diff --git a/metafile/metafile.go b/metafile/metafile.go
index 04886fa5..34ded61f 100644
--- a/metafile/metafile.go
+++ b/metafile/metafile.go
@@ -32,6 +32,10 @@ func Decode(reader io.Reader) (string, error) {
 		return "", err
 	}
 
+	if len(lines) < 2 {
+		return "", errors.New("No sha in meta file")
+	}
+
 	if matched {
 		return string(lines[1]), nil
 	}
diff --git a/metafile/metafile_test.go b/metafile/metafile_test.go
index ec00c293..d99945f1 100644
--- a/metafile/metafile_test.go
+++ b/metafile/metafile_test.go
@@ -51,3 +51,10 @@ func TestDecodeInvalid(t *testing.T) {
 		t.Errorf("Decoded invalid sha")
 	}
 }
+
+func TestDecodeWithValidHeaderNoSha(t *testing.T) {
+	buf := bytes.NewBufferString("# git-media")
+	if _, err := Decode(buf); err == nil {
+		t.Errorf("Decoded with header but no sha")
+	}
+}