How can encryption software accept password lengths which are not one of the AES key lengths?
I imagine that Truecrypt uses a KDF, to derive a 128/192/256-bit key from your password.  This is standard practice.  It's unadvisable to use a password directly, as they're generally low-entropy (predictable), and too short (as you've noted).