TT#14008 call g_string_set_size before grabbing pointer

closes #1412

Change-Id: I02f97aa05788401586848cb36421f65828968864
(cherry picked from commit 219982ba06)

daemon/rtcp.c

@@ -1402,8 +1402,8 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 	for (GList *l = rrs->head; l; l = l->next) {
 		struct ssrc_ctx *s = l->data;
 		if (i < 30) {
-			struct report_block *rr = (void *) ret->str + ret->len;
-			g_string_set_size(ret, ret->len + sizeof(*rr));
+			g_string_set_size(ret, ret->len + sizeof(struct report_block));
+			struct report_block *rr = (void *) ret->str + ret->len - sizeof(struct report_block);
 
 			// XXX unify with transcode_rr
 
@@ -1439,6 +1439,7 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 		i++;
 	}
 
+	sr = (void *) ret->str; // reacquire ptr after g_string_set_size
 	sr->rtcp.header.count = n;
 	sr->rtcp.header.length = htons((ret->len >> 2) - 1);
 
@@ -1456,8 +1457,8 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 
 	assert(sizeof(*sdes) == 24);
 
-	sdes = (void *) ret->str + ret->len;
 	g_string_set_size(ret, ret->len + sizeof(*sdes));
+	sdes = (void *) ret->str + ret->len - sizeof(*sdes);
 
 	*sdes = (__typeof(*sdes)) {
 		.sdes.header.version = 2,