throw new PACDecodingException("Malformed kerberos token");
            }

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if (mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION
                    || !(mechToken.getBaseObject() instanceof ASN1Sequence)) {
                throw new PACDecodingException("Malformed kerberos token");
            }

            new KerberosRelevantAuthData(malformedToken, keys);
        }, "A PACDecodingException should be thrown for a malformed token.");

        assertEquals("Malformed kerberos ticket", exception.getMessage(), "The exception message should indicate a malformed ticket.");
    }

    /**
     * Test constructor with an empty token.

    }

    /**
     * Test constructor with KERB_CHECKSUM_HMAC_MD5 type.
     *
     * @throws IOException if an I/O error occurs
     * @throws PACDecodingException if the PAC is malformed
     */
    @Test
    void testConstructorKerbChecksumHmacMd5() throws IOException, PACDecodingException {
        // Prepare data
        ByteArrayOutputStream baos = new ByteArrayOutputStream();

                    throw new PACDecodingException("Malformed Kerberos Ticket");
                }
                try {
                    this.ticket = new KerberosTicket(derTicket.getBaseObject().getEncoded(), this.apOptions, keys);
                } catch (IOException e) {
                    throw new PACDecodingException("Malformed Kerberos Ticket", e);
                }
                break;

            // Verify that the XML formatting is correct - no malformed closing tags
            assertFalse(result.contains("</plugin></plugins>"), "Should not have malformed closing tags");
            assertFalse(result.contains("</plugins></pluginManagement>"), "Should not have malformed closing tags");

            // Check that proper indentation is maintained

                throw new IOException("Malformed SPNEGO token " + constructed);
            }

            final ASN1Sequence vec = (ASN1Sequence) constructed.getBaseObject();

            final ASN1ObjectIdentifier spnego = (ASN1ObjectIdentifier) vec.getObjectAt(0);
            if (!SPNEGO_OID.equals(spnego)) {
                throw new IOException("Malformed SPNEGO token, OID " + spnego);
            }

    }

    @Test
    @DisplayName("parsing malformed token throws IOException")
    void testMalformedToken() {
        byte[] bad = new byte[] { 0x01, 0x02, 0x03 }; // not a valid ASN.1 tagged object
        assertThrows(IOException.class, () -> new NegTokenTarg(bad), "Malformed byte[] should cause IOException");
    }

    @Test

    }

    @Test
    @DisplayName("byte[] ctor: malformed DER is wrapped as PACDecodingException (IOException path)")
    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert

	D   string `json:"d,omitempty"`
	N   string `json:"n,omitempty"`
	E   string `json:"e,omitempty"`
	K   string `json:"k,omitempty"`
}

var (
	errMalformedJWKRSAKey = errors.New("malformed JWK RSA key")
	errMalformedJWKECKey  = errors.New("malformed JWK EC key")
)

// DecodePublicKey - decodes JSON Web Key (JWK) as public key
func (key *JWKS) DecodePublicKey() (crypto.PublicKey, error) {
	switch key.Kty {
	case "RSA":

     * @throws PACDecodingException if the string structure is malformed
     */
    public PacUnicodeString readUnicodeString() throws IOException, PACDecodingException {
        final short length = readShort();
        final short maxLength = readShort();
        final int pointer = readInt();

        if (maxLength < length) {
            throw new PACDecodingException("Malformed string in PAC");
        }