diff --git a/llvm/lib/Analysis/MemoryLocation.cpp b/llvm/lib/Analysis/MemoryLocation.cpp
--- a/llvm/lib/Analysis/MemoryLocation.cpp
+++ b/llvm/lib/Analysis/MemoryLocation.cpp
@@ -257,10 +257,11 @@
     case LibFunc_memccpy:
       assert((ArgIdx == 0 || ArgIdx == 1) &&
              "Invalid argument index for memccpy");
+      // We only know an upper bound on the number of bytes read/written.
       if (const ConstantInt *LenCI =
               dyn_cast<ConstantInt>(Call->getArgOperand(3)))
-        return MemoryLocation(Arg, LocationSize::precise(LenCI->getZExtValue()),
-                              AATags);
+        return MemoryLocation(
+            Arg, LocationSize::upperBound(LenCI->getZExtValue()), AATags);
       break;
     default:
       break;