VC6.0异常代码c0000005是什么原因，具体代码如下

#include
#include
#define LEN sizeof(struct student)
struct student
{
int num;
int score;
struct student *next;
};
int n=0;
struct student *creat()
{

struct student *head=NULL,*p1,*p2;
p1=p2=(struct student*)malloc(LEN);
scanf("%d %d",&p1->num,&p1->score);
while(p1->num!=0)
{ 
    n++;
    if(n==1)head=p1;
    else p2->next=p1;
    p2=p1;
    p1=(struct student*)malloc(LEN);
    scanf("%d %d",&p1->num,&p1->score);

}
p2->next-NULL;
free(p1);
return head;

}

int main()
{
struct student *pt;

pt=creat();
while(pt!=NULL)
{
    printf("num:%d sore:%d\n",pt->num,pt->score);
    pt=pt->next;
}

return 0;

}

p2->next-NULL;
->
p2->next=NULL;