diff --git a/package/base-files/files/bin/ipcalc.sh b/package/base-files/files/bin/ipcalc.sh
index f923c9e1e5f11..a75817443b9b2 100755
--- a/package/base-files/files/bin/ipcalc.sh
+++ b/package/base-files/files/bin/ipcalc.sh
@@ -44,7 +44,7 @@ case "$1" in
 	echo "Prefix out of range ($n)" >&2
 	exit 1
     fi
-    netmask=$((~((1 << (32 - n)) - 1) & 0xffffffff))
+    netmask=$(prefix2netmask "$n") || exit 1
     shift
     ;;
 *)
diff --git a/package/base-files/files/lib/functions/ipv4.sh b/package/base-files/files/lib/functions/ipv4.sh
index ba7c56f6cc148..69b52f7cf9785 100755
--- a/package/base-files/files/lib/functions/ipv4.sh
+++ b/package/base-files/files/lib/functions/ipv4.sh
@@ -131,3 +131,12 @@ int2ip() {
     echo "$((n >> 24)).$(((n >> 16) & 255)).$(((n >> 8) & 255)).$((n & 255))"
 }
 
+# convert prefix into an integer bitmask
+prefix2netmask() {
+    local n="$(check_uint32 "$1")"
+
+    [ "$n" -gt 32 ] && __die "Prefix out-of-range ($n)"
+
+    echo "$(((~(uint_max >> n)) & uint_max))"
+}
+