diff --git a/daemon/media_player.c b/daemon/media_player.c
index 3e4b30794..0006b250a 100644
--- a/daemon/media_player.c
+++ b/daemon/media_player.c
@@ -163,47 +163,13 @@ struct send_timer *send_timer_new(struct packet_stream *ps) {
 	return st;
 }
 
-
-// call is locked in R
-static void send_timer_send_rtcp(struct ssrc_ctx *ssrc_out, struct call *call, struct packet_stream *ps) {
-	GQueue rrs = G_QUEUE_INIT;
-	rtcp_receiver_reports(&rrs, call->ssrc_hash, ps->media->monologue);
-
-	ilog(LOG_DEBUG, "Generating and sending RTCP SR for %x and up to %i source(s)",
-			ssrc_out->parent->h.ssrc, rrs.length);
-
-	GString *sr = rtcp_sender_report(ssrc_out->parent->h.ssrc,
-			atomic64_get(&ssrc_out->last_ts),
-			atomic64_get(&ssrc_out->packets),
-			atomic64_get(&ssrc_out->octets),
-			&rrs);
-
-	socket_sendto(&ps->selected_sfd->socket, sr->str, sr->len, &ps->endpoint);
-	g_string_free(sr, TRUE);
-}
-
 // call is locked in R
 static void send_timer_rtcp(struct send_timer *st, struct ssrc_ctx *ssrc_out) {
 	struct call_media *media = st->sink ? st->sink->media : NULL;
 	if (!media)
 		return;
-	struct call *call = media->call;
-
-	// figure out where to send it
-	struct packet_stream *ps = media->streams.head->data;
-	if (MEDIA_ISSET(media, RTCP_MUX))
-		;
-	else if (!media->streams.head->next)
-		;
-	else {
-		struct packet_stream *next_ps = media->streams.head->next->data;
-		if (PS_ISSET(next_ps, RTCP))
-			ps = next_ps;
-	}
-
-	log_info_stream_fd(ps->selected_sfd);
 
-	send_timer_send_rtcp(ssrc_out, call, ps);
+	rtcp_send_report(media, ssrc_out);
 
 	// XXX missing locking?
 	ssrc_out->next_rtcp = rtpe_now;
diff --git a/daemon/rtcp.c b/daemon/rtcp.c
index 211e97a7e..f93f4d2f4 100644
--- a/daemon/rtcp.c
+++ b/daemon/rtcp.c
@@ -16,6 +16,7 @@
 #include "rtcplib.h"
 #include "ssrc.h"
 #include "sdp.h"
+#include "log_funcs.h"
 
 
 
@@ -1398,8 +1399,8 @@ GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32
 
 	// receiver reports
 	int i = 0, n = 0;
-	for (GList *l = rrs->head; l; l = l->next) {
-		struct ssrc_ctx *s = l->data;
+	while (rrs->length) {
+		struct ssrc_ctx *s = g_queue_pop_head(rrs);
 		if (i < 30) {
 			struct report_block *rr = (void *) ret->str + ret->len;
 			g_string_set_size(ret, ret->len + sizeof(*rr));
@@ -1489,3 +1490,38 @@ void rtcp_receiver_reports(GQueue *out, struct ssrc_hash *hash, struct call_mono
 	}
 	rwlock_unlock_r(&hash->lock);
 }
+
+
+// call must be locked in R
+void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out) {
+	struct call *call = media->call;
+
+	// figure out where to send it
+	struct packet_stream *ps = media->streams.head->data;
+	if (MEDIA_ISSET(media, RTCP_MUX))
+		;
+	else if (!media->streams.head->next)
+		;
+	else {
+		struct packet_stream *next_ps = media->streams.head->next->data;
+		if (PS_ISSET(next_ps, RTCP))
+			ps = next_ps;
+	}
+
+	log_info_stream_fd(ps->selected_sfd);
+
+	GQueue rrs = G_QUEUE_INIT;
+	rtcp_receiver_reports(&rrs, call->ssrc_hash, ps->media->monologue);
+
+	ilog(LOG_DEBUG, "Generating and sending RTCP SR for %x and up to %i source(s)",
+			ssrc_out->parent->h.ssrc, rrs.length);
+
+	GString *sr = rtcp_sender_report(ssrc_out->parent->h.ssrc,
+			atomic64_get(&ssrc_out->last_ts),
+			atomic64_get(&ssrc_out->packets),
+			atomic64_get(&ssrc_out->octets),
+			&rrs);
+
+	socket_sendto(&ps->selected_sfd->socket, sr->str, sr->len, &ps->endpoint);
+	g_string_free(sr, TRUE);
+}
diff --git a/include/rtcp.h b/include/rtcp.h
index 73edc6276..caa47cde3 100644
--- a/include/rtcp.h
+++ b/include/rtcp.h
@@ -39,5 +39,6 @@ void rtcp_init(void);
 
 GString *rtcp_sender_report(uint32_t ssrc, uint32_t ts, uint32_t packets, uint32_t octets, GQueue *rrs);
 void rtcp_receiver_reports(GQueue *out, struct ssrc_hash *hash, struct call_monologue *ml);
+void rtcp_send_report(struct call_media *media, struct ssrc_ctx *ssrc_out);
 
 #endif