Bug 1650089

Description of problem:
With the last version ntp-4.2.6p5-12.el6_9.2.x86_64 that includes this patch: 
--- ntp-4.2.6p5/ntpd/ntp_proto.c.cve-2017-6464  2017-03-22 12:54:11.270454677 +0100
+++ ntp-4.2.6p5/ntpd/ntp_proto.c        2017-03-22 12:54:11.279454706 +0100
@@ -3017,8 +3017,10 @@ peer_xmit(
                        }
                }
                peer->t21_bytes = sendlen;
-               sendpkt(&peer->srcadr, peer->dstadr, sys_ttl[peer->ttl],
-                   &xpkt, sendlen);
+               sendpkt(&peer->srcadr, peer->dstadr,
+                       sys_ttl[(peer->ttl >= sys_ttlmax) ? sys_ttlmax : peer->ttl],
+                       &xpkt, sendlen);
                peer->sent++;
                peer->throttle += (1 << peer->minpoll) - 2;

the ttl option is not correctly managed:
For example:
broadcast 224.0.1.1 ttl 6

will configure a ttl of 1 if the destination address is not in the same network.
But if we add an line 
"ttl 8" in the ntp.conf file, then ttl is then set to 8 (and not 6 ..)


The first issue is that in the patched code, sys_ttlmax is -1 thus peer->ttl is not used but -1 ... 

This is due to this part:

8<---------- 8< ---------------- 8< ---------------- 8< --------
static void
config_ttl(
        struct config_tree *ptree
        )
{
        int i = 0;
        int *curr_ttl;

        curr_ttl = queue_head(ptree->ttl);
        while (curr_ttl != NULL) {
                if (i < COUNTOF(sys_ttl))
                        sys_ttl[i++] = (u_char)*curr_ttl;
                else
                        msyslog(LOG_INFO,
                                "ttl: Number of TTL entries exceeds %lu. Ignoring TTL %d...",
                                (u_long)COUNTOF(sys_ttl), *curr_ttl);

                curr_ttl = next_node(curr_ttl);
        }
        sys_ttlmax = i - 1;
}
8<---------- 8< ---------------- 8< ---------------- 8< --------

ptree->ttl is 0, thus sys_ttlmax is -1 ...

If a ttl is not defined, it should be 127 according to the documentation, that is not the case, even if the broadcast address is for the local network (64).

Version-Release number of selected component (if applicable):
 ntp-4.2.6p5-12.el6_9.2.x86_64

How reproducible:
Easy

Steps to Reproduce:
1. Configure a broadcast with ttl option (or without)
2. Check the ttl of the message
3.

Actual results:
ntp-4.2.6p5-10.el6_8.2.x86_64:
	1. ttl configured to 5:
		- same network: => ttl 64
		- other network: => ttl 160
	2. no ttl option:
		- same network: => ttl 64
		- other network: => ttl 1
ntp-4.2.6p5-12.el6_9.1.x86_64:
	1. ttl configured to 5:
		- same network: => ttl 64
		- other network: => ttl 1
	2. no ttl option:
		- same network: => ttl 64
		- other network: => ttl 1

Expected results:
ttl correctly set according to the configuration.

Additional info:
I honestly don't know exactly what should be the value to ensure security but the documentation and ntp behaviour should match.
Thank you