unpack_sha1_header(): detect malformed object header