diff --git a/tools/binpac/src/CMakeLists.txt b/tools/binpac/src/CMakeLists.txt
index d2b14b210b..921e51d87e 100644
--- a/tools/binpac/src/CMakeLists.txt
+++ b/tools/binpac/src/CMakeLists.txt
@@ -82,6 +82,7 @@ set(binpac_SRCS
     pac_id.h
     pac_inputbuf.h
     pac_let.h
+    pac_nullptr.h
     pac_number.h
     pac_output.h
     pac_param.h
diff --git a/tools/binpac/src/pac_common.h b/tools/binpac/src/pac_common.h
index 8ddc7f1c7f..0808450c27 100644
--- a/tools/binpac/src/pac_common.h
+++ b/tools/binpac/src/pac_common.h
@@ -65,6 +65,7 @@ class InputBuffer;
 class LetDef;
 class LetField;
 class ID;
+class Nullptr;
 class Number;
 class Output;
 class PacPrimitive;
diff --git a/tools/binpac/src/pac_expr.cc b/tools/binpac/src/pac_expr.cc
index fca87cff66..360562afc5 100644
--- a/tools/binpac/src/pac_expr.cc
+++ b/tools/binpac/src/pac_expr.cc
@@ -5,6 +5,7 @@
 #include "pac_exception.h"
 #include "pac_exttype.h"
 #include "pac_id.h"
+#include "pac_nullptr.h"
 #include "pac_number.h"
 #include "pac_output.h"
 #include "pac_record.h"
@@ -64,7 +65,6 @@ Expr::Expr(ID* arg_id) : DataDepElement(EXPR) {
     init();
     expr_type_ = EXPR_ID;
     id_ = arg_id;
-    num_operands_ = 0;
     orig_ = strfmt("%s", id_->Name());
 }
 
@@ -72,15 +72,20 @@ Expr::Expr(Number* arg_num) : DataDepElement(EXPR) {
     init();
     expr_type_ = EXPR_NUM;
     num_ = arg_num;
-    num_operands_ = 0;
     orig_ = strfmt("((int) %s)", num_->Str());
 }
 
+Expr::Expr(Nullptr* arg_nullp) : DataDepElement(EXPR) {
+    init();
+    expr_type_ = EXPR_NULLPTR;
+    nullp_ = arg_nullp;
+    orig_ = strfmt("%s", nullp_->Str());
+}
+
 Expr::Expr(ConstString* cstr) : DataDepElement(EXPR) {
     init();
     expr_type_ = EXPR_CSTR;
     cstr_ = cstr;
-    num_operands_ = 0;
     orig_ = cstr_->str();
 }
 
@@ -88,7 +93,6 @@ Expr::Expr(RegEx* regex) : DataDepElement(EXPR) {
     init();
     expr_type_ = EXPR_REGEX;
     regex_ = regex;
-    num_operands_ = 0;
     orig_ = strfmt("/%s/", regex_->str().c_str());
 }
 
@@ -257,6 +261,7 @@ void Expr::GenCaseEval(Output* out_cc, Env* env) {
 void Expr::GenEval(Output* out_cc, Env* env) {
     switch ( expr_type_ ) {
         case EXPR_NUM: str_ = num_->Str(); break;
+        case EXPR_NULLPTR: str_ = nullp_->Str(); break;
 
         case EXPR_ID:
             if ( ! env->Evaluated(id_) )
diff --git a/tools/binpac/src/pac_expr.def b/tools/binpac/src/pac_expr.def
index d7c0319522..5b1fbec5c3 100644
--- a/tools/binpac/src/pac_expr.def
+++ b/tools/binpac/src/pac_expr.def
@@ -1,5 +1,6 @@
 EXPR_DEF(EXPR_ID, 		0, "%s")
 EXPR_DEF(EXPR_NUM,		0, "%s")
+EXPR_DEF(EXPR_NULLPTR,		0, "%s")
 EXPR_DEF(EXPR_CSTR,		0, "%s")
 EXPR_DEF(EXPR_REGEX,		0, "REGEX(%s)")
 EXPR_DEF(EXPR_SUBSCRIPT,	2, "@element@(%s[%s])") 
diff --git a/tools/binpac/src/pac_expr.h b/tools/binpac/src/pac_expr.h
index 07c33f9dc1..c24afd4f88 100644
--- a/tools/binpac/src/pac_expr.h
+++ b/tools/binpac/src/pac_expr.h
@@ -18,6 +18,7 @@ public:
 
