You are correct that the security provided by a one-time pad is that a chosen-plaintext attacker can't distinguish between two messages of the same length, at least not with better advantage than their advantage at distinguishing the pad itself from uniform random.
Length, of course, can be a side channel for more interesting information, especially if variable-rate compression is involved! For example, the distribution of page sizes when downloading Wikipedia is likely to be very different from the distribution of file sizes when downloading the WikiLeaks archive.
If you have a maximum message length, you could extend your messages up to that maximum length with (say) zeros. But this can be costlier. Alternatively, you could break messages up into chunks. In any case, message length is something that a protocol designer must consider when striving for confidentiality!