Description:
------------
The "hash_hmac" function does not properly handle passing anything else than strings as their parameters.

Is is especially problematic for the second parameter "$data", because usually you'd be likely to pass externally controlled data into it.

Calling the function with something like an array instead of a string will trigger a warning, and return "NULL" as the function result. This is not documented.

The behavior is present since the introduction of the function in PHP 5.1.2.

Test script:
---------------
<?php
var_dump(hash_hmac('sha256', array(), 'secret'));
?>

See this in action at https://3v4l.org/7QtjC

For an interesting video examining a bug hunting challenge that is based on this behaviour, see https://www.youtube.com/watch?v=MpeaSNERwQA

Note that the actual result (below) is the same if you pass the array as first or third parameter (with different parameter count, of course).

Expected result:
----------------
A security related function should stop working and terminate the script with an error if something is wrong in their input parameters.

I cannot see any valid use case in letting "hash_hmac" operate on parameter types different from strings.

Actual result:
--------------
Warning: hash_hmac() expects parameter 2 to be string, array given in /in/7QtjC on line 3
NULL