[OML] fix bugs in BCCH info parser for ip.access
diff --git a/openbsc/include/openbsc/abis_nm.h b/openbsc/include/openbsc/abis_nm.h
index 56f8e52..00697a3 100644
--- a/openbsc/include/openbsc/abis_nm.h
+++ b/openbsc/include/openbsc/abis_nm.h
@@ -701,7 +701,7 @@
 	u_int16_t arfcn;
 	u_int8_t rx_lev;
 	u_int8_t rx_qual;
-	u_int16_t freq_err;
+	int16_t freq_err;
 	u_int16_t frame_offset;
 	u_int32_t frame_nr_offset;
 	u_int8_t bsic;
diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c
index 757bb95..c64582a 100755
--- a/openbsc/src/abis_nm.c
+++ b/openbsc/src/abis_nm.c
@@ -2731,8 +2731,8 @@
 		cid->mnc += (buf[1] >> 4) *   1;
 	}
 
-	cid->lac = ntohs(buf+3);
-	cid->ci = ntohs(buf+5);
+	cid->lac = ntohs(*((u_int16_t *)&buf[3]));
+	cid->ci = ntohs(*((u_int16_t *)&buf[5]));
 }
 
 /* parse BCCH information IEI from wire format to struct ipac_bcch_info */
@@ -2750,6 +2750,8 @@
 	len = ntohs(*(u_int16_t *)cur);
 	cur += 2;
 
+	DEBUGP(DNM, "bcch info: %s\n", hexdump(cur, len));
+
 	binf->info_type = ntohs(*(u_int16_t *)cur);
 	cur += 2;
 
@@ -2780,7 +2782,7 @@
 	cur += 4;
 
 	if (binf->info_type & IPAC_BINF_BSIC)
-		binf->bsic = *cur++ & 0x3f;
+		binf->bsic = *cur & 0x3f;
 	cur++;
 
 	ipac_parse_cgi(&binf->cgi, cur);