Looking at all those next() calls makes me wonder if you should add an optional $length parameter to get the next several bytes/characters. Collapsing three to five method dispatches and their concatenations seems like a potential improvement.

I also wonder if it would help to emulate walking through a string with a char pointer as in C -- instead of substr, keep around a variable holding the position in the buffer.

If you think either of these could help, I'd be happy to grab the CVS and play around a bit.