 67af483046f9cf16fe19f9087929ccfc6ad176ade3290b4d33f43e0ddb07e711
 tiger192,3: 00a0f884f15a9e5549ed0e40ca0190522d369027e16d5b59
 whirlpool: 4a0f1582b21b7aff59bfba7f9c29131c69741b2ce80acdc7d314040f3b768cf5a17e30b74cceb86fbc6b34b1692e0addd5bfd7cfc043d40c0621f1b97e26fa49
-adler32(raw): 12c803f7
 md5(raw): 2a632783e2812cf23de100d7d6a463ae
 sha256(raw): 49bde3496b9510a17d0edd8a4b0ac70148e32a1d51e881ec76faa96534125838
 ===Done===
diff --git a/ext/hash/tests/hash_hmac_error.phpt b/ext/hash/tests/hash_hmac_error.phpt
index 7ced431c6a..bff478a55e 100644
--- a/ext/hash/tests/hash_hmac_error.phpt
+++ b/ext/hash/tests/hash_hmac_error.phpt
@@ -16,16 +16,19 @@ $key = 'secret';
 
 echo "\n-- Testing hash_hmac() function with less than expected no. of arguments --\n";
 var_dump(hash_hmac());
-var_dump(hash_hmac('crc32'));
-var_dump(hash_hmac('crc32', $data));
+var_dump(hash_hmac('md5'));
+var_dump(hash_hmac('md5', $data));
 
 echo "\n-- Testing hash_hmac() function with more than expected no. of arguments --\n";
 $extra_arg = 10;
-var_dump(hash_hmac('crc32', $data, $key, TRUE, $extra_arg));
+var_dump(hash_hmac('md5', $data, $key, TRUE, $extra_arg));
 
 echo "\n-- Testing hash_hmac() function with invalid hash algorithm --\n";
 var_dump(hash_hmac('foo', $data, $key));
 
+echo "\n-- Testing hash_hmac() function with non-cryptographic hash algorithm --\n";
+var_dump(hash_hmac('crc32', $data, $key));
+
 ?>
 ===Done===
 --EXPECTF--
@@ -51,4 +54,9 @@ NULL
 
 Warning: hash_hmac(): Unknown hashing algorithm: foo in %s on line %d
 bool(false)
-===Done===
\ No newline at end of file
+
+-- Testing hash_hmac() function with non-cryptographic hash algorithm --
+
+Warning: hash_hmac(): Non-cryptographic hashing algorithm: crc32 in %s on line %d
+bool(false)
+===Done===
diff --git a/ext/hash/tests/hash_hmac_file_basic.phpt b/ext/hash/tests/hash_hmac_file_basic.phpt
index 5c18fd6a2d..8ac248756c 100644
--- a/ext/hash/tests/hash_hmac_file_basic.phpt
+++ b/ext/hash/tests/hash_hmac_file_basic.phpt
@@ -36,8 +36,6 @@ fclose($fp);
 $key = 'secret';
 
 
-echo "adler32: " . hash_hmac_file('adler32', $file, $key) . "\n";
-echo "crc32: " . hash_hmac_file('crc32', $file, $key) . "\n";
 echo "gost: " . hash_hmac_file('gost', $file, $key) . "\n";
 echo "haval128,3: " . hash_hmac_file('haval128,3', $file, $key) . "\n";
 echo "md2: " . hash_hmac_file('md2', $file, $key) . "\n";
@@ -55,7 +53,6 @@ echo "snefru: " . hash_hmac_file('snefru', $file, $key) . "\n";
 echo "tiger192,3: " . hash_hmac_file('tiger192,3', $file, $key) . "\n";
 echo "whirlpool: " . hash_hmac_file('whirlpool', $file, $key) . "\n";
 
-echo "adler32(raw): " . bin2hex(hash_hmac_file('adler32', $file, $key, TRUE)) . "\n";
 echo "md5(raw): " . bin2hex(hash_hmac_file('md5', $file, $key, TRUE)). "\n";
 echo "sha256(raw): " . bin2hex(hash_hmac_file('sha256', $file, $key, TRUE)). "\n";
 
