Stupid code review tool won't let me make a note on the call to ParserParseFile; but you can't safely use the name stored in tmp there, either: nothing prevents an attacker from substituting a file of their own chosing in place of yours in between your writing the file named by tmp and your reading of it in ParserParseFile().  The only acceptable use of the contents of tmp hereafter is the unlink() call below; everything else should be done via the file handle you got back from mkstemp(); or use a tmpfile() instead.

This probably obliges you to restructure ParserParseFile() so that other callers can continue using it as at present, it only deals with opening the file and both it and your code here then call a second function that takes a file handle or stream.  This would make tmpfile() a viable solution, and clearly preferrable to mkstemp() here (if you continue using it, you probably need to use mkostemp and pass flags that let you read as well as write from the same file descriptor).