Prior to this fix, when matching addresses using mask,
extra bits could be used for  comparison, e.g to
match with "a.b.c.d/24" , 27 bits were compared rather than 24.

The patch fixes the calculation.