多行文本框代码:各位大虾,帮忙看一下啊!关于对链表的操作.是哪里错了啊?

以下C程序是用来对链表的插入操作,可运行后,当我输入链表成员时,弹出错误对话框:"0x00404028"指令引用的"0xcdcdcdcd"内存．该内存不能为"written".
要终止程序，请单击”确定”．
要调试程序，请单击”取消”．
我的C程序如下：
#include<malloc.h>
#include<stdio.h>
#define null 0
#define len sizeof(struct student)
struct student
{
long num;
float score;
struct student *next;

};
int n;
struct student *creat(void)
{
struct student *head;
struct student *p1,*p2;
n=0;
p1=p2=(struct student*)malloc(len);
scanf("%ld,%f",p1->num,p1->score);
head=null;
while(p1->num!=0)
{
n=n+1;
if(n==1)head=p1;
else p2->next=p1;
p2=p1;
p1=(struct student*)malloc(len);
scanf("%ld,%f",&p1->num,&p1->score);
}
p2->next=null;
return(head);
}
void print(struct student *head)
{
struct student *p;
printf("\nbu%d records are:\n",n);
p=head;
if (head!=null)
do
{
printf("%ld %5.1f\n",p->num,p->score);
p=p->next;

}while(p!=null);

}
struct student * insert(struct student *head,struct student *stu)
{
struct student *p0,*p1,*p2;
p1=head;
p0=stu;
if(head==null)
{head=p0;p0->next=null;}
else
{
while((p0->num>p1->num)&&(p1->next!=null))
{
p2=p1;
p1=p1->next;
}
if(p0->num<=p1->num)
{
if(head==p1) head=p0;
else p2->next=p0;
p0->next=p1;
}
else
{p1->next=p0;p0->next=null;}
}
n=n+1;
return(head);
}
void main()
{
struct student *head,stu;

head=creat();
scanf("%ld,%f",&stu.num,&stu.score);

head=insert(head,&stu);
print(head);

}
各位帮忙看看啊！谢谢！