diff --git a/src/vendor/hqyj/fs_hi3861/common/bsp/src/hal_bsp_nfc_to_wifi.c b/src/vendor/hqyj/fs_hi3861/common/bsp/src/hal_bsp_nfc_to_wifi.c
index 8f09cd6ce5acffcd57c3240e3aa2d57e42cab121..a1c1572bd7e3bb8e79d0a74ac1cd1b67e38cc1b8 100644
--- a/src/vendor/hqyj/fs_hi3861/common/bsp/src/hal_bsp_nfc_to_wifi.c
+++ b/src/vendor/hqyj/fs_hi3861/common/bsp/src/hal_bsp_nfc_to_wifi.c
@@ -50,7 +50,7 @@ uint8_t ios_GetWiFi_ssid_passwd(const char *nfc_buff, char *wifi_name, char *wif
                          nfc_buff + OFFSET_HEAD + dataType_len + OFFSET_WIFI_NAME + 1, wifi_name_len) == 0) {
                 ret = 1; // 成功获取到WiFi名称和密码
             }
-            uint8_t wifi_passwd_len = nfc_buff[OFFSET_HEAD + dataType_len + OFFSET_WIFI_NAME + 1\
+            uint8_t wifi_passwd_len = nfc_buff[OFFSET_HEAD + dataType_len + OFFSET_WIFI_NAME - 1\
                                                + wifi_name_len + OFFSET_WIFI_PASSWD];
             if (memcpy_s(wifi_passwd, MAX_BUFF,
                          nfc_buff + OFFSET_HEAD + dataType_len + OFFSET_WIFI_NAME + \