unpack_sha1_file is being called by fsck-cache. Therefore it should not assume that a \0 occurs within the first 8192 bytes of the uncompressed data. However, currently both the sscanf and strlen calls do just that.
Also, unpack_sha1_file should call inflateEnd in a couple of the error cases.
Finally, if *size==0, shouldn't unpack_sha1_file allocate a single byte to prevent malloc from returning NULL?
Morten