diff --git a/dissect/cstruct/parser.py b/dissect/cstruct/parser.py index 0394a00..bdf664a 100644 --- a/dissect/cstruct/parser.py +++ b/dissect/cstruct/parser.py @@ -59,7 +59,7 @@ def _tokencollection() -> TokenCollection: "ENUM", ) TOK.add(r"(?<=})\s*(?P(?:[a-zA-Z0-9_]+\s*,\s*)+[a-zA-Z0-9_]+)\s*(?=;)", "DEFS") - TOK.add(r"(?P\*?[a-zA-Z0-9_]+)(?:\s*:\s*(?P\d+))?(?:\[(?P[^;\n]*)\])?\s*(?=;)", "NAME") + TOK.add(r"(?P\**?[a-zA-Z0-9_]+)(?:\s*:\s*(?P\d+))?(?:\[(?P[^;\n]*)\])?\s*(?=;)", "NAME") TOK.add(r"[a-zA-Z_][a-zA-Z0-9_]*", "IDENTIFIER") TOK.add(r"[{}]", "BLOCK") TOK.add(r"\$(?P[^\s]+) = (?P{[^}]+})\w*[\r\n]+", "LOOKUP") @@ -243,7 +243,7 @@ def _parse_field(self, tokens: TokenConsumer) -> Field: name = d["name"] count_expression = d["count"] - if name.startswith("*"): + while name.startswith("*"): name = name[1:] type_ = Pointer(self.cstruct, type_) diff --git a/tests/test_pointer.py b/tests/test_pointer.py index 7b80cbd..3619304 100644 --- a/tests/test_pointer.py +++ b/tests/test_pointer.py @@ -160,3 +160,17 @@ def test_pointer_sys_size(): c = cstruct.cstruct(pointer="uint16") assert c.pointer is c.uint16 + + +def test_pointer_of_pointer(): + cdef = """ + typedef uint32 **ptr; + """ + cs = cstruct.cstruct(pointer="uint8") + cs.load(cdef) + + ptr = cs.ptr(b"\x01\x02AAAA") + assert ptr == 1 + assert isinstance(ptr.dereference(), PointerInstance) + assert ptr.dereference() == 2 + assert ptr.dereference().dereference() == 0x41414141