Any unbroken n-bit cryptographic hash function has a collision resistance of 2n/2. This means that, if you want to have a 2128 collision resistance, you need to use, at minimum, a 256-bit hash function. As 264 operations are achievable, you would not want to use a 128-bit hash. A 160-bit hash (that is, a 280 security level) is borderline. Using a 256-bit hash will give you a 2128 security level, which should be completely fine for the foreseeable future. Sometimes, weaknesses in the hash function itself result in it being easier to break than the output digest would suggest. The SHA-2 family of hashes is one example that is currently unbroken. SHA-1 on the other hand is broken. It has a 160-bit output but "only" a 263 security level against collisions, rather than 280.
I suspect you may be mixing up collision attacks with other types of attacks. A collision attack will not allow an attacker to find input that hashes to an arbitrary value. The formal definitions:
Preimage attack - Given h where f(m) = h, find any m' such that f(m') = h.
"Find input that hashes to an arbitrary value."
2nd preimage attack - Given f(m) = h, find any m' such that m ≠ m' and f(m') = h.
"Modify an input without changing the resulting hash."
Collision attack - Find any pair of m and m' such that m ≠ m' and f(m) = f(m').
"Find any two inputs that have the same hash."
Each attack has different implications. A collision attack is problematic for certificates, as they can be used in signatures that are valid for both benign and malicious versions of the same software. A preimage attack is problematic for verification. Imagine if an attacker could modify an executable without changing its hash. Clearly, a preimage attack is far more severe than a collision attack, but it is also thankfully far more difficult to pull off. The infamously insecure MD4 algorithm, for example, is so bad at collision resistance that it is cheaper to find a collision than it is to run the hash function itself twice. However, as broken as it is, preimage attacks against it are highly theoretical.
If, on the other hand, you simply want to check for accidental corruption and are not intending to protect against an active attacker, then a CRC with a properly-selected polynomial would be ideal. A CRC can actually guarantee error detection up to a point.