The length test was pasted from the ordinary decrypt function, when it should have been pasted from encrypt_length (which got this right). I've never tried to test those functions before, so I never noticed.