External method 0 of IOSurfaceRoot is IOSurfaceRootUserClient::create_surface. This method expects to receive an xml string which it
deserializes into an OSDictionary. It then passes that dictionary to IOSurfaceRoot::createSurface(task *,OSDictionary *)
here's https://code.google.com/p/google-security-research/issues/detail?id=221 the relevant code
deserializes into an OSDictionary. It then passes that dictionary to IOSurfaceRoot::createSurface(task *,OSDictionary *)
here's https://code.google.com/p/google-security-research/issues/detail?id=221 the relevant code