How to create the right Blowfish padding?
I use the OpenSSL library for Blowfish encryption in ecb mode. [...] What am I doing wrong?


You're using ECB mode and no authentication.



But as for the question itself.

Your input length is 29+1 bytes, which should get padded to 32 bytes, which should be ceil(32/3*4) = ceil(42.67) = 43 characters when base64-encoded, plus one = to round up to four. The output from the site you linked to seems to be of that length, but the output from your code looks like 48 characters, or 36 bytes. Extra bytes appear to show up from somewhere.

The output is made using this call to base64_encode:

unsigned char *out = (unsigned char *)malloc(OutSize);
base64_encode(out, strlen((char *)out))


The length is determined with strlen. But is the data in the out buffer terminated with a zero byte? I don't see that terminator anywhere, so it may be that strlen and hence base64_encode read past the buffer. 
Check what the strlen output is, compared to OutSize. 

In any case, the output from the cipher might contain zero bytes too, so I don't think you should be using strlen here at all. 

Also, the padding you are using destroys the length of the plaintext. That is, foobar and foobar0 pad to the same string, foobar00 and there's no way to tell them apart. You may want to consider some other method of padding. (Basically, encode the length of the padding in the padding itself, which means you may need to pad a full block.)