fix(tracing): use-after-realloc in ddtrace_format_tracestate

[morrisonlevi]

PROF-14628

Description

There is a logic error in ddtrace_format_tracestate that can theoretically result in a stale pointer read caused by a realloc.

I found this by investigating a customer crash which has smart_str_append in the stack. I am not sure it is this one.

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2026-05-12 16:37:41

Comparing candidate commit f880f75 in PR branch codex/spanlink-long-origin-smart-str with baseline commit 09ec639 in branch master.

Found 1 performance improvements and 5 performance regressions! Performance is the same for 188 metrics, 0 unstable metrics.

scenario:EmptyFileBench/benchEmptyFileBaseline

• 🟥 execution_time [+81.024µs; +341.736µs] or [+2.562%; +10.805%]

scenario:EmptyFileBench/benchEmptyFileBaseline-opcache

• 🟥 execution_time [+114.634µs; +394.466µs] or [+3.424%; +11.783%]

scenario:PHPRedisBench/benchRedisOverhead-opcache

• 🟩 execution_time [-50.173µs; -38.890µs] or [-4.781%; -3.706%]

scenario:SamplingRuleMatchingBench/benchRegexMatching1

• 🟥 execution_time [+52.860ns; +165.940ns] or [+3.528%; +11.075%]

scenario:SamplingRuleMatchingBench/benchRegexMatching2

• 🟥 execution_time [+35.535ns; +122.065ns] or [+2.408%; +8.271%]

scenario:SamplingRuleMatchingBench/benchRegexMatching3

• 🟥 execution_time [+32.715ns; +117.885ns] or [+2.175%; +7.838%]

[datadog-prod-us1-3]

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.67% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f880f75 | Docs | Datadog PR Page | Give us feedback!}

[bwoebi]

The extra { indent level is odd, but logic is right.

[morrisonlevi]

The extra block scope is to ensure that the temporaries are not used later on, because the whole issue with the bug is the pointer being used after it has been invalidated, so we didn't want their scope to live any longer than necessary.