diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index d72e0d371..9a457f203 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -1402,8 +1402,8 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 	for (GList *l = rrs->head; l; l = l->next) {
 		struct ssrc_ctx *s = l->data;
 		if (i < 30) {
-			struct report_block *rr = (void *) ret->str + ret->len;
-			g_string_set_size(ret, ret->len + sizeof(*rr));
+			g_string_set_size(ret, ret->len + sizeof(struct report_block));
+			struct report_block *rr = (void *) ret->str + ret->len - sizeof(struct report_block);
 
 			// XXX unify with transcode_rr
 
@@ -1439,6 +1439,7 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 		i++;
 	}
 
+	sr = (void *) ret->str; // reacquire ptr after g_string_set_size
 	sr->rtcp.header.count = n;
 	sr->rtcp.header.length = htons((ret->len >> 2) - 1);
 
@@ -1456,8 +1457,8 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 
 	assert(sizeof(*sdes) == 24);
 
-	sdes = (void *) ret->str + ret->len;
 	g_string_set_size(ret, ret->len + sizeof(*sdes));
+	sdes = (void *) ret->str + ret->len - sizeof(*sdes);
 
 	*sdes = (__typeof(*sdes)) {
 		.sdes.header.version = 2,