Adds checks for annotation wrappers with length 0.

src/main/java/com/amazon/ion/impl/IonCursorBinary.java

@@ -803,6 +803,9 @@ private boolean uncheckedReadAnnotationWrapperHeader_1_0(IonTypeID valueTid) {
             } else {
                 endIndex = uncheckedReadVarUInt_1_0(b);
             }
+            if (endIndex == 0) {
+                throw new IonException("Annotation wrapper must wrap a value.");
+            }
         } else {
             endIndex = valueTid.length;
         }
@@ -851,6 +854,9 @@ private boolean slowReadAnnotationWrapperHeader_1_0(IonTypeID valueTid) {
             if (valueLength < 0) {
                 return true;
             }
+            if (valueLength == 0) {
+                throw new IonException("Annotation wrapper must wrap a value.");
+            }
         } else {
             // At this point the value must be at least 3 more bytes: 1 for the smallest-possible annotations
             // length, 1 for the smallest-possible annotation, and 1 for the smallest-possible value representation.

src/test/java/com/amazon/ion/impl/IonCursorBinaryTest.java

@@ -517,4 +517,35 @@ public void annotationWrapperLengthPlusCurrentIndexExceedsJavaLong(boolean const
             assertThrows(IonException.class, cursor::nextValue);
         }
     }
+
+    @Test
+    public void annotationWrapperLengthZeroAtStreamEndFailsCleanly() {
+        try (
+            IonCursorBinary cursor = initializeCursor(
+                // Note: a refillable reader would await more bytes before throwing. See the next test.
+                true,
+                0xE0, 0x01, 0x00, 0xEA, // IVM
+                0xEE, // Annotation wrapper, variable length
+                0x80  // VarUInt 0 at stream end. This is an error because annotation wrappers must wrap a value.
+            )
+        ) {
+            assertThrows(IonException.class, cursor::nextValue);
+        }
+    }
+
+    @ParameterizedTest(name = "constructFromBytes={0}")
+    @ValueSource(booleans = {true, false})
+    public void annotationWrapperLengthZeroFailsCleanly(boolean constructFromBytes) {
+        try (
+            IonCursorBinary cursor = initializeCursor(
+                constructFromBytes,
+                0xE0, 0x01, 0x00, 0xEA, // IVM
+                0xEE, // Annotation wrapper, variable length
+                0x80, // VarUInt 0. This is an error because annotation wrappers must wrap a value.
+                0x20, 0x20, 0x20 // Value bytes to pad the input. A refillable reader expects at least this many bytes to compose a valid annotation wrapper.
+            )
+        ) {
+            assertThrows(IonException.class, cursor::nextValue);
+        }
+    }
 }