iptables: fix possible NULL pointer access on constructing rule masks