@@ -70,8 +67,6 @@ unlink($file);
 ===Done===
 --EXPECTF--
 *** Testing hash_hmac_file() : basic functionality ***
-adler32: 0f8c02f9
-crc32: f2a60b9c
 gost: 94c39a40d5db852a8dc3d24e37eebf2d53e3d711457c59cd02b614f792a9d918
 haval128,3: f1cea637451097d790354a86de3f54a3
 md2: a685475e600314bb549ab4f33c3b27cb
@@ -88,7 +83,6 @@ sha512: d460aabdf0353655059ed0d408efa91f19c4cda46acc2a4e0adf4764b06951c899fbb2ed
 snefru: 7b79787e1c1d926b6cc98327f05c5d04ba6227ab51c1398661861196016ef34c
 tiger192,3: ca89badf843ba68e3fae5832635aa848a72a4bc11676edd4
 whirlpool: 37a0fbb90547690d5e5e11c046f6654ffdb7bab15e16d9d79c7d85765cc4bdcbfd9df8db7a3ce9558f3f244fead00ca29cf05297f75596555195a0683f15d69f
-adler32(raw): 0f8c02f9
 md5(raw): 8bddf39dd1c566c27acc7fa85ec36acf
 sha256(raw): 9135286ca4c84dec711e4b831f6cd39e672e5ff93d011321274eb76733cc1e40
 Error cases:
diff --git a/ext/hash/tests/hash_hmac_file_error.phpt b/ext/hash/tests/hash_hmac_file_error.phpt
index 26ba8aacbe..29adbddba8 100644
--- a/ext/hash/tests/hash_hmac_file_error.phpt
+++ b/ext/hash/tests/hash_hmac_file_error.phpt
@@ -28,8 +28,11 @@ hash_hmac_file('crc32', $file, $key, TRUE, $extra_arg);
 echo "\n-- Testing hash_hmac_file() function with invalid hash algorithm --\n";
 hash_hmac_file('foo', $file, $key, TRUE);
 
+echo "\n-- Testing hash_hmac_file() function with non-cryptographic hash algorithm --\n";
+hash_hmac_file('crc32', $file, $key, TRUE);
+
 echo "\n-- Testing hash_hmac_file() function with bad path --\n";
-hash_hmac_file('crc32', $file.chr(0).$file, $key, TRUE);
+hash_hmac_file('md5', $file.chr(0).$file, $key, TRUE);
 
 ?>
 ===Done===
@@ -55,7 +58,11 @@ Warning: hash_hmac_file() expects at most 4 parameters, 5 given in %s on line %d
 
 Warning: hash_hmac_file(): Unknown hashing algorithm: foo in %s on line %d
 
+-- Testing hash_hmac_file() function with non-cryptographic hash algorithm --
+
+Warning: hash_hmac_file(): Non-cryptographic hashing algorithm: crc32 in %s on line %d
+
 -- Testing hash_hmac_file() function with bad path --
 
 Warning: hash_hmac_file(): Invalid path in %s on line %d
-===Done===
\ No newline at end of file
+===Done===
diff --git a/ext/hash/tests/hash_pbkdf2_error.phpt b/ext/hash/tests/hash_pbkdf2_error.phpt
index fd70cca581..8c49d365d2 100644
--- a/ext/hash/tests/hash_pbkdf2_error.phpt
+++ b/ext/hash/tests/hash_pbkdf2_error.phpt
@@ -17,21 +17,25 @@ $salt = 'salt';
 echo "\n-- Testing hash_pbkdf2() function with less than expected no. of arguments --\n";
 var_dump(@hash_pbkdf2());
 echo $php_errormsg . "\n";
-var_dump(@hash_pbkdf2('crc32'));
+var_dump(@hash_pbkdf2('md5'));
 echo $php_errormsg . "\n";
-var_dump(@hash_pbkdf2('crc32', $password));
+var_dump(@hash_pbkdf2('md5', $password));
 echo $php_errormsg . "\n";
-var_dump(@hash_pbkdf2('crc32', $password, $salt));
+var_dump(@hash_pbkdf2('md5', $password, $salt));
 echo $php_errormsg . "\n";
 
 echo "\n-- Testing hash_pbkdf2() function with more than expected no. of arguments --\n";
-var_dump(@hash_pbkdf2('crc32', $password, $salt, 10, 10, true, 'extra arg'));
+var_dump(@hash_pbkdf2('md5', $password, $salt, 10, 10, true, 'extra arg'));
 echo $php_errormsg . "\n";
 
 echo "\n-- Testing hash_pbkdf2() function with invalid hash algorithm --\n";
 var_dump(@hash_pbkdf2('foo', $password, $salt, 1));
 echo $php_errormsg . "\n";
 
+echo "\n-- Testing hash_pbkdf2() function with non-cryptographic hash algorithm --\n";
+var_dump(@hash_pbkdf2('crc32', $password, $salt, 1));
+echo $php_errormsg . "\n";
+
 echo "\n-- Testing hash_pbkdf2() function with invalid iterations --\n";
 var_dump(@hash_pbkdf2('md5', $password, $salt, 0));
 echo $php_errormsg . "\n";
@@ -65,6 +69,10 @@ hash_pbkdf2() expects at most 6 parameters, 7 given
 bool(false)
 hash_pbkdf2(): Unknown hashing algorithm: foo
 
+-- Testing hash_pbkdf2() function with non-cryptographic hash algorithm --
+bool(false)
+hash_pbkdf2(): Non-cryptographic hashing algorithm: crc32
+
 -- Testing hash_pbkdf2() function with invalid iterations --
 bool(false)
 hash_pbkdf2(): Iterations must be a positive integer: 0