     Expr(ID* id);
     Expr(Number* num);
+    Expr(Nullptr* nullp);
     Expr(ConstString* s);
     Expr(RegEx* regex);
     Expr(ExprList* args); // for EXPR_CALLARGS
@@ -101,6 +102,7 @@ private:
     RegEx* regex_;        // EXPR_REGEX
     ExprList* args_;      // EXPR_CALLARGS
     CaseExprList* cases_; // EXPR_CASE
+    Nullptr* nullp_;      // EXPR_NULLPTR
 
     string str_;  // value string
     string orig_; // original string for debugging info
diff --git a/tools/binpac/src/pac_nullptr.h b/tools/binpac/src/pac_nullptr.h
new file mode 100644
index 0000000000..f1fe8e545a
--- /dev/null
+++ b/tools/binpac/src/pac_nullptr.h
@@ -0,0 +1,14 @@
+#ifndef pac_nullptr_h
+#define pac_nullptr_h
+
+#include "pac_common.h"
+
+class Nullptr : public Object {
+public:
+    const char* Str() const { return s.c_str(); }
+
+protected:
+    const string s = "nullptr";
+};
+
+#endif // pac_nullptr_h
diff --git a/tools/binpac/src/pac_parse.yy b/tools/binpac/src/pac_parse.yy
index b1172c307c..95488f7f8d 100644
--- a/tools/binpac/src/pac_parse.yy
+++ b/tools/binpac/src/pac_parse.yy
@@ -25,7 +25,7 @@
 %token TOK_EMBEDDED_ATOM TOK_EMBEDDED_STRING
 %token TOK_PAC_VAL TOK_PAC_SET TOK_PAC_TYPE TOK_PAC_TYPEOF TOK_PAC_CONST_DEF 
 %token TOK_END_PAC
-%token TOK_EXTERN
+%token TOK_EXTERN TOK_NULLPTR
 
 %nonassoc '=' TOK_PLUSEQ
 %left ';'
@@ -66,6 +66,7 @@
 %type <function> funcproto function
 %type <id> TOK_ID tok_id optfieldid 
 %type <input> input
+%type <nullp> TOK_NULLPTR
 %type <num> TOK_NUMBER
 %type <pacprimitive> embedded_pac_primitive
 %type <param> param
@@ -105,6 +106,7 @@
 #include "pac_id.h"
 #include "pac_inputbuf.h"
 #include "pac_let.h"
+#include "pac_nullptr.h"
 #include "pac_output.h"
 #include "pac_param.h"
 #include "pac_paramtype.h"
@@ -160,6 +162,7 @@ extern Output* source_output;
 	InputBuffer		*input;
 	LetFieldList		*letfieldlist;
 	LetField		*letfield;
+	Nullptr			*nullp;
 	Number			*num;
 	PacPrimitive		*pacprimitive;
 	Param 			*param;
@@ -576,6 +579,10 @@ expr		:	tok_id
 				{
 				$$ = new Expr($1);
 				}
+		|	TOK_NULLPTR
+				{
+				$$ = new Expr($1);
+				}
 		|	expr '[' expr ']'
 				{
 				$$ = new Expr(Expr::EXPR_SUBSCRIPT, $1, $3);
diff --git a/tools/binpac/src/pac_scan.ll b/tools/binpac/src/pac_scan.ll
index e3b35d3663..edcb216c94 100644
--- a/tools/binpac/src/pac_scan.ll
+++ b/tools/binpac/src/pac_scan.ll
@@ -21,6 +21,7 @@
 #include "pac_expr.h"
 #include "pac_flow.h"
 #include "pac_id.h"
+#include "pac_nullptr.h"
 #include "pac_number.h"
 #include "pac_output.h"
 #include "pac_param.h"
@@ -200,6 +201,10 @@ ESCSEQ	(\\([^\n]|[0-7]{3}|x[[:xdigit:]]{2}))
 				yylval.val = AnalyzerDataUnit::FLOWUNIT;
 				return TOK_DATAUNIT;
 				}
+<INITIAL>nullptr		{
+				yylval.nullp = new Nullptr();
+				return TOK_NULLPTR;
+				}
 <INITIAL>of			return TOK_OF;
 <INITIAL>offsetof 		return TOK_OFFSETOF;
 <INITIAL>padding		return TOK_PADDING;