[51] simulation in KeilC question

Hi, The test code is listed as below,

#pragma OT(0)
void main (void)
{
    DATA_MSG *b=NULL;
    DATA_MSG *a=NULL;

    b=(DATA_MSG *)malloc(sizeof(DATA_MSG));
    b->sMsgHeader.MessageType=E_Battery_Status;
    b->sMsgHeader.Extended=1;
    //Plug_Status=0;
    //Varible_Init();
    a=(DATA_MSG *)malloc(sizeof(DATA_MSG));
    a->sMsgHeader.MessageType=E_Get_Country_Info;
    a->sMsgHeader.Extended=0;
    if(b->sMsgHeader.Extended || a->sMsgHeader.Extended)
        EX3=1;
    else
        EX3=0;

I use the keil-C simulator to debug it. I found the pointer a and b point to the same memory location.
It means that the a overwrites b, I don't know why? Anyone knows it? Thanks a lot.